Arbia Riahi Sfar
email: arbia.sfar@hds.utc.fr

Yacine Challal
email: y_challal@esi.dz

Pascal Moyal
email: pascal.moyal@utc.fr

Enrico Natalizio
email: enrico.natalizio@loria.fr

Arbia Riahi Sfar

A Game Theoretic Approach for Privacy Preserving Model in IoT-Based Transportation

Keywords: Internet of Things, intelligent transportation, privacy, game theory, Markov chains

come

I. Introduction

The evolution of IoT invokes massive possibilities for exchanging private data enabling new business models across heterogeneous networks. Intelligent Transportation Systems (ITS) noticed a fast development in communication technologies as one of the key founders of IoT, and provides numerous applications to solve problems related to modern transportation environment. Authors in [START_REF] Xu | Internet of vehicles in big data era[END_REF] surveyed the Internet of Vehicles (IoV) in big data era, and investigated the application of IoV big data in autonomous vehicles, and discussed the emerging issues. One of the most important applications is transport logistics, which ensure various capabilities as real time cargo and goods tracking/location, automate scheduling/delivery, and vehicles capacity management.

Due to the dynamic nature of the entities, their interactions, and the topology of the network, new privacy and security issues arise. Based on information such as identities, pseudonyms, locations, and profiles; an enemy can initiate active or passive attacks to thieve social data or to damage communications. For instance, the rising security and privacy issues of Mobile Social Networks (MSN) are strongly related to the application design and the user's needs. Commonly, during MSN applications conception, security and privacy aspects such as the trust relations, private information leakage, and malicious behavior, need to be considered [START_REF] Liang | Security and privacy in mobile social networks: challenges and solutions[END_REF].

As IoT devices are known for their limited memory space and computational capabilities, conventional solutions, as encryption methods, are inadequate to solve many privacy concerns. One promising solution is the use of game theory to model interactions between actors and assist them during decision making to balance valuable vehicular social information with personal and private information. Many papers have considered both gamebased or payoff-based dynamical system, such as [START_REF] Blume | Evolutionary stability in games of communication[END_REF], where authors dealt with evolutionary stability in games of communication. In [START_REF] Meyer | Quantum strategies[END_REF], author considered game theory from the perspective of quantum algorithms, and in [START_REF] Meyer | Statistical mechanics of voting[END_REF] statistical mechanics of voting are debated. Recently, a distributed, dynamical system view of finite, static games was proposed in [START_REF] Li | A distributed, dynamical system view of finite, static games[END_REF].

In this paper, we propose a game theory-based privacy preservation model between data holder (driver, intelligent devices, etc.) and data requester (employer, supplier, etc.), to find the optimal protection strategy for a data holder to preserve private data over a series of interactions with a data requester. We define a set of states for each player and we use a Markovian chain to model transitions. An utility function is proposed to evaluate the compromise between privacy concession and incentive motivation, and make the adequate decision of disclosing private data or not.

The remaining of this paper is organized as follows. Section II depicts the most important research activities related to the use of game theory to solve privacy concerns in IoT-based applications. Section III discusses the privacy issues in ITS and lists the most important attacks of automated vehicles. Section IV presents the overall architecture of an ITS using game theory in privacy preservation. Section V explains game strategies, actors, equilibrium and utility function. Section VI presents numerical results; and the last section concludes the paper and proposes possible future directions.

II. Related work

In literature, many approaches have been proposed to protect privacy, and a whole bunch of privacy negotiation tools and research can be explored. Applications examples include Windows CardSpace 1 , the Microsoft's client software for the Identity Metasystem, Idemix 2 (Identity Mixer), and P3P 3 (Platform for Privacy Preferences Project). Besides, a great deal of effort was made in data minimization, anonymity and unlinkability [START_REF] Bichsel | Data-minimizing authentication goes mobile[END_REF]- [START_REF] Verhaeghe | A mobile and reliable anonymous epoll infrastructure[END_REF]. Some of the most prominent research proposals debating privacy in IoT environments are summarized in table I where we use three parameters: input measures (adversary's estimate, adversary's resources, true outcome, prior knowledge, parameters), output measures (uncertainty, information gain or loss, similarity/diversity, indistinguishability, adversary's success probability, error, time, accuracy/precision) [START_REF] Wagner | Technical privacy metrics: a systematic survey[END_REF], and privacy properties (anonymity, pseudonymity, unlinkability, and unobservability) 4 , to compare our work to anonymization (k-Anonymity, l-Diversity, t-Closeness, PPDP/PPDM), cryptography, blocking approaches, and differential privacy.

Due to its mathematical rigor and its numerous solutions, many researchers choose to use game theory in formulating interactions between actors in security scenarios. In [START_REF] Panaousis | Game-theoretic model of incentivizing privacy-aware users to consent to location tracking[END_REF], a Stackelberg Bayesian game between the user and the company was proposed to make a rational decision of the service provider in conjunction with rational decision-making of the users who wish to protect their location privacy. However, authors did not provide any information theory-based metrics, and did not consider active attacks scenarios. In [START_REF] He | A game theory-based analysis of data privacy in vehicular sensor networks[END_REF], authors focused on location privacy, where a defender uses the privacy protecting techniques against the attack strategies implemented by an adversary. They consider both passive and active attack scenarios, and proposed complete information and incomplete information games. Nevertheless, their work consider only location privacy information and did not provide any privacy quantification method. To enhanced information usage in online information service, authors in [START_REF] Li | Enforcing differential privacy for shared collaborative filtering[END_REF] integrated privacy protection methodology into the process of shared data generation and consumption, under a differential privacy framework. In [START_REF] Wang | Parallel driving in cpss: A unified approach for transport automation and vehicle intelligence[END_REF], authors proposed a novel unified approach, parallel driving, a cloud-based cyberphysical social systems framework aiming at synergizing connected automated driving. Although their considerable contribution in automotive technology, they did not debated security aspects. In [START_REF] Tan | Private information retrieval in vehicular location-based services[END_REF], authors proposed a privacy-provable and deployable framework for Vehicular Location-Based Services (VLBS) based on com- As stochastic games can be used to model the interactions between malicious attackers and defenders, we adopt their principle to deal with privacy concerns in ITS scenarios. They capture interactions between game players and system's dynamics, to compute probabilities of expected adversary behavior, build a transition matrix, and evaluate the interconnected system security.

III. Recent attacks and privacy issues of connected vehicles

ITS core technologies include reliable and real-time platforms managing mixed vehicle services, efficient navigation, improved decision-making algorithms, communication and network technologies, and open service platform. They enable interactions among sensors, vehicles, drivers and supervisors, and integrate features of both vehicular networks and social networks, which raise considerable privacy issues. In figure 1, an abstract model of data exchange vectors in the vehicular communication domain is shown, and attack surfaces are highlighted. For example, location privacy issues may be caused by unencrypted messages (identifier, location, speed, etc.) exchanged over the network, which may be linked to driver's identity and lead to identity theft, tracking and users linkage. Consequently, the system can be abused by third parties (employers, insurance companies, criminals) to track individuals, and re-identify anonymous users in a social network graph [START_REF] Devare | A survey on internet of things for smart vehicles[END_REF].

From security point of view, these systems are exposed to many risks as attacking autonomous vehicle sensors including wheel encoder, on-board unit, e-maps, ultrasonic sensors, radar, camera, GPS, wireless cards, etc. Many security attacks may occur such as jamming, replay, relay, spoofing, tracking, and blinding. To highlight the seriousness of privacy concerns, we summarize the most important attacks during the last few years in table II. To avoid threats, countermeasures such as detect jamming attacks on cameras via spectral analysis, increase redundancy by adding cameras, etc. may be taken [START_REF] Petit | Revisiting attacker model for smart vehicles[END_REF].

In [START_REF] Currie | White paper: Developments in car hacking[END_REF], SANS institute proposed four main solutions to prevent car hacking. First, cryptography methods may be used to solve the lack of message confidentiality problems, but may be affected by the maximum data field size allowed by CAN protocol's. Second, the use of device authorization may prevent unauthorized computers or CAN controllers from broadcasting CAN messages, but requires additional processing time to CAN transmissions, additional expense for automakers, and additional weight on the vehicle. Third, defense in depth provides multiple layers security but needs to find a balance between the protection capability and cost, performance, and operations considerations. Fourth, security by design may be considered into vehicle systems from the ground up, but many security problems were caused by the lack of features due to the development of programs before cars were connected to Internet, and automobile industry which moves slowly and resists change. These challenges affect the whole IoT ecosystem, and may lead to devices failure, or even to serious exposure to danger. For example, many difficulties about managing cryptographic material may occur (key renewal, update, To develop more realistic models of interactions between untrusted entities, researchers accord significant interest in combining game theory techniques and cryptographic schemes [START_REF] Katz | Bridging Game Theory and Cryptography: Recent Results and Future Directions[END_REF]. Many game theoretic approaches were proposed recently to explore practical and defensible ways of safeguarding connected cars against many types of abuse, including static, cooperation, sequence, and traceability games [START_REF] Ferrag | Privacypreserving schemes for ad hoc social networks: A survey[END_REF]. This can be explained by the fact that both game theory and cryptography are concerned with interactions among entities with conflicting interests. In the cryptographic setting, a set of communicating entities aim to evaluate a function on their inputs, and receive some output of the computation. To face malicious behavior, cryptography guarantees properties such as secrecy, correctness and fairness. Game theory is more open-ended, by understanding natural behaviors and goals of entities, and conceiving a set of rules leading to decisions with desirable properties. It guarantees some payoff for the players according to their joint actions [START_REF] Dodis | Cryptography and game theory[END_REF]. Thus, ideas from both disciplines may be combined to model interaction with conflicting interests.

IV. Proposed Model

We propose a solution for privacy preservation using game theory, which can be used to complete cryptographic mechanisms. To position our work, we use the Common Criteria Privacy Components10 (anonymity, pseudonymity, unlinkability, unobservability). We aim to assure unobservability using data protection, to mitigate the attacks of location tracking and break forward secrecy (shown in figure 1). An illustrative example of IoT application in ITS field is shown in figure 2. By using a recently proposed systemic and cognitive approach for security in IoT [START_REF] Riahi | A systemic approach for iot security[END_REF]- [START_REF] Riahi | A roadmap for security challenges in the internet of things[END_REF], we can distinguish four main stakeholders: person (users, drivers, experts, etc.), technological ecosystem (software, robotics, networks, etc.), process (manufacturing, integration, etc.), and intelligent objects (sensors, RFID, monitoring equipment, payment devices, etc.). In this scenario, we assume that private data are hold by sensors, intelligent vehicles and drivers. They are connected to employer/supervisor to optimize the movement of people and products, improve financial profit, public safety, and the environment, etc.

More precisely, we consider the fleet management domain where ITS service providers (insurance companies, criminals , advertisement) may attempt to access sensing data to improve their activities. They may carry an attack or encourage data holder through incentive motivation. We define a game involving two players that use their goals, believes and intentions to make real-time decisions to protects their interests. As we believe that road security can not be negotiated, our approach is not suitable for exchanges related to emergency situations. As nowadays vehicles are already complex systems with many computers and integrated sensors, and able to collect information and exchange them in real time with other vehicles [START_REF] Papadimitratos | Vehicular communication systems: Enabling technologies, applications, and future outlook on intelligent transportation[END_REF], we adopt the on-vehicle computation (utility function, steady state, etc.) option.

A. Model description

In the scenario presented in figure 2, two types of players are involved: Data Holder (DH) and Data Requester (DR). DH may be a sensor or a driver, and may sell its sensing data if the DR offers a motivating buying price and a minimum privacy preference level is respected. DR may be a supervisor or a service provider, and may lead an attack to access sensing data or attempt to buy them from a particular driver or a set of sensors. In this work, we suppose the existence of an automated data acquisition process, a data detection and data categorization mechanism to determine driver's identification and activities, as well as to track commercial vehicles and determine driver's health and environmental data. To define an adequate pricing model for private data, many solutions are given in [START_REF] Niyato | Smart data pricing models for the internet of things: a bundling strategy approach[END_REF]. In practice, we can adopt utility maximization pricing schemes which describe the level of preference that a player receives from consuming goods or services. Regarding the attack model, we distinguish two cases: passive attack where the adversary's goal is to read private information without providing any effort to find potential victims, and active attack where the adversary is active by providing effort to encounter victims and to identify private data [START_REF] He | A game theory-based analysis of data privacy in vehicular sensor networks[END_REF].

B. Actors and game players

Game players/actors and roles are summarized in table III where we propose two different scenarios. In the incentive scenario, DH owns the private data and DR is a curious player which proposes an incentive motivation value to access private data. In the attack scenario, DR is a malicious player which leads an attack to access private data. Income and expense of each player differ in both scenarios according to the player strategy. When the equilibrium is reached, players are either satisfied by the realized balance between data privacy and incentive motivation, or stop the game to minimize expenses.

V. Game theoretic formulation

A. Utility functions

The utility function of a player pl, U pl expresses the preferences over outcomes. He/she prefers outcome a to outcome a ′ if U pl (a) > U pl (a ′ ). It considers the privacy concession made by DH and the incentive motivation proposed by DR. During the game, DR aims to access private data, and is not directly concerned by privacy concession. Then, we believe that DH is the key player of the game, and the utility function reflects his/her ability to disclose or not private data against an interesting incentive motivation. To remain applicable in the attack scenario where no incentive are proposed, this function will be adapted with a null incentive value.

We consider two sub-functions: a loss function, denoted by L, which returns the privacy concession, and a gain function G, which represents the impact of the incentive motivation on the player. Mathematically, we chose to use sigmoid functions for L and G because they provide a good example of non-linear and quickly increasing functions of the probability of disclosure, and makes computation easier than arbitrary activation functions.

L(p priv ) = 1 1 + e -gpriv * (ppriv-hpriv) ; G(p inc ) = 1 1 + e -ginc * (pinc-hinc) where g priv and g inc are the steepness of sigmoid functions, and h priv and h inc are their centers. In practice, g priv depends on user preferences and realized privacy, and g inc depends on motivation value proposed by DR, and an external constant reflecting the market conditions. p priv is the probability of making privacy concession by DH, and p inc is the probability of accepting the incentive motivation proposed by DR. Observe that these two probabilities are defined independently, however in the present model the only context in which the DH makes a privacy concession is when it accepts the incentive motivation proposed by the DR. Therefore the two events are the same, and their probabilities coincide. We thus can set p op := p priv = p inc . Then, the overall objective of the game is to maximize the function:

U pl (p op ) = (1 -L(p op )) * G(p op ) for all p op ∈ [0, 1]

B. Equilibrium solution

The equilibrium of the game is found by solving the following optimization problem:

p D := Argmax {U pl (p op ) ; p op ∈ [0, 1]} (1)
that is p D is the value of p op maximizing the utility function and thereby, reflecting the optimal probability of disclosing private data. Observe that the optimum, p D can be derived explicitly in the particular case where g priv = g inc and h inc > h priv . In the general case we retrieve the value of p D numerically (figure 12).

C. Strategies 1) Assumptions:

We suppose that the following assumptions are reasonable in IoT context-based applications:

• The current context is only observable by DH.

• DR can only deduce the context based on the modified sensing data. 2) Decision parameters: Game strategies are described by transitions between states and depend on four parameters: (1) energy and communication facilities, (2) data privacy concession, (3) incentive motivation, and (4) attack/intrusion. For convenience, we summarize notations used in the game formulation in table IV.

3) State transitions: Markov chains are commonly used to represent discrete events random systems, in discrete time, under the assumption that at any time, the distribution of the next state depends only on the value of the random input, and of the current state. For our model the Markov representation has the following state-space: S = {W, D, R, OoP }∪{(N, i) : i = 0, 1, 2, ...}∪{(AD, j) : j = 0, 1, 2, ...}.

Where W stands for wait, D for disclose, R for reject and Oop for Out of P rocess (table V). Any state of the form (N, i) is interpreted as "the agent has been negotiating for i time epochs", and likewise for any state of the form (AD, j), where AD stands for "Attacking/Defending". The game tree is illustrated in figure 3 where we distinguish the two different scenarios explained in IV-B. In each case, DR may iterate the N state, or the AD state until reaching a satisfying agreement (disclose or reject).

Figure 4 respectively. We assume that p D and p R , i.e. respectively the probability of disclosing and rejecting in the first scenario, whenever these actions are possible, are obtained via the optimization scheme below. Namely, p D solves (1) and p R is such that p D + p R = 1. Similarity, we define p ′ D and p ′ R , respectively the probability of disclosing and rejecting in the second scenario (p ′ D +p ′ R = 1). Then, the non-zero terms of the transition matrix are given by:

P (W, W ) = 1 -p, P (W, OoP ) = p; P (D, OoP ) = 1, P (R, OoP ) = 1; P (OoP, W ) = 1 -c, P (OoP, (N, 0)) = c 4 ; P (OoP, (AD, 0)) = c 4 , P (OoP, OoP ) = c 2 ;
∀i, P ((N, i), W ) = l + ie; P ((N, i), (N, i + 1)) = 1 i + 2 ;

P ((N, i), D) = pD 1 -l -ie - 1 i + 2 ; P ((N, i), R) = pR 1 -l -ie - 1 i + 2 ;
∀j, P ((AD, j), W ) = l + je; P ((AD, j), (AD, j + 1)) = 1 j + 2 ;

P ((AD, j), D) = p ′ D 1 -l -je - 1 j + 2 P ((AD, j), R) = p ′ R 1 -l -je - 1 j + 2 .
In practice, we assume that the player can be in the states N and AD only for a finite number of times epochs. Specifically, we let i s and j s be two positive integers, and allow the states (N, i) only for i = 0, ..., i s , and the states (AD, j) only for j = 0, ..., j s . This practical assumption makes the state-space of the Markov chain finite. Observe that the events {The Chain is in state (N, i)}, i = 0, ..., i s form a partition of the event {The agent negotiates} (and likewise for AD states), we have:

π(N ) = is i=0 π((N, i)); and π(AD) = js j=0 π((AD, j)).
(

) 2
Let us define:

p := (p1, p2, p3, p4, p5, p6)

:= (π(W ), π(N ), π(AD), π(D), π(R), π(OoP )) = π(W ), is i=0 π((N, i)), js j=0 π((AD, j)), π(D), π(R), π(OoP )
Thus we have:

p 1 + p 2 + p 3 + p 4 + p 5 + p 6 = 1
As the chain is ergodic, p 1 is the long-run proportion of time when the agent is waiting, p 2 is the long-run proportion when the agent negotiates, and so on.

VI. Numerical results

A. Simulations parameters

In table VI, we summarize the simulation parameters used to evaluate the proposed game model. Let p be the probability of the intelligent object to solve communication facilities deficiency. To highlight the effect of its ability to overcome IoT difficulties (battery charging, channel communication channel finding, etc.), we make different simulations for variable values of p as shown in figure 7. Otherwise, we assume that intelligent object is able to solve its communication facilities difficulties, and we fix p = 0.8. With l, we expresses the probability of facing communication facilities deficiency by the intelligent object and moving the W state as shown in figure 5 and6. Otherwise, we suppose that communication facilities conditions are favorable, which means that the value of l is relatively low (we fix l = 0.1). The parameter e highlights the cost of each game iteration (N and AD states) as shown in figure 9. It highlights the impact of the game evolution on the communication facilities available to the intelligent object (number of allowed game iterations). By default, we fix e = 0.1 which is a realistic value regarding IoT conditions. With c, we indicate the probability of having communication facilities deficiency in the end of the game (transition from Oop to W state) as illustrated in figure 8. In favorable conditions we choose c = 0.9, and in severe conditions c = 0.1. As explained in the previous section, parameters p D and p R define respectively the probability of disclosing and rejecting in the first scenario (p D + p R = 1), while p ′ D and p ′ R are respectively the probability of disclosing and rejecting in the second scenario (p ′ D + p ′ R = 1). In a first step, we make the simulations for different values of p D (figures 5, 7, 8, and 9), and p ′ D (figure 6) to find the steady state and show the system convergence. In a second step, we calculate the game equilibrium solution numerically based on the utility functions behaviors (L and G) to find the probability of disclosure intention (p D ), as presented in figure 12 and re-inject it in the system state.

Finally, g priv and g inc are respectively the normalized incentive motivation value and privacy user preference parameters. In figure 12, these parameters are used to show the impact of the compromise "user preference/incentive motivation" on the final state of the game. For example, for high value of incentive motivation, the DH has a high probability of disclosure intention (p D is higher than 0.5). h priv and h inc are the centers of the sigmoid functions, and we choose by default h priv = h inc = 0.5.

B. Steady state

We remind that the player switches from other states to W state in case of energy limitations problem. The player's behavior, when this phenomenon occurs, is reflected by parameter l which expresses the default value of energy consumption in sleep situation, and parameter e, which handles energy consumption in each iteration of N or AD states. Once the player is in state W , he/she leaves only when communication facilities problems are solved. In addition, the player lasts in state OoP when he/she is not facing any communication problems, but waiting for "something to happen" (starting a game spontaneously, or waiting for a game proposal from another player).

Steady states for i s = 3 and j s = 3 are shown in figures 5, 6, 7, 8, and 9. In each sub-figure, we fixed p, c, l, e, p ′ D and p ′ R , and calculate the steady state probabilities for 5 increasing values of p D and p R (from 0.1 (left bars) to 0.9 (right bars)). Similarly, in figure 6, probabilities are calculated for 5 increasing values of p ′ D and p ′ R . In figure 5, we choose p = 0.8, c = 0.9 and e = 0.1 which means that the player is not facing any communication facilities problem at the beginning of the game. For small values of l, the player stays a shorter period of time in W state than OoP state. That means, from the communications facilities point of view, the player can freely play and no constraints are inhibiting his/her behavior. In addition, time spent in N , AD, D and R states is high since the player is active and has the possibility to make decisions. In return, for big values of l, the player lasts more time in W state as energy consumption is high. We notice that numerical values of the game result D and R are around 10%, which is explained by their shortness in real time. In figure 6, we used the same logic to show the steady state values in attack scenario. The main difference is that, if we assume the existence of defense mechanisms, the probability of disclosing private data is clearly lower than the probability of rejecting the DR demand. For the rest of parameters, which depend only on communication facilities, players behaviors are similar to those in figure 5. In figure 7, we focus on the impact of parameter c in severe situation of constraints (c = 0.1). Even for low energy consumption (e = 0.1) high value of p and low

C. Equilibrium

We solve the game equilibrium for different situations in the game numerically. Then, we represent gain function and loss function, calculate their product, find their maximum point, and get the corresponding steady state. To distinguish between different situations, we modify the normalized value of parameters g inc and g priv , and analyze the player's behavior (figure 12). For a limited privacy concession (g priv ≪ 1), we search for the equilibrium point for different values of g inc . We notice that the probability of disclosing data is high (p op > 0.5). For an intermediate privacy concession (g priv = 0.5), we found that equilibrium probability for small values of g inc (non interesting incentive motivation) is small. That means, disclosing private data for the high values of g inc is more probable due to the interesting incentive offer (p op ≈ 0.2 -0.6). If we choose a high privacy concession (g priv ≈ 1), we find that equilibrium probability for different values of g inc (interesting and non interesting incentive motivation) is low. That means, players hesitate to disclose private data even for high values of g inc (p op < 0.5) in almost all situations.

To compare our contribution to other proposals, we consider three different research papers [27] [11] [28] and we run simulations as shown in figure 11. Results of comparison are explained in the following. In [START_REF] Wu | Game theory based correlated privacy preserving analysis in big data[END_REF], authors proposed a differential privacy solution for anonymization and correlated privacy preserving analysis in big data. They used a truncated geometric mechanism (TGM) to illustrate the dynamic privacy choices, and ln function to fit the relationship between utility and privacy. The expected payoff is represented in black (F (s) = α 1 ln(s + α 2 ) + α 3 ; s > 0), and is calculated for α 1 = 0, 05811, α 2 = 0, 001, α 3 = 0, 7652. In [START_REF] Panaousis | Game-theoretic model of incentivizing privacy-aware users to consent to location tracking[END_REF], authors proposed an infinite repeated game for privacy protection in mobile application. They introduced a discount coefficient that discounts future earnings to weigh the pros and cons of different paths. The user tries to maximize his utility by controlling the probability of releasing his private data, and when the discount coefficients satisfy the ranges, the player loses the motivation to actively deviate from the social norm. The expected payoff is represented in blue (U ui (c) = Q(c)/1 -δ u ; 0 ≤ δ u ≤ (1)), and is calculated for Q(c) = 2. In [START_REF] Hamdi | Game-based adaptive security in the internet of things for ehealth[END_REF], authors proposed damage and lifetime functions to calculate player's benefits. We model the opposite of their damage function (1-∆) in function of (1-P pv ), which is a correct representation of data disclosure (green curve). Compared to our solution, the two function have similar behaviors but gain values depends on data privacy vs incentive motivation in our case. For example, in figure 11 for low probability of disclosure intention, the gain of their solution is higher than our proposed solution, which can be explained by the value of the sigmoid function's steepness. In our proposal, we adapt the gain value in function of incentive motivation to show its impact on DH's disclosure intention and equilibrium solution. In addition, we study the balance between incentive motivation and privacy concession by inserting the latter parameter in loss function to analyze the final state of the game. That means, for high values of g inc , the gain value is high, and for high values of g priv , the loss value is high, and vice versa.

D. ITS Particular case

In ITS, we need to consider particular cases where DR is the authority representative, the public safety, or emergency management applications. In these situations, response of DH has to be instantaneous with the required aid. Our model provides flexibility to solve this problem by adjusting some precise parameters. Then, we fix p = c ≈ 1 (no communications constraints exist), l = e ≈ 0 (energy consumption is low), and p ′ D = 1 (no resistance of disclosing data is shown) as shown in figure 10. We notice that p D = 0.81 which reflects a high disclosure intention, which is confirmed by the steady state probabilities (π(D) ≫ π(R)). We also notice that time spent in OoP state is much higher than W state, which highlights the readiness of the DH to answer the DR request in this type of situations.

VII. Conclusion and future work

In this paper, we proposed a Markovian game-based solution to protect private data exchanged in the ITS context where each player aims to maximize his/her payoff. This approach can be used during negotiation between actors to predict the DR's strategies, and then to determine the DH's decisions based on the compromise found in the equilibrium solution between privacy concession and incentive motivation. Our model considers two different scenarios (DR: curious or malicious), and is applicable in particular cases of ITS by adapting its parameters. With this aim in mind, we defined six different states for each player, solved the Markovian system numerically, and illustrated the steady state. We come up to integrate parameters related to IoT context and those related to privacy preservation in a global system. Then, we sketched the DH behavior in different situations by adapting the corresponding parameters of the system such as energy costs, privacy concession and incentive motivation. Finally, we illustrated the utility function to analyze the equilibrium solution of the system, which reflects the disclosure probability of DH, p D . This parameter is calculated to illustrate the DH ability to disclose private data in each situation by adapting energy, incentive and privacy parameters. Then, we showed that DH behavior depends to its current situation and acts accordingly.

Fig. 3 .Fig. 4 .

 34 Fig. 3. Sequential game tree.

Fig. 5 .Fig. 6 .

 56 Fig. 5. Steady state for variable l, p D and p R .

Fig. 7 .

 7 Fig. 7. Steady state for variable p, p D and P R .

Fig. 8 .

 8 Fig. 8. Steady state for variable c, p D and P R .

Fig. 9 .

 9 Fig. 9. Steady state for variable e, p D and P R .

Fig. 10 .

 10 Fig. 10. Steady state for particular ITS case.

Fig. 11 .

 11 Fig. 11. Utility functions comparison.

Fig. 12 .

 12 Fig. 12. Game equilibrium and steady states for normalized values of incentive motivations and privacy concession.

  8, c = 0.8, l = 0.2, e = 0.1, pD = 0.79, pR = 0.21, p'D = 0.5, p'R = 0.5. Probability value (a) High incentive, low privacy concession 8, c = 0.8, l = 0.2, e = 0.1, pD = 0.51, pR = 0.49, p'D = 0.5, p'R = 0.5. Probability value (b) Medium incentive, medium privacy concession .05, gpriv = 0.5, hinc = 0.5, hpriv = 0.5. .8, c = 0.8, l = 0.2, e = 0.1, pD = 0.23, pR = 0.77, p'D = 0.5, p'R = 0.5. Probability value (c) Low incentive, high privacy concession

TABLE I

 I Summary of privacy preservation models.

	putational Private Information Retrieval (cPIR); and
	guaranteed much lower communication cost for VLBS.

TABLE II

 II Recent attacks of connected cars.

	Sensor Data	Processing	Data in	Processing	Sensor Data
			transit
	In vehicle ...	Data at rest	Meta Data	Data at rest	In vehicle ...

location tracking, break forward secrecy privacy inferences store information collect information about me, my car, and my surrounding malware

	Infrastructure
	Fig. 1. Privacy violation in connected cars [17].

TABLE III

 III Scenarios, players, roles and actions of the game.

•

  Previous action results are included in the system.• DH can only predict the DR strategy from previous action results, which are observable by him/her.

	Parameter Description
	U pl	Utility function of a player pl
	L	Loss function (privacy concession)
	G	Gain function (incentive motivation)
	gpriv	Privacy user preference parameter
	ginc	Incentive motivation value parameter
	hpriv	Center of the sigmoid function (loss function)
	hinc	Center of the sigmoid function (gain function)
	ppriv	Probability of making privacy concession by DH
	pinc	Probability of accepting the incentive motivation
		proposed by DR
	pop	Equilibrium probability
	pD	Probability of disclosing in the first scenario
	pR	Probability of rejecting in the first scenario
	p ′ D p ′ R	Probability of disclosing in the second scenario Probability of rejecting in the second scenario
	p	Probability of solving comm. facilities deficiency
	l	Probability of having comm. facilities deficiency in
		the beginning of the game
	e	Cost of each game iteration (N and AD states)
	c	Probability of having comm. facilities deficiency in
		the end of the game
	pi	Probability of the final state i.

• DH knows in which context the requester has launched its request/attack (curious or malicious).

• DR has the same probability to be curious or malicious.

• The game evolution depends on the negotiation steps between DR and DH based on incentive motivation and privacy preferences.

TABLE V

 V Markovian process states.

www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

www.telegraph.co.uk/technology/2016/03/23/hackers-can-unlock-and-start- dozens-of-high-end-cars-through-the/

8 www.cnbc.com/2016/11/28/cybersecurity-experts-.

html 9 www.hackread.com/road-sign-in-modesto-hacked-with-anti-trump-message/ recovery, etc.). In some particular situations, cryptography implementation may be expensive, or unsuitable in environments with constrained energy consumption.

www.commoncriteriaportal.org

In the future, we will focus on long-term players payoffs (after many game instances) and their effect on the game continuity (final states and transition). Also, we will consider new players behavior and types, and generate and analyze new models accordingly.


Michel E Safar

Céline Lange

Jean Tichet

Jacques Blacher

Eveline Eschwège

Beverley Balkau
email: balkau@vjf.inserm.fr

D E S I R Study Group

The D.E.S.I.R. study: the change and the rate of change of the ageblood pressure relationship

Keywords: Epidemiology, Age, Blood pressure

come

Introduction

Antihypertensive therapy has considerably improved cardiovascular (CV) risk in people treated for hypertension [START_REF] Hansson | Are these benefits from any antihypertensive agent additional to blood pressure lowering per se?[END_REF][START_REF] Staessen | Changing concepts on the role of blood pressure reduction in cardiovascular prevention[END_REF].The major beneficial effect of CV prevention has been for stroke, congestive heart failure and renal insufficiency. Less progress has been made for the prevention of coronary heart disease.

Despite an adequate drug treatment, a significant residual coronary risk is commonly observed during the long-term follow-up of hypertensive subjects [START_REF] Blacher | Residual coronary risk in men aged 50-59 years treated for hypertension and hyperlipidaemia in the population: the PRIME study[END_REF]. Furthermore, a very particular haemodynamic pattern is frequently observed during antihypertensive therapy: while diastolic blood pressure (DBP) is adequately controlled (≤ 90 mm Hg), systolic blood pressure (SBP) remains frequently elevated above 140 mm Hg [START_REF] Black | A new classification schema for hypertension based on relative and absolute risk with implications for treatment and reimbursement[END_REF]. This haemodynamic profile, which is commonly observed in the elderly, even in the total absence of antihypertensive drug treatment, is traditionally attributed to an age-induced increase in arterial stiffness together with the presence of altered wave reflections [START_REF] Safar | Arterial stiffness and central hemodynamics in treated hypertensive subjects according to brachial blood pressure classification[END_REF][START_REF] Vergnaud | From 'optimal' to 'borderline' blood pressure in subjects under chronic antihypertensive therapy[END_REF]. This observation suggests that, during chronic drug therapy, consistent interactions occur in the long term between aging, high SBP and/or DBP, and antihypertensive treatment. Such interactions are difficult to clarify because the duration of therapeutic trials approximates 3-5 years, while that of antihypertensive therapy is close to 30 years (and even longer).

Taken together, these findings indicate the need to develop studies evaluating in parallel the changes of brachial SBP and DBP and the progressive development of vascular aging. D.E.S.I.R. (Data from an Epidemiologic Study on the Insulin Resistance syndrome) is a cohort of more than 4,500 men and women aged 30-65 years at inclusion, who were investigated every 3 years for a total of 9 years follow-up [START_REF] Balkau | The incidence and persistence of the NCEP (National Cholesterol Education Program) metabolic syndrome. The French D.E.S.I.R. study[END_REF]. From this long-term survey, it is possible to evaluate not only the mean values of SBP and DBP with age, but also the rate of change of this classical relationship, i.e. the change in SBP or DBP per unit year (∆SBP or ∆DBP), in each gender, according to age at baseline. From the present D.E.S.I.R. study and other investigations [START_REF] Balkau | The incidence and persistence of the NCEP (National Cholesterol Education Program) metabolic syndrome. The French D.E.S.I.R. study[END_REF][START_REF] Kannel | Systolic versus diastolic blood pressure and risk of coronary heart disease: The Framingham Study[END_REF][START_REF] Kannel | Blood pressure as a cardiovascular risk factor: Prevention and treatment[END_REF][START_REF] Stamler | Blood pressure (systolic and diastolic) and risk of fatal coronary heart disease[END_REF][START_REF] Franklin | Hemodynamic patterns of age-related changes in blood pressure[END_REF][START_REF] Safar | Systolic versus diastolic blood pressure: In Handbook of Hypertension Bulpitt CJ[END_REF], we know that the mean values of SBP and DBP increase progressively with age but also that, above 50-60 years of age, mean values of SBP increase with age while mean values of DBP begin to lower. Our working hypothesis is that the evolution of ∆SBP and ∆DBP also differ consistently, particularly ∆DBP, and that this process might influence the effects of drug treatment. The role of major cardiovascular risk factors such as smoking, blood pressure (BP), body weight, plasma cholesterol and glucose was systematically investigated.

Methods

Participants

The main objective of the 9-year longitudinal study D.E.S.I.R., was to clarify the development of the insulin resistance syndrome. It is not a population based study, but a study of individuals who volunteered for a heath check-up and who were willing to participate in a 9-year study. Participants were recruited over the period 1994 to 1998 from ten Health Examination Centres from volunteers insured by the French Social Security system, which offers periodic health examinations free of charge: 85% of the French population is eligible for these examinations [START_REF] Balkau | The incidence and persistence of the NCEP (National Cholesterol Education Program) metabolic syndrome. The French D.E.S.I.R. study[END_REF]. The total population in the geographical area of our study was over four million inhabitants, and 90,000 individuals benefit from such examinations each year.. The protocol was approved by the CCPPRB ("Comité Consultatif de la Protection des Personnes pour la Recherche Biomédicale") of Bicêtre Hospital, Paris, and participants signed an informed consent.

The analysis included 2,278 men and 2,314 women, aged 30 to 65 years, with measures at baseline for all studied parameters and at least one other measure of BP at one of the follow-up examinations at 3, 6 and 9 years after inclusion.

Measures

Arterial blood pressures were measured in a supine position after 5 minutes rest. Both at inclusion and at the 3-year follow-up examination, a mercury sphygmomanometer was used and at the 6-and 9-year examinations, an OMRON HEM-705CP. According to the validation study by O'Brien et al. [START_REF] O'brien | Evaluation of three devices for self-measurement of blood pressure according to the revised British Hypertension Society Protocol: the Omron HEM-705CP, Philips HP5332, and Nissei DS-175[END_REF] the OMRON HEM-705O device measures SBP 2 mmHg and DBP 1 mmHg lower than a standard mercury sphygmomanometer; we added these differences to the Omron measured blood pressures. Participants were lightly clad, and weight and height were measured, and body mass index (BMI = weight /height 2 (kg/m 2 ))

article SAFAR, 30/6/08 5/26 calculated. The waist was measured as the smallest circumference between the lower ribs and the iliac crest. Hypertensive treatment and hormone replacement therapy were recorded.

All biochemical measurements were from one of four health-centre biological laboratories located in France at Blois, Chartres, La Riche or Orléans. Total cholesterol, HDL-cholesterol and triglycerides, were assayed by DAX 24 (Bayer Diagnostics, Puteaux, France) or KONE (Evry, France). The fasting plasma glucose, measured by the glucose-oxidase method, was applied to fluoro-oxalated plasma using a Technicon RA1000 (Bayer Diagnostics, Puteaux, France) or a Specific or a Delta device (Konelab, Evry, France). The inter-laboratory variability was assessed monthly on normal and pathological values for each biologic variable, the coefficients of variation for laboratories being lower than 6% over the inclusion period.

The examining physician noted the menopausal status of the women at each of the four examinations; no hormonal tests to validate this status were carried out. The information was inconsistent for some of the women, so that we were able to class only 2,202 of the 2,314 women: 878 were postmenopausal at entry into the study, 575 were menopaused during the study, and 749 were premenopausal at the end of the nineyear follow-up. Hormone replacement therapy was taken by 853 women, of whom 361 were postmenopausal: 69 women did not provide information about hormonal replacement therapy.

Cardio-metabolic risk factors were defined as follows [START_REF]Executive Summary of the Third Report of the National Cholesterol Education Program (NCEP) Expert Panel on Detection, Evaluation, and Treatment of High Blood Cholesterol in Adults (Adult Treatment Panel III)[END_REF]: Glucose status (diabetic: treated or fasting plasma glucose ≥ 7.0 mmol/l, impaired fasting glucose: fasting plasma glucose between 6.1 and 6.9 mmol/l, normal: fasting plasma glucose < 6.1 mmol/l.)

Statistical methods

The characteristics of the individuals, their SBP, DBP are presented at inclusion in the study, according to sex, by means (standard deviations) and percentages. We studied, the SBP and DBP of each individual, over the 9 years of follow-up, by two metrics: their values at baseline, and their rate of change per year, ∆SBP, ∆DBP, assuming a linear relation over the time period.

The relations between baseline SBP and DBP mean values and age, called "SBP and DBP mean values", were modelled by linear regression with respect to baseline age (as a continuous parameter) [START_REF] Franklin | Hemodynamic patterns of age-related changes in blood pressure[END_REF], and likelihood ratio tests determined whether these relations were better described by a linear or a curvilinear relation with age, by the addition of a squared term in age. These relations are shown graphically, with the observed data as points on the graphs by 5-year age groups, along with the modelled curve. We compared the relations between men and women, using likelihood ratio tests and present the regression relations with a) separate curves or lines, or with b) a combined curve or line if they did not differ significantly according to sex. These relations were also studied according to strata of cardio-metabolic risk factors, presence of anti-hypertensive drug treatment, menopausal status and hormone replacement therapy. For the different classes of antihypertensive agents, the numbers treated were too small to allow an adequate statistical evaluation (Table 1).

The changes per year in SBP and DBP were studied according to age at entry into the study, and by sex.

For each subject a slope, or a change per year, was calculated for SBP and DBP over the nine years of the study, called "∆SBP" and "∆DBP". These values are shown graphically by 5-year age groups and modelled by regression analysis, according to age at entry into the cohort, with tests for linearity in age. These relations are shown graphically. We compared the relations between men and women using likelihood ratio tests and present models with a) separate curves or lines, or with b) a combined curve or line if they did not

Results

General characteristics of the studied population

Table 1 shows the mean value of clinical and biological parameters and their evolution per year, assuming a linear progression. For the same age, and a similar percentage of antihypertensive drug therapy, women had a significantly lower mean weight, height, waist circumference, SBP and DBP than men, but a higher mean heart rate. Changes per year in weight and waist circumference were higher in women than in men, but an opposite finding was observed for the changes per year in SBP and DBP. Changes in biological parameters slightly differed between men and women during the follow-up. Antihypertetnsive treatment was mainly with beta blockers and ACE inhibitors; at inclusion angiotensin receptor blockers were not available.

Mean values of brachial SBP and DBP at inclusion by age and sex

At each age range at inclusion, the mean SBP was lower in women than in men (Fig. 1A). However, both in men and women, SBP increased linearly and significantly with age, at a higher rate (P < 0.0001) and with a lower intercept (P < 0.0001) in women than in men. In women, this latter finding was even more pronounced in postmenpause than in the premenopause; women who became menopaused during the follow-up having the greatest increase (data not shown). For SBP, the same model was studied in populations divided according to values of cardio-metabolic risk factors (BMI, BP status, smoking, total cholesterol, glucose status as well as waist circumference, HDL-cholesterol, triglycerides, menopause (data not shown for the latter factors)). Higher intercepts (except with smoking) were noted in the presence of the article SAFAR, 30/6/08 8/26 risk factors, antihypertensive drug treatment and hormonal replacement therapy (Table 2). There was one other exception: when individuals were divided according to BP status, for men and women without high BP at inclusion, there was little variation in mean SBP with age (Fig. 2A); for men and for women with high BP the intercepts were higher, with almost identical SBP-age coefficients.

There was a significant increase in DBP with age (Fig. 1B), with lower values in women than in men at each age range. In men and women, the best model was curvilinear, with a significantly steeper slope with age in women than in men. These relations were little changed in the presence of other cardiovascular risk factors or according to menopause (Table 2): when one of these risk factors was increased, equations of the model generally did not change their slope but had a significantly higher intercept, except for smoking in men. This was also true for men and women with high and with low BP where there were similar relations between DBP and age (Table 2, Fig. 2B).

In summary, the mean values of SBP and DBP increased with age, both in men and women. The increase in SBP and DBP with age was steeper in women than in men, particularly in postmenopausal women. The model relating BP to age was linear for SBP and curvilinear for DBP. The presence of other cardiovascular risk factors changed little the slope with age but was associated with a consistent increase in the intercept, except for smoking. These conclusions held when account was taken of blood pressure treatment (Table 2).

Mean change of SBP and DBP per year (∆SBP and ∆DBP) by age at inclusion and by sex

Figure 3 shows the mean change per year of SBP, ∆SBP (Fig. 3A), and of DBP, ∆DBP (Fig. 3B), according to age and sex in the overall population.

For ∆SBP in the total population (Fig. 3A), the mean change per year increased significantly with age, with higher values (P < 0.0001) in men than in women. There was a similar slightly curvilinear model (P < 0.05) in both sexes with the increase being less pronounced at higher ages. The presence of the factors cited above did not modify this description (Table 3), and there was no longer a significant curvature when the population was divided according to these strata, with an exception regarding BP status. For men with article SAFAR, 30/6/08 9/26 or without high BP at inclusion, there was an increase in ∆SBP with age of 0.4 mmHg per 10 years of age, with a similar increase for women (Table 3). However, men and women with high BP had respectively, a yearly change 0.82 and 0.89 mmHg lower than those without high BP at inclusion.

The ∆DBP by age model exhibited a very particular aspect (Fig. 3B), as it was identical and curvilinear for both men and women, with a maximum value around 45 years of age, after which ∆DBP decreased with age, showing negative values, after the age of 60 years. The finding was unaffected by the presence of the various covariates (Table 3), with the exception of high BP. In all of these cases the ∆DBP curves were separated, with the men and women at lower risk having a higher ∆DBP. The ∆DBP-age relation remained curvilinear only for the men. This result indicates that over 45 years of age, ∆DBP is reduced more and more with increasing age, particularly in those with high BP at baseline. In summary, the relation between age and ∆SBP and ∆DBP differed markedly, increasing with age for ∆SBP and decreasing for ∆DBP. This latter observation was not influenced by sex, or other possible confounders, excepting for antihypertensive treatment in women (Table 3).

Discussion

This analysis of the D.E.S.I.R. study of 2,278 men and 2,314 women, was focused on the long term changes of SBP and DBP with age, between the ages of 30 and 65 years. While some participants were over 60 years at inclusion, D.E.S.I.R. did not include a "true" geriatric population. Indeed, it is well established in studies of CV epidemiology that around 55-60 years of age, the increase in SBP with age is associated with a progressive and consistent reduction of DBP with age [START_REF] Kannel | Systolic versus diastolic blood pressure and risk of coronary heart disease: The Framingham Study[END_REF][START_REF] Kannel | Blood pressure as a cardiovascular risk factor: Prevention and treatment[END_REF][START_REF] Stamler | Blood pressure (systolic and diastolic) and risk of fatal coronary heart disease[END_REF][START_REF] Franklin | Hemodynamic patterns of age-related changes in blood pressure[END_REF][START_REF] Safar | Systolic versus diastolic blood pressure: In Handbook of Hypertension Bulpitt CJ[END_REF]. In the present longitudinal study (Fig. 1A andB), we showed that both the mean values of SBP and DBP increased markedly with age-class and were influenced by sex, menopausal status and metabolic disorders (cholesterol, glycaemia, obesity, …). All these factors are usually associated with a shift of SBP and DBP toward higher BP values at each given age range. However, from the long term follow-up of D.E.S.I.R., another important factor article SAFAR, 30/6/08 10/26 was shown for the first time: the rate of change in SBP or DBP per year with age differed markedly for each of the two parameters. This rate increased progressively as function of age for SBP, but in contrast, decreased significantly with age for DBP, as soon as the age of 40-45 years had been reached. Thereafter, the rate of change of DBP per year decreased progressively and markedly with increasing age. This finding was independent of sex, menopausal status and increased levels of BMI, waist circumference, plasma cholesterol, glucose and triglycerides. The only exception to this rule was the case of high BP, in which, particularly in men, the process of reduced ability to decrease DBP with age was consistently attenuated or even disappeared.

This investigation was performed on the basis of non-invasive brachial BP measurements.

A limitation of the study was that, primarily, a mercury sphygmomanometer was used for BP measurements, and, then after 3 years follow-up, an OMRON-device was used. However, in the present study, we accounted for this change and verified that it did not modify at all the classification of the overall population. Furthermore, our longitudinal study gave similar results to those previously obtained in the literature. In fact, as in all epidemiological reports, the principal limitation of the investigation was the site of BP measurements: the brachial artery [START_REF] Safar | Systolic versus diastolic blood pressure: In Handbook of Hypertension Bulpitt CJ[END_REF]. Indeed, SBP is the most reproducible parameter to determine at the brachial artery site. However as a consequence of the presence of physiological SBP amplification, brachial SBP must be considered as a local parameter, which does not reflect central SBP measurements, except in subjects above 50 years of age without any tachycardia [START_REF] Franklin | Hemodynamic patterns of age-related changes in blood pressure[END_REF][START_REF] Safar | Systolic versus diastolic blood pressure: In Handbook of Hypertension Bulpitt CJ[END_REF]. On the other hand, DBP, which is known to involve many errors in its measurement, is not a totally local parameter since its value is almost the same in the entire arterial tree. Brachial DBP may reflect adequately central DBP, and thus might be an index of the perfusion pressure of coronary arteries. In the present study, it is the change in DBP according to age, which was mostly studied. Thus, the errors of DBP measurements during the long-term follow-up might be largely minimized. On the other hand, it is well accepted that the OMRON device that was used for many of the measures in this study is known to predict very adequately the level of CV risk [START_REF] Bobrie | Cardiovascular prognosis of "masked hypertension" detected by blood pressure self-measurement in elderly treated hypertensive patients[END_REF]. The D.E.S.I.R. cohort is not a population based study, but from a general French population; we believe these article SAFAR, 30/6/08 11/26 results can be generalised to the population, taking into account the characteristics of the French Social Security System.

The principal result of this investigation was obtained from the calculation of the mean change of SBP and DBP per unit year (ie. the rate of change) during the follow-up. Whereas the mean values of SBP and DBP both increased across the different age ranges, the rates of changes of SBP and DBP per year were strikingly dissociated. Across the age ranges, this change increased markedly with age for SBP but markedly decreased with age for DBP (Fig. 3A and3B). The mathematical model was curvilinear for ∆DBP with age, the maximum value being observed around 45 years and it then fell progressively for the higher ages. This evolution suggests an active process relating the reduction of DBP to vascular aging. This aspect differs from that of SBP but occurred similarly in men and women and was independent of traditional CV risk factors such as hypercholesterolemia, glycaemic status, BMI. Note that in the past, many studies have shown that the mean value of DBP decreased with age, but not the rate of change per unit age [START_REF] Kannel | Systolic versus diastolic blood pressure and risk of coronary heart disease: The Framingham Study[END_REF][START_REF] Kannel | Blood pressure as a cardiovascular risk factor: Prevention and treatment[END_REF][START_REF] Stamler | Blood pressure (systolic and diastolic) and risk of fatal coronary heart disease[END_REF][START_REF] Franklin | Hemodynamic patterns of age-related changes in blood pressure[END_REF][START_REF] Safar | Systolic versus diastolic blood pressure: In Handbook of Hypertension Bulpitt CJ[END_REF]. However, this decrease in the mean value of DBP with age before 55 years of age and was not observed in the present study because the cohort had only a very small geriatric population at inclusion.

In the present study, the increase in the mean values of SBP and DBP with age was shifted toward higher values of SBP and DBP when studied by strata of traditional cardiovascular risk factors (such as higher BMI, diabetes mellitus, and increased cholesterol); the relations however remained parallel. In contrast, the relationship of the SBP or DBP slope with age was influenced exclusively by the presence of high BP, and not by any of the other cardiovascular risk factors. This finding might indicate that the presence of structural changes of arterioles and capillary rarefaction contributes consistently to maintain the elevated values of blood pressure in this population [START_REF] Izzard | Small artery structure and hypertension: adaptive changes and target organ damage[END_REF]. Further studies are needed to show which factors are responsible for the specific defect in the well-established process of DBP reduction with age.

Perspectives

This investigation has shown that, in a long-term follow-up, whereas for SBP the rate of change of the relationship increases progressively with age, for DBP the relationship begins to reduce as early as 45 article SAFAR, 30/6/08 12/26 years. The finding is independent of gender and metabolic disorders but disappears in the presence of hypertension at inclusion, particularly in men. Whether this particularity is influenced by drug treatment is yet difficult to determine and requires further investigations.

-

  Overweight: BMI ≥ 25 kg/m 2 ; -Abdominal obesity: waist circumference > 102 / 88 cm, men/women; -High blood pressure: SBP ≥ 130 mmHg and/or DBP ≥ 85 mmHg; -Smoker: current smoker; -Hyper-cholesterolaemia: cholesterol: ≥ 5.70 mmol/l; -Hyper-triglyceridaemia: triglycerides ≥ 1.69 mmol/l; -Hypo-HDL-cholesterolaemia: HDL-cholesterol < 1.04 / 1.29 mmol/l, men/women; article SAFAR, 30/6/08 6/26

  article SAFAR, 30/6/08 7/26 differ according to sex. These relations were also studied according to strata of cardio-metabolic risk factors and other factors indicated above. A change in the intercept without any change in slope indicated a shift of the curve. A change in the slope indicated a change in the sensitivity of the system. Analyses used SAS Version 8.2 (SAS Institute Inc. Cary, NC USA).

Fig. 1A .

 1A Fig. 1A. Mean values of systolic blood pressure (SBP) mmHg by age (5 years), and sex: points indicate observed mean SBP by age class and the lines are the best-fit regressions; both the slope and the intercept differ significantly (P < 0.0001) between men and women.

Fig. 1B .

 1B Fig. 1B. Mean values of diastolic blood pressure (DBP) mmHg by age (5 years), and sex: points indicate observed mean DBP by age class with the lines are the best-fit regressions; both the slope and the intercept differ significantly (P < 0.006, 0.001 respectively) between men and women.

Fig. 2A .

 2A Fig. 2A. Mean values of systolic blood pressure (SBP) mmHg by age and sex, according to strata of blood pressure at inclusion. The slope and the intercept differ significantly between the strata for both men and women.

Fig. 2B .

 2B Fig. 2B. Mean values of diastolic blood pressure (DBP) mmHg by age and sex. Only the intercepts differ significantly between the strata, for both men and women.

Fig. 3A .

 3A Fig. 3A. Mean change per year (∆SBP) mmHg by age (5 years), and sex: points indicate observed mean changes per year by age class with the lines as the best-fit regressions; intercepts differed significantly (P = 0.0001) but identical curvature.

Fig. 3B .

 3B Fig. 3B. Mean change per year (∆DBP) mmHg by age (5 years), and sex: points indicate observed mean changes per year by age class with the lines as the best-fit regressions; relations are identical for men and women.

Table 1 .

 1 Characteristics [mean, (standard deviation) or n (%)] of the men and women at inclusion in the study, and the evolution of the parameters per year, assuming a linear increase.

	Variables	Men (n=2,278)	Women (n=2,314)	P-value
	Baseline levels:
	Age (years)	47.1 (10.0)	47.1 (10.0)	0.8
	BMI (kg/m 2 )	25.4 (3.3)	24.0 (4.0)	<0.0001
	Weight (kg)	75.8 (10.7)	61.1 (10.3)	<0.0001
	Height (cm)	172.6 (6.5)	159.6 (6.0)	<0.0001
	Waist circumference (cm)	89.7 (9.4)	77.1 (10.2)	<0.0001
	Systolic blood pressure (mmHg)	134.5 (14.8)	127.8 (15.6)	<0.0001
	Diastolic blood pressure (mmHg)	82.1 (9.5)	77.6 (9.0)	<0.0001
	Treated for hypertension	234 (10%)	275 (12%)	0.08
	Beta blockers	94 (40%)	140 (51%)	0.01
	ACE	102 (44%)	69 (25%)	<0.0001
	Diuretics	65 (28%)	96 (35%)	0.08
	Calcium channel blockers	63 (27%)	43 (16%)	0.002
	Heart rate (beats per min)	66.4 (10.3)	68.2 (9.5)	<0.0001
	Fasting glucose (mmol/l)	5.57 (0.86)	5.13 (0.76)	<0.0001
	Cholesterol (mmol/l)	5.85 (1.01)	5.62 (0.97)	<0.0001
	HDL-cholesterol (mmol/l)	1.48 (0.38)	1.78 (0.42)	<0.0001
	Triglycerides (mmol/l)	1.37 (1.35)	0.97 (0.54)	<0.0001
	Smoking (n, %)	616 (27%)	335 (14%)	<0.0001
	Alcohol intake (g/day)	25.2 (24.8)	7.3 (11.4)	<0.0001
	Postmenopausal (n,%)		878 (40%)
	Hormonal replacement therapy (n,%)		853 (38%)
	Change per year in:
	BMI (kg/m 2 )	0.11 (0.28)	0.15 (0.32)	<0.0001
	Weight (kg)	0.27 (0.82)	0.32 (0.77)	0.06
	Waist circumference (cm)	0.32 (0.93)	0.45 (0.99)	<0.0001
	Systolic blood pressure (mmHg)	0.94 (2.49)	0.53 (2.28)	<0.0001
	Diastolic blood pressure (mmHg)	0.27 (1.59)	0.19 (1.43)	0.09
	Heart rate (beats per min)	-0.22 (1.63)	-0.18 (1.57)	0.3
	Fasting glucose (mmol/l)	0.001 (0.13)	-0.002 (0.10)	0.4
	Cholesterol (mmol/l)	-0.02 (0.14)	0.01 (0.13)	<0.0001
	HDL-cholesterol (mmol/l)	-0.01 (0.04)	-0.01 (0.05)	0.0002
	Triglycerides (mmol/l)	-0.001 (0.25)	0.01 (0.08)	0.03
	Alcohol intake (g/day)	-0.38 (3.30)	-0.01 (1.43)	<0.0001

a r t i c l e S A F A R , 3 0 / 6 / 0 8

article SAFAR, 30/6/08

Acknowledgements

The D.E.S.I.R. Study Group: INSERM-U780: B.Balkau, P.Ducimetière, E.Eschwège; INSERM-U367: F.Alhenc-Gelas; CHU-D'ANGERS: Y.Gallois, A.Girault; HOPITAL-BICHAT: F.Fumeron, M.Marre; CENTRES D'EXAMENS DE SANTÉ: Alençon, Angers, Blois, Caen, Chartres, Chateauroux, Cholet, Le Mans, Orléans, Tours; INSTITUT DE RECHERCHE EN MÉDECINE GÉNÉRALE: J.Cogneau; MEDECINS GÉNERALISTES des Départements; INSTITUT INTER-RÉGIONAL POUR LA SANTÉ: C.Born, E.Cacès, M.Cailleau, JG.Moreau, F.Rakotozafy, J.Tichet, S.Vol.

Sources of Funding