Mohamed Ben Marzouk

Agnès Chaumond

Eduardo Redondo-Iglesias

Maxime Montaru

Serge Pelissier

Mohamed Ben-Marzouk
email: mohamed.ben-marzouk@ifsttar.fr

Serge Pélissier

Experimental protocols and first results of calendar and/or cycling aging study of lithium-ion batteries -the MOBICUS project

Keywords: lithium battery, battery SoH (State of Health), cycle life, battery calendar life, France

Introduction

With the growing market of electrified vehicles across the whole world, the need for long-life batteries becomes more and more essential for economic issues. The battery can cost up to several thousand of euros that's why the knowledge of the aging mechanisms is primordial to optimize its different using process. The study of aging laws for lithium-ion batteries (LIB) is a challenging plan. Many projects exist allaround the world [START_REF] Bloom | An accelerated calendar and cycle life study of Li-ion cells[END_REF]- [START_REF] Robertson | A comparison of battery testing protocols: Those used by the U.S. advanced battery consortium and those used in China[END_REF]. Most of these works take into account either the calendar aging or the cycling aging although in real automotive applications LIBs usually experience the both aging in driving phases separate by parking phases.

The objectives of MOBICUS project (2014 -2017) were the design and validation of strategies to extend batteries life-time depending on vehicle use and charging patterns, from experimental measures. MOBICUS gathers 12 partners (5 research labs and 7 industrial companies) and mobilizes 18 testing benches in order to conduct an ambitious and innovative aging test program combining cycling and calendar phases of aging. Most partners of MOBICUS have participated to two previous research projects: SIMTOCK (2007SIMTOCK ( -2010) ) on the cycling aging [START_REF] Badin | Modelling of On-board Energy Storage System aging: The French SIMSTOCK research network[END_REF] and SIMCAL (2009-2012) on calendar aging [START_REF] Grolleau | The French SIMCAL Research Network for Modelling of Energy Storage System Calendar Ageing in EVs and HEVs-EIS Analysis[END_REF], [START_REF] Delaille | SIMCAL Project: calendar aging results obtained on a panel of 6 commercial Li-ion cells[END_REF] The two different types of LIB technologies tested in MOBICUS are detailed in Table 1. The Techno#1 was tested in both SIMSTOCK and SIMCAL projects. Techno#2 is specific to MOBICUS.

Experimental

In order to cover almost all the types of batteries aging in automotive application, three large categories of tests constitute the experimental plan: calendar aging, cycling aging and mixed calendar /cycling aging.

Calendar aging

This category of tests summarizes more than 90% of the vehicle life-time (personal car) which is the parking mode. That's why many scientists are studying batteries aging at this "rest" mode. From these studies [START_REF] Delaille | SIMCAL Project: calendar aging results obtained on a panel of 6 commercial Li-ion cells[END_REF], the aging here depends mainly on temperature and SoC factor. To study the simple and the combined effects of these two factors, three types of tests in this category were planned: storage on fixed SoC and fixed temperature, storage on fixed SoC and variable temperature and finally storage on variable SoC and fixed temperature.

Pure calendar (fixed SoC and temperature)

This type of tests is designed to validate and enrich the results obtained by SIMCAL project. Pure calendar aging tests consist on storing each module at a constant temperature and fixed SoC for almost 2 years. During this time a periodical characterisation is planned to check-up the evolution of batteries electrical properties.

The tests are distributed in 4 different temperatures (0, 25, 45 and 60°C) and 5 different SoCs (0, 30, 65, 80 and 100%). Since we have already some results from a former project (SIMCAL [START_REF] Grolleau | The French SIMCAL Research Network for Modelling of Energy Storage System Calendar Ageing in EVs and HEVs-EIS Analysis[END_REF]) for the first technology, only complementary tests are scheduled (10 modules) whereas for the second one, a more complete test is planned (16 modules will be tested).

The figure below (Figure 1) represents the capacity loss in function of time at different temperatures at SoC 80. Our first results presented here confirm that the high temperature is a very degrading factor for the LIB.

Although the curve's shape of capacity loss for Techno#1 and Techno#2 is approximately the same, the two technologies haven't the same capacity loss. The Techno#1 is more alterable against temperature than Techno#2. At the end of testing, more points will be obtained and then a better analysis and understanding of the calendar aging phenomena will be possible.

Thermal cycling calendar tests (fixed SoC and variable temperature)

In real aging conditions, the temperature is never constant; it varies depending on the season and the moment of the day. Following this principle, we've designed this type of tests. It consists on storing the cells at a fixed SoC and a variable temperature.

For each technology, we test the aging in 2 different SoCs (60 and 100%) and within 2 temperature ranges (0-30°C and 30-60°C).

A thermal cycling between the 2 values of each range is an iteration of a 24 hours loop. It is composed of 10 hours at temperature#1, 2 hours of ramp, then 10 hours at temperature#2 and another 2 hours of ramp (this can be related to the variation of temperature during the day). To optimize the use and availability of equipment, one test consists of 11 weeks of thermal cycling in the 0-30°C range, one check-up of cells performances, 11 weeks of thermal cycling in the 30-60°C, one check-up of cells performance, etc. as shown in Figure 2 (the variation of temperature depending on season) The important influence of the high temperature is again visible by comparing the capacity loss rate in the range 0-30°C to 30-60°C range. It can be noted that after a phase of aging at high temperature (temperature cycle between 30 and 60 °C), there is a stabilisation of the capacity loss or even a regeneration phenomenon at the next phase (temperature cycle between 0 and 30 °C). This can be checked and understood better at a further stage of testing.

Variable SoC calendar tests

In real life automotive application and at parking phases, the level of SoC is never the same. So to study this effect and to validate the results that will be obtained from the previous types of test, this type of tests is designed. It combines the aging at a high and a low level of SoC. The variation of the capacity loss speed here confirm the results obtained from SIMCAL (the SoC have a big influence on the LIB aging). To quantify this influence, a combined analysis, of these tests and the pure calendar tests, is required (at the end of the tests).

Cycling aging

In order to discriminate the effect of SoC on the cycling aging mechanisms, experiments contain cycling tests at different values of SoC is needed (Cycling at fixed SoC). Then to measure the effect of SoC variation like in real life aging, some tests are designed for cycling in a specified range of SoC.

Cycling at fixed SoC

The treated factors here are temperature (3 values), SoC (4 values), charge current (2 values) and discharge current (2 values). For this category of test, there are 2 main values of charge or discharge current: "MAX" and "min", they are defined differently for each technology. The "min" and "MAX" values for the charge current can define respectively a normal or a rapid charge whereas for the discharge current they describe the economic or the non-economic driving. For Techno#1 the "MAX" and "min" values are respectively 1C and C/3 however for Techno#2 they are 3C and 1C. The choice of current level is related mainly to the batteries application (Techno#1 EV and Techno#2 PHEV). The cycling at a fixed SoC consists in a cycling of +/-5% around a SoC value.

To build a full factorial design of experiments (DoE) for these selected factors, we need 48 tests for each technology. Taking into account the available equipment for MOBICUS project and its duration, only 17 tests for each technology can be realized. A D-optimal design [START_REF] Gauchi | Plans d'expériences optimaux: un exposé didactique[END_REF] is thus chosen to answer these conditions, and the obtained DoE is decomposed on three test waves to be the more adaptive as possible. These tests are distributed among three waves (Table 2). The first wave contains 9 tests, the second one 4 tests and the last 4 tests).

The first wave is a DoE subset with only 2 values of SoC designed to study the simple effect of factors and to get an overview of interaction between temperature and SoC. The second and third waves could be modified according to the first wave's results in order to study more precisely the SoC effect (with 4 levels), and other factor interactions. The first results of the wave#1 (e.g. Figure 6) showed that there is no much difference between on the one hand, tests at Icharge="MAX" and Idischarge ="min" and on the other hand, tests at Icharge="min" and Idischarge ="MAX". That's why all the tests susceptible to be changed are delayed to the wave#3 in order to properly analyse the results of the wave#1 and some first results of the second wave of tests. The figures below represent the first results of the first techno. The Figure 6 represents the capacity loss at 25°C for different SoCs however; the Figure 7 illustrates the capacity loss at the same SoC (SoC 30) at different temperatures (0, 25 and 45°C) The figure above confirms what it is expected, that at the same current and temperature conditions, the capacity loss is more important at high level of SoC than at low SoC level. This latter figure shows that the high temperature is the most degrading factor for batteries life even at low level of current (Icharge=Idischarge=min=C/3). More results can be collected and analysed side by side at the end of the experimental part of the project. To build rigorous aging laws that takes into account all the tested factors.

Cycling in a range of SoC

The main objective of this type of tests is to validate the results of the previous tests. It can also contribute to study the batteries aging of professional automotive application (vehicle that travels long distances daily). This cycling aging is tested within two current profiles, a constant current profile and a Dynamic Stress Test (DST) profile [START_REF] Duong | USABC and PNGV test procedures[END_REF], at 2 different temperatures (0 and 45°C) in a large range of SoC (between SoC 80% and SoC 30%). The figure below (Erreur ! Source du renvoi introuvable.) is a graphical representation of the difference between cycling at fixed SoC (part 2.2.1) and cycling in a range of SoC (part 2.2.2) for the same level of current (1C). The current level of the cycling in a range of SoC at a constant current profile is the same as the "MAX" level of cycling at fixed SoC to simplify the comparison between these two tests types and also to have the same cells heating.

Current level:

Techno#1 Icharge=Idischarge=1C

Techno#2 Icharge=Idischarge=3C Since we've just started this type of tests, the results above are extracted after only one check-up. At a further stage, these results will be combined and compared with the others of cycling at fixed SoC.

Mixed calendar/cycling aging

The third category of tests is the mixed aging tests. It consists on a combination of the calendar and cycling aging to approach the real life automotive application.

For each technology there are 3 modules per temperature (25 and 45°C) in three different patterns.

Each pattern is a repetition of a 12 hours loop containing an alternation between the cycling and calendar aging Table 3. The difference between the patterns is either the ratio cycling and calendar or the SoC level The cycling part consists on cycling between (SoC target + 5%) and (SoC target -5%) at "MAX" current (Techno#1=1C; Techno#2=3C), just like the cycling at fixed SoC. The calendar part is like a rest stage at the chosen SoC. More details about this category of tests and analysis are presented in a separate paper submitted also to EVS29 : "Capacity fade of lithium-ion batteries upon mixed calendar/cycling aging protocol"

Periodical characterisation

A check-up protocol is periodically applied to the tested cells in order to track their characteristics and status of aging. Firstly, a charge/discharge pattern at C/10 is individually applied on each cell which enables to measure cell capacity and observe voltage behaviour at low C-rate. Also, it enables to realise incremental capacity analysis (ICA) on cells at different state-of-health [START_REF] Dubarry | Identifying battery aging mechanisms in large format Li ion cells[END_REF]- [START_REF] Smith | Narrow Range Cycling and Storage of Commercial Li Ion Cells[END_REF]. Particularly, a representation of ICA curves are realised for the both technologies summited to cycling at 0°C SOC80% at minimum C-rate (Figure 11). ICA profiles of both technologies presents three significant peaks located at 3.5, 3.9 and 4.05 V for Techno#1 and, at lower voltages for Techno#2, i.e. at 3.45, 3.65 and 3.75 V. These peaks have equivalent levels for Techno#1 despite of the 2 nd technology which presents one predominant peaks around at 3.65 V. For both technologies, we can observe that aging occurs a decrease of peak level and a decay to high voltage. This effect could be due to cumulative effect of charge slippage and LAM (Loss of Active Material).

Secondly, a pulsed profile pattern is applied on the module each 5% of SOC during discharge and charge in order to measure open circuit voltage (OCV) and impedance of cells. In order to compare easily direct current resistance (DCR) measurements and ICA curves, resistances are represented versus OCV for both technologies in similar previous conditions (Figure 12). Resistances of the two tested technologies present similar behaviour with an important rise for low voltage under 3.6V for Techno#1 and 3.5 V for Techno#2.

For both technologies, we can observe a cross of charge and discharge DCR curves. It happens one time for Techno#1 around 3.95 V and two times for Techno#2 at 3.7 V and 3.95 V. This phenomenon traduces OCV plateau transition. For Techno#2, the cross observed at 3.7 V disappears for 79% of SOH which can be due to charge slippage.

Conclusion

An ambitious and innovative experiment campaign is organized to study the aging of LIB under real use conditions. Calendar and cycling aging are studied in separate and mixed tests. The program mobilizes 12 partners and 18 experimental test benches. 258 cells from 2 technologies of LIB are tested. All the collected data will feed into aging laws and models at the end of the project.

Figure 1 :

 1 Figure 1 : Pure Calendar aging tests first results: Capacity loss for each technology at SoC 80

Figure 2 :

 2 Figure 2 : Planning of the test showing periodicity of Check-Up (CU) and Thermal Cycling (TC) This type of tests helps us better understand the influence of the variable temperature on the calendar aging. The figure below (Figure 3) represents our first results.

Figure 3 :

 3 Figure 3 : Thermal cycling calendar tests first results: Capacity loss for each techno

Figure 4 :

 4 Figure 4 : Planning of the test showing periodicity of Check-Up (CU) and calendar storage at various SoC

Figure 5 :

 5 Figure 5 : Variable SoC calendar tests first results: Capacity loss for each techno

Figure 6 :

 6 Figure 6 : Cycling at fixed SoC first results: Capacity loss at 25°C at different SoC for Techno#1

Figure 7 :

 7 Figure 7 : Cycling at fixed SoC first results: Capacity loss at SoC 30 at different temperature for Techno#1

Figure 8 :

 8 Figure 8 : Difference between cycling at fixed SoC and in a range of SoC

Figure 9 :

 9 Figure 9 : Cycling in a range of SoC first results: Capacity loss after the first 10000 throughput Ah

Figure 10 :

 10 Figure 10 : Mixed calendar/cycling aging first results: Capacity loss per time and per Ah

Figure 11 :

 11 Figure 11 : Incremental capacity analysis at different state-of-health on (a) Techno#1 and (b) Techno#2 at different SOH attained after cycling at 0°C SOC80% with minimum C-rate.

Figure 12 :

 12 Figure 12 : 10s -DCR vs OCV measured on (a) Techno#1 and (b) Techno#2 at different SOH attained after cycling at 0°C SOC80% with minimum C-rate.

Table 1 :

 1 characteristics of the two technologies of LIB testes in MOBICUS

	Technology Composition	Capacity	Type	Application
	#1	NMC-LMO	43 Ah	Energy	EV
	#2	NMC-Ni rich	26 Ah	Power	PHEV
	In this project 86 modules are in test (40 modules for Techno#1 and 46 for Techno#2). For each
	technology, each module represents a different test (different conditions: temperature, SoC, current of
	charge or discharge). For measurements quality, every module is composed of three cells. This means 258
	cells are in test in MOBICUS

Table 2 :

 2 experiments plan for cycling around a SoC tests for one technology

	Wave#2 (changed)

Table 3

 3

			: cell ratings for both tested technologies
	Pattern	Duration of the cycling part per 12 h Duration of the calendar part per 12 h	SoC (%)
	Pattern 1	2 hours	10 hours	80
	Pattern 2	2 hours	10 hours	65
	Pattern 3	6 hours	6 hours	65

Acknowledgments

We acknowledge all members of the MOBICUS program for their fruitful discussions The 12 partners involved in MOBICUS are: Renault (Leader), Siemens, Valéo, EDF, Controlsys, DBT, CEA, IFPen, IFSTTAR, EIGSI-La Rochelle and IMS-Univ Bordeaux. Invited partners are: PSA, Saft, UTC, ERDF and La Poste. This work obtained financial support from BPI France, the Conseil Général des Yvelines and the Conseil Régional du Nord-Pas de Calais.

Authors


Arnaud Delaille

Sébastien Grolleau

François Duclaud

Julien Bernard

Renaud Revel

Serge Pelissier

Eduardo Redondo-Iglesias

Jean-Michel Vinassa

Akram Eddahech

Christophe Forgez

Sim-

B Crouzevialle

J Lejosne

S Mailley

B Molina-Concha

L Jamy

/ Eigsi

: A Guignard

A Mieze

Ifp Energies

F Moreau

I Clémençon

D Audigier

F Badin

F Le-Berr

V Sauvant-Moynot

J Hafsaoui

P Aubret

/ Lrcs

: M Morcrette

C Delacourt

C Adès

/ Psa

Peugeot Citroën

: M Capelle

T Prenant

/ Saft

SIMCAL Project: calendar aging results obtained on a panel of 6 commercial Li-ion cells

Introduction

Battery performances degrade over time, not only due to their charge/discharge profile, commonly called 'cycling aging', but also at rest, commonly called 'calendar aging' [START_REF] Kassem | Calendar aging of a graphite/LiFePO4 cell[END_REF][START_REF] Broussely | Aging mechanism in Li ion cells and calendar life predictions[END_REF][START_REF] Belt | Calendar and PHEV cycle life aging of high-energy, lithium-ion cells containing blended spinel and layered-oxide cathodes[END_REF][START_REF] Bloom | An accelerated calendar and cycle life study of Liion cells[END_REF]. This second type of aging is much less studied than the first one, probably due to the fact that the purpose of a battery is precisely to be charged / discharged. Many efforts have thus been made by battery manufacturers to improve aging in cycling. Moreover, we intuitively expect a greater impact on aging of cycling compared to rest time. However, time spent at rest can be prominent in many applications. This is the case of vehicles (including electric vehicles) which stay at rest approximately 90% of their time (in parking mode). This is why the SIMCAL Project, conducted by 14 French partners, focused on the study of calendar aging during 3 years. This communication establishes a synthesis of performances obtained, and describes the main aging mechanism understood thanks to post-mortem analyses.

Experimental

The SIMCAL study focused on a panel of 7 commercial battery technologies, including 1 NiMH and 6 Li-ion cells references, among which 1 C/NCA, 1 C/NMC, 1 C/LMO-NMC, and 3 C/LFP. Only results obtained on Li-ion cells are discussed in this communication, the case of the NiMH being too specific to be compared to Li-ion results. The table below gives the general characteristics of the 6 Li-ion cells tested. 9 storage conditions including 3 temperatures (30°C, 45°C, and 60°C respectively) and 3 SOC (30%, 65%, and 100% respectively) have been applied to the cells stayed at rest and disconnected up to 2 years and half (shorter test durations for more severe storage conditions). Aging was punctuated by periodical electrical tests performed at 25°C, including a residual discharge followed by 2 complete cycles at 1C in charge and discharge to assess the State-of-Health (SOH). For each condition, 3 cells were tested to verify the reproducibility of the results, and allow the sample of 2 cells during aging for autopsies, including SEM, XRD, and electrochemical measurements on half-cells [START_REF] Kassem | Post-mortem analysis of calendar-aged graphite/LiFePO4 cells[END_REF].

Results and discussion

The Fig. 1 presents the calendar aging results obtained on 6 commercial Li-ion cells (Tab. 1) according to the 9 conditions previously mentioned (3T 3 SOC). Generally speaking, results obtained confirm that the calendar aging increases for all Li-ion technologies with the temperature, and in a lesser extent with the SOC. However, as also indicated by the figure above, each technology follows its own aging laws.

On the other hand, post-mortem analyses realized on 4 cells (Tab. 1) have shown that a same main mechanism is involved in the calendar aging of these cells, namely the loss of cyclable lithium. As shown by the Fig. 2, the maximum lithium stoichiometry of cathodes collected from cells decreases with the capacity fade, results obtained both from XRD and electrochemical titration. These results are interpreted as the consequence of the Solid Electrolyte Interphase (SEI) growth at the negative electrode / electrolyte interface, that consumes Li ions and leads consequently to an increase of the imbalance of electrodes, and so to the diminution of cyclable Li.

Conclusion

Results obtained in the SIMCAL Project confirm the necessity to address the calendar aging when one wishes to forecast the lifetime of batteries. This type of aging may even become the dominant aging factor depending on the temperature and the SOC usage profile. Moreover, this aging mode is not representative of one application and its study is hence useful for virtually all applications. This type of aging is also particularly interesting since it can be partially contained by a thermal and/or a SOC range management strategies. Finally, post-mortem analyses have helped to better understand the aging mechanisms involved in calendar aging, mainly ruled by the loss of cyclable Li considering the autopsied cells.

Fig. 1 :

 1 Fig. 1: Calendar aging measured on 6 Li-ion commercial cells according to 9 aging conditions (measured data)

Fig. 2 :

 2 Fig. 2: Cells capacity fade vs. cathodes maximum Li stoichiometry

Tab. 1: characteristics of the studied cells

	Cell #	1	2	3	4	5	6
	Cell chemistry	C/NCA	C/NMC	C/LMO-NMC	C/LFP	C/LFP	C/LFP
	Nominal capacity (Ah)	7.0	12.0	5.3	8.0	15.0	2.3
	Post-mortem analyses (Y/N)	N	Y	N	Y	Y	Y

Acknowledgments

The authors would like to acknowledge the French National Research Agency for its financial support to the SIMCAL Project.

Bibliography


Sarah El-Samad

Dany Obeid

Gheorghe Zaharia

Sawsan Sadek

Ghaïs El

International Journal on Communications Antenna and Propagation (IRECAP) Remote Heartbeat Detection Using Microwave System from Four Positions of a Normally Breathing Patient

Keywords: Doppler radar, Electrocardiograph, Heartbeat rate, Microwave system, Noncontact detection I

This paper presents a microwave system for the detection of the cardiopulmonary activity. Measurements are performed at different operational frequencies and from different sides of a healthy subject who is breathing normally while sitting at 1 meter from the system. Simultaneously with the microwave system, a PC-based electrocardiograph is used in order to validate the heartbeat rate detection. Cardiopulmonary signals are processed using wavelet transforms in order to extract the heartbeat signal. The obtained results upon using the proposed system show the ability of detecting the cardiopulmonary signals at four sides of the subject, and the signal processing techniques show high accuracy in extracting the heartbeat signal and the heartbeat rate.

Introduction

Contactless monitoring of vital signs is needed in medical surveillance applications and in healthcare [START_REF] Kuutti | Evaluation of a Doppler radar sensor system for vital signs detection and activity monitoring in a radio frequency shielded room[END_REF], especially for burn patients where the use of the traditional electrodes to measure vital signals like cardiopulmonary signals is not possible. Due to the microwave sensitivity toward tiny movements, radar has been employed as a noninvasive monitoring system of human cardiopulmonary activity [START_REF] Wang | A hybrid FMCW-Interferometry Radar for indoor precise positioning and versatile life activity monitoring, Microwave Theory and Techniques[END_REF].

Several radar types are used for the vital signs detection like ultra-wideband (UWB) radars, frequency modulated continuous wave (FMCW) radars, and continuous wave (CW) Doppler radars. Each of these radar technologies can measure the Doppler shift and has its own advantages and disadvantages. UWB radar can detect range and breathing rate for one or more persons [START_REF] Rahman | Signal processing techniques for vital sign monitoring using mobile short range Doppler radar[END_REF]. FMCW radar allows measuring distance of the detected subject [START_REF] Wang | Clutter interference reduction in coherent FMCW radar for weak physiological signal detection[END_REF], and can detect motion, but accuracy is a critical issue. It requires a 1.5 GHz bandwidth to achieve 10 cm resolution; hence they cannot meet the requirement of vital sign monitoring or small gesture classification. Recently, a technique based on coherent phase detection of the FMCW signal has partially solved this problem [START_REF] Wang | Clutter interference reduction in coherent FMCW radar for weak physiological signal detection[END_REF].

Although CW Doppler radar cannot detect range, it has been widely used due to its high precision in displacement's measurement [START_REF] Wang | A hybrid FMCW-Interferometry Radar for indoor precise positioning and versatile life activity monitoring, Microwave Theory and Techniques[END_REF]. In addition, it is relatively immune to stationary clutter interference [START_REF] Crocco | A review on ground penetrating radar technology for the detection of buried or trapped victims[END_REF]. Various RF architectures have been proposed in the literature [START_REF] Li | A Review on Recent Advances in Doppler Radar Sensors for Noncontact Healthcare Monitoring[END_REF]. Each of them shows its specific advantage in certain environments. The first architecture is homodyne architecture. It is designed to eliminate the null detection problem of a single-channel Doppler radar.

The second one is the heterodyne architecture; it has the advantage over the homodyne architecture by its robustness against DC offset. The third one is the double side band; it is useful when designing vital sign radars operating at high frequencies such as millimeter wave or above.

On the other hand, several processing techniques are applied to isolate multiple subjects and clutter noise like blind source separation (BSS), passive RF tags [START_REF] Li | A Review on Recent Advances in Doppler Radar Sensors for Noncontact Healthcare Monitoring[END_REF] and curvelet transform [START_REF] Li | Advanced Signal Processing for Vital Sign Extraction With Applications in UWB Radar Detection of Trapped Victims in Complex Environments[END_REF]. Others are used to separate heartbeat from cardiorespiratory signals based on bandpass filters [START_REF] Singh | System modeling and signal processing of microwave Doppler radar for cardiopulmonary sensing[END_REF][START_REF] El-Samad | Contact-Less measurement system or cardiopulmonary activity[END_REF] continuous-wavelet filters and ensemble empirical mode decomposition (EEMD) [START_REF] Hu | Noncontact Accurate Measurement of Cardiopulmonary Activity Using a Compact Quadrature Doppler Radar Sensor[END_REF] and LMS adaptive harmonic cancellation algorithm [START_REF] Zhang | The Separation of the Heartbeat and Respiratory Signal of a Doppler Radar Based on the LMS Adaptive Harmonic Cancellation Algorithm[END_REF]. Previous studies have shown the ability of detecting the heartbeat activity from the front side of the patient only. However, in practical cases, the patient can turn while sleeping. Also, detecting life signs for earthquake victims should be at any side of the person.

In this work, the heartbeat rate has been extracted at different frequencies from four positions for a person who breathes normally. To overcome the clutter and accuracy problems, CW Doppler radar is used. In order to validate the proposed measurement system and the selected signal processing technique, measurements were performed simultaneously with a PC-based electrocardiograph.

The rest of this paper is organized as follows: Section II describes the measurement system. Section III presents the signal processing techniques. Obtained results are summarized and discussed in Section IV. Finally, Section V gives some concluding remarks.

II. Measurement System

For a Doppler radar, a continuous wave signal reflected from a target will be modulated by the target movement [START_REF] Rahman | Signal processing techniques for vital sign monitoring using mobile short range Doppler radar[END_REF]. Indeed, based on the Doppler theory, a static target having a quasi-periodic movement will reflect a transmitted signal with its phase modulated by the target's position and velocity [START_REF] Byung-Kwon | Single channel receiver limitations in Doppler radar measurements of periodic motion[END_REF]. When the target is a person's chest, the reflected signal will contain information about the chest's displacement; hence, it contains information for both breathing and heart beating. The relationship between the chest displacement x(t) and the phase variation (t) of S 21 is:

∆Ɵ(𝑡) = 4𝜋∆𝑥(𝑡) 𝜆 (1)
where  is the wavelength of the transmitted signal [START_REF] Obeid | Multitunable microwave system for touch less heartbeat detection and heart rate variability extraction[END_REF].

Theoretically, while holding the breath, the heartbeat activity causes a chest-wall motion between 0.2 and 0.5 mm. When breathing normally, a breach causes chestwall motion between 4 and 12 mm. At rest, the frequency corresponding to breathing rate varies between 0.1 and 0.3 Hz, while the frequency corresponding to heartbeat rate varies 1 and 4 Hz [START_REF] Obeid | Multitunable microwave system for touch less heartbeat detection and heart rate variability extraction[END_REF]. For children over 3 years and adult people, the heartbeat frequency varies between 1 and 2 Hz.

The heartbeat and respiration rates are extracted from the cardiopulmonary signal obtained upon using the proposed system. This system consists of a Vector Network Analyzer (VNA) (Agilent N5230A 4-Port) that operates at frequencies up to 20 GHz, and two horn antennas. The horn antennas used in this experiment are the Q-par Angus Ltd (model number WBH2-18HN/S) operating between 2 and 18 GHz. Their characteristics are summarized in Table I. The overall system including the VNA, the antennas, and the PC-based ECG are presented in Fig. 1.

Fig. 1. Measurement setup

Using a VNA provides many advantages that allow: tuning both the operational frequency and the transmitted power, setting the sampling frequency of the signal and the measurement duration, and measuring several parameters including the time variation of the phase as well as the magnitude of the S parameters.

The proposed system has advantages over other systems by its ability of tuning the transmitted power and emitted signal frequency when performing measurements for the same person under test. Thus, the minimal transmitted power and the optimal operational frequency can be determined. Determining the minimal power is important for the safety of the patient and minimizes the risk of high radiation exposure. In addition, determining the optimal operational frequency helps obtaining the most accurate results for the final system. The frequencies of the transmitted CW signal chosen for this study are: 2.4 GHz (ISM S-band), 5.8 GHz (ISM Cband) and 10 GHz (X-band). The person under test is a 54-year-old sitting at a distance of 1m from the system and breathing normally. This distance is chosen as the measurement could be performed in a hospital room or in a medical office. In addition, from a technical point of view, this distance must not be increased in order to receive a signal with a large signal to noise ratio, able to ensure good accuracy of measurement results. The radiated power of the antenna depends on the transmitted power measured at the input of the transmit antenna and the gain of the antenna, as given in equation 2:

P r (dBm) = P t (dBm) + G (dB) (2)
where P r is the radiated power, P t is the transmitted power, and G is the gain of the antenna. The radiated power is fixed at 0 dBm in order to limit the possible impact on the health patient and the medical staff. Therefore, using (2) and the antenna gain values given in Table I, the power of the transmitted signal is -11 dBm at 2.4 GHz, -16 dBm at 5.8 GHz and -19 dBm at 10 GHz.

Table II summarizes the characteristics of the measurement setup. Each measurement lasts 30 seconds and is performed at four sides of the person under test: Front, Back, Left and Right sides. Fig. 2 represents all measurement's positions.

To validate the proposed system, radar system measurements are performed simultaneously with ECG measurements. Fig. 3 presents an example of the phase variation (deg) of S 21 measured at 5.8 GHz and for a radiated power of 1 mW from the front side of the person. It shows 11 peaks over 30 seconds of observation window. These peaks are mainly due to the breathing frequency, which corresponds to about 0.33 Hz.

III. Processing Techniques

As breathing causes larger chest-wall motion than heart beating, the phase variations of S 21 will be larger for the former. Thus, an advanced signal processing technique is required in order to extract the heartbeat signal from the cardiopulmonary signal. According to the literature, several methods of signal processing show the ability of extracting the heartbeat signal from the measured cardiopulmonary signal such as classic filtering, fast Fourier transform (FFT) [START_REF] El-Samad | Contact-Less measurement system or cardiopulmonary activity[END_REF], short time Fourier transform (STFT) and wavelet transform. Classic filters are widely applied for the heartbeat extraction, but the variation of the heartbeat cannot be extracted due to the distortion obtained when applying classic filters. Fast Fourier transform rapidly converts a signal from time domain to frequency domain. Hence, the heartbeat signal is converted to frequency domain, and then the frequency corresponding to the rate of the heartbeats is extracted by choosing the maximum amplitude between 0.8 and 3 Hz. FFT is not efficient because the frequency of the heartbeat changes over time, hence, the heart rate variability (HRV) cannot be extracted. In order to track the variation of the HR over time, the Short-Time Fourier Transform is proposed (STFT). This technique based on applying the Fourier transform over portions of the signal, namely windows, instead of applying the Fourier transform over the whole signal. This allows analyzing the signal in time and frequency domain with a variable resolution according to the selected length of the window. Short window results in high resolution in time, and poor resolution in frequency, while large window results in poor resolution in time, but high resolution in frequency.

The drawback of the STFT of having unchanged window length, which results in dilemma of resolution, has been overcome with the wavelet transform. The principles of wavelet transform consist of splitting the signal into many signals, and representing the signals corresponding to different frequency bands. This provides information about what frequency bands exist at what time intervals. There are two types of wavelets: continuous wave transform (CWT) and discrete wavelet transform (DWT). DWT is interesting in the context of fast and non-redundant transforms. The DWT is the signal processing tool used in order to extract the heartbeat signal from the cardiopulmonary signal, hence, extracting the heartbeat rate. The DWT (𝑊 𝑗,𝑘 ) of a signal 𝑓(𝑡) is given by the scalar product of 𝑓(𝑡) with the scaling function (i.e. the wavelet basis function) ∅(𝑡) which is scaled and shifted:

𝑊 𝑗,𝑘 = 𝑓(𝑡), ∅ 𝑗.𝑘 (𝑡) > (3)
The basis function is given by:

∅ 𝑗.𝑘 (𝑡) = 2 -1 2 ⁄ ∅(2 -𝑗 𝑡 -𝑘) (4)
where j is the j th decomposition level or step and k is the k th wavelet coefficient at the j th level. Wavelet has several families like Daubechies, Coiflets, Symlets, etc. The difference between wavelet families make compromise between how compactly they are localized in time and how smooth they are. The number of coefficients and the iterations used in the wavelets are classified as subclasses. As the DWT analyzes the signal at several frequency bands with different windows lengths and different resolutions, it decomposes the signal into approximation 'A' and detail information 'D'. These are computed by successive low-pass and high-pass filtering of the discrete time-domain signal where 'A' represents the low-pass filtered signal and 'D' represents the highpass filtered signal [START_REF] Blackburn | Retrieval of chlorophyll concentration from leaf reflectance spectra using wavelet analysis[END_REF]. After trial and error, Daubechies 5 shows the most precise results and is presented in this study. The DWT principle is resumed in Fig. 4. In general, Dn contains frequencies between fs/2 𝑛+1 and fs/2 𝑛 , where fs is the sampling frequency and is the decomposition level (n = 1, 2, …). The heartbeat rate for an adult is between 60 and 120 beats per minute, hence the frequency of the heartbeat is located between 1 and 2 Hz. A resampling method is necessary in order to obtain the decomposition of the signal in the appropriate frequency band. Thus, converting the sampling frequency from 666.7 Hz to 512 Hz results in obtaining the wavelet decomposition having frequencies between 1 and 2 Hz at the 8 th level. A peak detection technique is applied in order to extract the heartbeat rate from the 8 th decomposition.

IV. Results and Discussion

Fig. 5 presents the peak detection of the ECG signal when the microwave measurement is performed from the back-side of the person under test. The ECG is a bipolar derivation. The sampling frequency of the ECG is 360 Hz and the amplitude resolution is 350 adu/mV (analog to digital unit per milliVolt). The peak detection is applied in the time domain. For a duration of 30 seconds, 40 peaks are detected from the ECG signal while 37 peaks are detected from the signal obtained with the VNA at 2.4 GHz. Heart rate is calculated using relation ( 5):

𝐻𝑅 = 60(𝑁-1) 𝑑 1 +𝑑 2 +⋯+𝑑 𝑁-1 (5)
where N is the number of peaks and d k is the duration, in seconds, of the interval determined by 2 successive peaks. The heart rate is expressed in beat per minute (bpm). The obtained heartbeat rate extracted from the ECG is 88 bpm corresponding to a frequency of 1.46 Hz and the obtained heartbeat extracted from the VNA is 84 bpm corresponding to a frequency of 1.4 Hz. Table III represents the heart rates extracted from both ECG and VNA system for all sides and all emitted frequencies. Figs. 6-8 represent a 10 seconds duration of the D8 decomposition. Peak detection is applied and the heartbeat rate is extracted. Fig. 6 represents the peak detection applied to D8 for the four positions when the microwave system is operating at 2.4 GHz. Fig. 7 represents the peak detection of D8 measured from the four positions at 5.8 GHz, and Fig. 8 represents the peak detection of D8 measured from the four positions at 10 GHz. Relative error 𝑅 between the Heartbeat Rate extracted from the radar system (HR VNA ) and that extracted from the ECG (HR ECG ) is calculated by the relation ( 6): 𝑅𝐸 = 100 × 𝐻𝑅 𝑉𝑁𝐴 -𝐻𝑅 𝐸𝐶𝐺 𝐻𝑅 𝐸𝐶𝐺 [START_REF] Li | A Review on Recent Advances in Doppler Radar Sensors for Noncontact Healthcare Monitoring[END_REF] Table IV summarizes the relative HR error (%) for the measurements performed at different sides of the person and for the different operational frequencies. The obtained results show accurate detection of the heartbeat signal and extraction of the heartbeat rate at several operational frequencies and from different sides from the person under test. Noteworthy to mention that according to the American National Standard [START_REF]Cardiac monitors, heart rate meters, and alarms[END_REF], medical devices measuring the heartbeat rate should have a relative error lower than 10% or 5 bpm.

Fig. 2 .Fig. 3 .

 23 Fig. 2. Measurement positions

Fig. 4 .

 4 Fig. 4. Wavelet decomposition

Fig. 5 .

 5 Fig. 5. Peak detection of the ECG signal

Fig. 6 .

 6 Fig. 6. Peak detection of D8 signal at 2.4 GHz for four positions: (a) front side, (b) back side, (c) left side, and (d) right side

TABLE I ANTENNA CHARACTERISTICS Frequency (GHz) Gain (dB) Half power beam width (deg)

 I

			H	E
	2.4	11	22	18
	5.8	16	10	8
	10	19	8	7

TABLE II CHARACTERISTICS

 II OF THE MEASUREMENT SETUP

	Characteristics	Value
	Sweep time	30 s
	Measurement points	20,000 points
	Sampling frequency	666.7 Hz
	Radiated power	0 dBm

TABLE III HEART

 III RATE EXTRACTED FROM ECG AND FROM VNA FOR EACH FREQUENCY AND EACH POSITION

	Side	Frequency (GHz)	HRVNA (bpm)	HRECG (bpm)
	Front	2.4	83	81
	Front	5.8	81	85
	Front	10	80	84
	Back	2.4	78	85
	Back	5.8	84	88
	Back	10	83	90
	Left	2.4	82	83
	Left	5.8	82	82
	Left	10	79	79
	Right	2.4	91	89
	Right	5.8	75	87
	Right	10	76	89

TABLE IV HR

 IV RELATIVE ERROR (%) FOR ALL FREQUENCIES AND ALL POSITION

	Frequency (GHz)	Back	Front	Left	Right
	2.4	9	3	1	3
	5.8	5	5	0	13
	10	8	4	0	14

Acknowledgements

The authors acknowledge LASER (Lebanese Association for Scientific Research) for funding this study, and "Rennes Metropole" for partially funding this work.

V. Conclusion

A CW Doppler radar system is presented for cardiopulmonary activity detection. Measurements are performed at different operational frequencies simultaneously with an ECG reference system. The heartbeat rate is extracted from a normally breathing person sitting at a distance of 1 meter from the system. The measurements are performed considering four sides of the person and compared to those obtained by the ECG. Obtained results prove the ability of the system to detect the cardiopulmonary signals at a distance of 1 m for four sides of the person under test. Also, the proposed signal processing technique shows the possibility of extracting the heartbeat signal from the cardiopulmonary signal as well as extracting the heartbeat rate. The highest accuracy is obtained when the microwave measurement is performed at the left side of the person under test, while the lowest accuracy is obtained at the right side. Future work will focus on determining the heart rate of the person in movement and behind an obstacle.

AUTHORS' INFORMATION


Sarah El-Samad

Dany Obeid

Gheorghe Zaharia

Sawsan Sadek

Ghaïs El

Feasibility of Heartbeat Detection Behind a Wall Using CW Doppler Radar

Keywords: heartbeat detection, continuous wave Doppler radar, electrocardiogram, heart rate, behind wall

come   L'archive ouverte pluridisciplinaire

I. INTRODUCTION

Contactless monitoring of vital signs is needed in medical surveillance applications and in healthcare [START_REF] Kuutti | Evaluation of a Doppler radar sensor system for vital signs detection and activity monitoring in a radio frequency shielded room[END_REF], especially for burn patients and newly born. In addition, it can be very useful for detecting signs of life of people buried under rubble after an earthquake or tornado.

Non-contact microwave radar sensors have advantages over other contactless measurement systems like those based on video technologies, as microwave radar has sensibility towards tiny movements due to heartbeat and respiration. In addition, Doppler characteristics reveal extra details of motion, and thus enable gesture recognition [START_REF] Wang | Application of Linear Continuous Wave (LFMCW) Radars for Tracking of Vital Signs[END_REF]. Several radar types are used for the vital signs detection like ultra-wideband (UWB) radars, frequency modulated continuous wave (FMCW) radars, and continuous wave (CW) Doppler radars. Each of these radar technologies can be used to measure the Doppler shift and has its own advantages and disadvantages. Here, the CW Doppler radar is used because of its accuracy in the detection of vital signs and its ability to overcome the problem of clutter [START_REF] Wang | A hybrid FMCW-Interferometry Radar for indoor precise positioning and versatile life activity monitoring[END_REF]. The Doppler radar first captures the chest motion. Then the human heartbeat and respiration rates are identified by signal processing techniques [START_REF] El-Samad | Contact-Less measurement system or cardiopulmonary activity[END_REF].

Several processing techniques are applied to separate heartbeat and respiratory signals based on band-pass filters [START_REF] Obeid | Low Power Microwave Systems for Heartbeat Rate Detection at 2[END_REF], continuous-wavelet filters and ensemble empirical mode decomposition (EEMD) [START_REF] Othman | Heart Monitoring Systems at 10 GHz Using Microwave Doppler Techniques for Atheletes Fitness Monitoring System: A Review[END_REF], and LMS adaptive harmonic cancellation algorithm [START_REF] Zhang | The Separation of the Heartbeat and Respiratory Signal of a Doppler Radar Based on the LMS Adaptive Harmonic Cancellation Algorithm[END_REF].

In most of the previous studies, continuous wave Doppler radar was used for detecting vital signs of human subjects in indoor environments, hence the SNR was high. When the Doppler radar works outdoor, the SNR of the radar echo signal becomes low and it may be difficult to extract vital signs. However, detecting vital signs throw wall is highly desirable for a range of organizations, including police, fire, rescue personnel and defense forces to allow the detection even behind an obstacle [START_REF] Muqaibel | Wall Attenuation and Dispersion[END_REF].

In this work, heartbeat rate has been extracted using continuous wave Doppler radar in the presence of a separation wall for a person who breathes normally at 1 m from the system. To validate our measurement system and the selected signal processing techniques, as in [START_REF] Obeid | Microwave Doppler radar for heartbeat detection vs electrocardiogram[END_REF], measurements were performed simultaneously with a PC-based electrocardiogram used as a reference system. The rest of this paper is organized as follows: Section II gives background information; Section III describes the measurement system. Section IV presents the data processing techniques. Obtained results are summarized and discussed in Section V. Finally, Section VI gives some concluding remarks.

II. BACKGROUND INFORMATION

According to the Doppler effect, when the radar signal is reflected by a target having a quasi-periodic motion, its phase will be modulated by the time-varying position of the target [START_REF] Obeid | A tunable-frequency system for touch-less heartbeat detection and HRV extraction[END_REF]. The relation between target displacement ∆x(t) and the phase variation ∆θ(t) is:

∆Ɵ = ∆ (1)
where is the wavelength of the transmitted signal [START_REF] Obeid | Low Power Microwave Systems for Heartbeat Rate Detection at 2[END_REF].

The person's chest is the target; and the reflected signal contains information about the chest displacement due to heartbeat and respiration. When breathing normally, the peak to peak variation of the chest is between 4 and 12 mm [START_REF] Obeid | A tunable-frequency system for touch-less heartbeat detection and HRV extraction[END_REF]. It is caused by respiration. When holding breath, the range of the chest displacement is between 0.2 and 0.5 mm [START_REF] Obeid | A tunable-frequency system for touch-less heartbeat detection and HRV extraction[END_REF]. In this case, the chest displacement is due to heartbeat only. Table I presents frequencies (Hz), heartbeat rates (beat per minute) and respiration per minute for each case.

In this paper, measurements are done on adult persons; hence the frequency range is between 1 and 2 Hz. This work presents the heartbeat detection in the presence of a barrier. Barriers cause attenuation: α and β represent attenuation and phase constants, respectively [START_REF] Muqaibel | Wall Attenuation and Dispersion[END_REF]. They can be expressed in terms of the material properties and frequency as:

α = 2 1 1 ! " β = 2 1 1 ! "
where is the angular frequency, is the permeability, is the real part of the relative permittivity. It accounts for the energy storing capability of the material. is the permittivity of free space and is the effective conductivity. is the sum of static conductivity $ which is responsible for the material's ohmic losses and ac field conductivity % that is responsible to the heating of the dielectric material caused by the dipole oscillations [START_REF] Muqaibel | Wall Attenuation and Dispersion[END_REF]. Based on the formulas, the attenuation may be significant when the frequency increase, hence the error increase when the frequency increase. In addition, this attenuation should cause the augmentation of error relatively to the absence of the barrier.

III. MEASUREMENT SYSTEM

The measurement system is based on a vector network analyzer (VNA) and two horn antennas. Fig. 1 presents the system used for detecting vital signs of a person behind a wall. The VNA is used to measure the time variation of the phase of the S 21 parameter. S 21 corresponds to the difference between the phases of the received and transmitted signals.

The frequencies of the transmitted CW signal chosen for this study are: 2.4 GHz (ISM S-band) and 10 GHz (X-band). This choice allows to compare the accuracy of the results obtained using these frequencies. The horn antennas used in this experiment are the Q-par Angus Ltd (model number WBH2-18HN/S) operating between 2 and 18 GHz. The gain of the antennas is 11 dB at 2.4 GHz and 19 dB at 10 GHz. The total transmitted power is 1 mW (0 dBm). The radiated power of the antenna in dBm is the addition of the transmitted power of the VNA (dBm) and the gain of the antenna (dB); hence the radiated power is 11 dBm at 2.4 GHz and 19 dBm at 10 GHz. During 30 seconds, 20 000 points have been recorded. Hence, the sampling frequency is 666.7 Hz.

A 54 years old person is sitting behind a concrete wall with 10 cm thickness. The distance between the antennas system and the wall is 0.5 m and the distance between the wall and the person is 0.5 m. The person is breathing normally.

To validate the proposed system and the ability of the system to detect heartbeat rate behind wall, the radar system measurements are performed simultaneously with ECG measurements. Fig. 2 presents the peak detection of the ECG signal for a window of 10 s. It is taken at the same moment when the person is setting behind wall with an emitted frequency equal to 2.4 GHz. Hence, 42 peaks are detected.

IV. PROCESSING TECHNIQUES

Processing technique is required in this work because respiratory amplitude is much larger than heartbeat amplitude; hence wavelet transform is chosen as processing technique for heartbeat extraction. This transform is a powerful tool to analyze non-stationary signals because it gives a good localization in time at high frequencies and good localization in frequency at low frequencies [START_REF] Megahed | Selection of a Suitable Mother Wavelet for Analyzing Power System Fault Transients[END_REF]. Two types of wavelets can be used: 'Discrete Wavelet Transform' and 'Continuous Wavelet Transform'. In this paper, 'Discrete Wavelet Transform' (DWT) is used. DWT is computed by successive low-pass and high-pass filtering of the discrete time-domain signal [START_REF] Blackburn | Retrieval of chlorophyll concentration from leaf reflectance spectra using wavelet analysis[END_REF]. After the low-pass filtering the signal corresponds to the approximation (A n ) while after the high-pass filtering the signal corresponds to the detail (D n ). For a signal having a sampling frequency f s , D n contains frequencies between fs/2 &'( and fs/2 & and A n contains frequencies between 0 and fs/2 &'( . By assembling the decompositions and approximations, the original signal is reconstructed. The relation [START_REF] Wang | Application of Linear Continuous Wave (LFMCW) Radars for Tracking of Vital Signs[END_REF] gives the reconstructed signal

) *+,$ -* . = / 0 1 0 ⋯ . . 1 1 ( (2)
where N denotes the maximum level of decomposition.

There are different families of wavelets. Families of wavelets make different trade-offs between how compactly the basic functions are localized in space and how smooth they are. Each family of wavelets has subclasses distinguished by the number of coefficients and by the level of iterations [START_REF] Obeid | A tunable-frequency system for touch-less heartbeat detection and HRV extraction[END_REF]. All families give reasonable results. Because Daubechies 5 gives better results. It is chosen as wavelet family. Because heartbeat rate is between 60 and 120 beats per minute, which corresponds to a frequency between 1 and 2 Hz, resampling method should be applied before wavelet decomposition to finally obtain a decomposition having frequencies between 1 and 2 Hz. In this work, the resampling method is used to convert the sampling frequency from 666.7 Hz to 512 Hz.

In conclusion, D 8 contains the frequencies between 1 and 2 Hz. Peak detection is applied on D 8 . Fig. 4 presents the peak detection applied on D 8 for the results obtained at 2.4 GHz and 10 GHz, with presence and absence of wall.

V. RESULTS

After peak detection of the heartbeat signal, parameters are extracted. The parameter extracted in this work is the heartbeat rate which is calculated using the relation ( 3):

45 = 6 07( . ! '. " '⋯'. 89! (3)
where N is the peaks number and d k is the duration of the interval determined by 2 successive peaks expressed in seconds. Relative error (RE) between the Heartbeat Rate extracted from the radar system (HR VNA ) and that extracted from the ECG (HR ECG ) is calculated by the relation (4):

5: = 100 < => ?8@ 7 => ABC => ABC (4)
Table II presents the heartbeat rates extracted from ECG and the VNA, as well as the relative error for each case and each emitted frequency. Based on the American National Standard [START_REF]Cardiac monitors, heart rate meters, and alarms[END_REF], the system is considered accurate when the relative error is lower than 10% or 5 bpm difference between the reference ECG and the microwave system. In general, obtained results are acceptable. The relative errors for measures taken directly in front of the person are less than 5 % and for those taken behind the wall are slightly less than 10 %.

VI. CONCLUSION

In this paper, a CW Doppler radar system has been used for cardiopulmonary activity measurements in different cases. ECG is taken as a reference signal and compared to the VNA signals. The heartbeat rate is extracted from a person sitting at a distance of 1 meter from the system, with emitted frequencies 2.4 and 10 GHz and in 2 cases: in presence and absence of wall. The system is able to detect the heartbeat signal at a distance of 1 m for both cases. Relative errors without wall are less than 5% and increase to 11% with presence of wall. Other measures can be done to ensure that daubechies 5 is better than other wavelet families and to ensure that relative error increase when frequency increase with presence of barrier. Future work will focus on determining the heartbeat rate of the person in movement and behind an obstacle.

Fig. 1 .

 1 Fig. 1. Measurement system for a person behind a wall.

Fig. 2 .

 2 Fig. 2. Peak detection of an ECG signal.

Fig. 3

 3 Fig.3presents the phase variation (deg) of S 21 for a person who is sitting in front of the system at 2.4 GHz and 10 GHz and for a person sitting in front of the system without and with a barrier (wall) for 2 different frequencies: 2.4 GHz and 10 GHz. These signals represent the cardiorespiratory signal.

Fig. 3 .

 3 Fig. 3. Phase of S21 (deg).

Fig. 4 .

 4 Fig. 4. Peak detection applied on D8.

TABLE I .

 I FREQUENCIES AND RATES OF RESPIRATION AND HEARTBEAT

	Case	Frequency (Hz)	Rate (breathes or beats /min)
	Respiration	0.1 to 0.3	6 to 18
	Heartbeat	1 to 3	60 to 180
	Adult Heartbeat	1 to 2	60 to 120
	Babies heartbeat	2 to 3	120 to 180

TABLE II .

 II HEARTBEAT RATE EXTRACTED FROM ECG AND FROM VNA FOR EACH FREQUENCY AND EACH CASE

	Case	Frequency	HRVNA	HRECG	Relative
		(GHz)	(bpm)	(bpm)	Error (%)
	Direct	2.4	83	81	2.46
	Direct	10	80	84	5
	Behind wall	2.4	76	85	10.58
	Behind wall	10	80	90	11.11

ACKNOWLEDGMENT

The authors acknowledge LASER (Lebanese Association for Scientific Research) for funding this study, and "Rennes Metropole" for partially funding this work.


Xavier Bultel

Pascal Lafourcade

A Posteriori Openable Public Key Encryption

Keywords: Public-Key Encryption, Openable Encryption, ROM, CPA

We present a public key encryption primitive called A Posteriori Openable Public Key Encryption (APO-PKE). In addition to conventional properties of public key cryptosystems, our primitive allows each user, who has encrypted messages using different public keys, to create a special decryption key. A user can give this key to a judge to open all messages that have been encrypted in a chosen time interval with the public keys of the receivers. We provide a generic efficient construction, in the sense that the complexity of the special key generation algorithm and this key size are independent of the number of ciphertexts. We give security models for our primitive against chosen plaintext attack and analyze its security in the random oracle model.

Introduction

Since the emergence of the Internet, email communication is accessible to anyone. Email privacy is an important computer security topic. Without public key encryption schemes, plaintext messages are sent and stored by the mail server without any protection. Fortunately, there exist many straightforward to use softwares that allow everyone to encrypt and sign emails using public key cryptography, such as the well known GnuPG 3 tool. Unfortunately, these softwares are rarely used [START_REF] Whitten | Why johnny can't encrypt: A usability evaluation of pgp 5.0[END_REF], consequently encrypted emails may be considered as a suspect behavior. Hence as P. Zimmermann, the designer of PGP, said:"If privacy is outlawed, only outlaws will have privacy". We hope that in a near future everybody can privately exchange emails. Then our motivation is based on the following scenario, where Alice is implied in a court case. To find some clues, the judge needs to read emails that Alice has sent during a specified time period. The judge uses his power to obtain from Alice's email server all emails sent by Alice (including dates of dispatch and receiver identities). If the messages are not encrypted then the judge can read emails without relation to the investigation, which is a privacy violation. On the other hand, if messages are encrypted with the receiver public key then the judge can suspect Alice to hide crucial information for the investigation. Moreover, without the receivers' private keys, Alice has no solution to prove her innocence and cannot reveal his correspondence to the judge.

To solve this problem, Alice needs a mechanism to give to the judge a possibility to open all messages sent during a specified time period. Using our solution Alice can construct such a special key called an interval-key. With this key, the judge can only read the encrypted messages sent during this specific interval of time, because this key does not allow him to open other encrypted messages stored on the email server. Nowadays, to the best of our knowledge, there is no efficient cryptographic solution that offers such functionality to the users. The goal of this paper is to propose a practical and efficient solution to this problem.

In many public key cryptosystems, when a ciphertext is generated, it is possible to create a special key that allows a person to decrypt it, without knowing the corresponding secret key. For example, in ElGamal [START_REF]A public key cryptosystem and a signature scheme based on discrete logarithms[END_REF], C = (C 1 , C 2 ) = (g r , g x•r • m) is the ciphertext of the message m with the public key g x and a random element r (for g a generator of G a group of prime order). Knowing the random element r, the public key of Bob g x and the ciphertext C a third party can compute C 2 /(g x ) r = m to recover the plaintext. Using this property it is possible to construct a naïve solution by giving n random elements to a third party to decrypt n ciphertexts. However, this method presents an inherent limitation when the number n is large and the user has to store all the random elements used to encrypt all the messages during an interval of time. The aim of this paper is to allow a user to construct an interval-key to decrypt several consecutive messages in a time interval where the size of the key, the stored information and the key generation complexity are constant and do not increase with the number of ciphertexts.

Contributions:

We first present the notion of Random Coin Decryptable Public Key Encryption (RCD-PKE). The idea of RCD-PKE is that one can open a ciphertext with the secret key and also use the random coin used during the encryption to open a cipher. We show that several existing schemes in the literature satisfy this notion, e.g. [START_REF] Abdalla | DHIES: an encryption scheme based on the Diffie-Hellman problem[END_REF][START_REF] Cramer | Design and analysis of practical public-key encryption schemes secure against adaptive chosen ciphertext attack[END_REF][START_REF] Fujisaki | Secure integration of asymmetric and symmetric encryption schemes[END_REF]. We use the RCD-PKE property to construct a scheme that allows a user to generate an interval-key for a judge to open all the messages he sent during a period of time. This scheme, called A Posteriori Openable Public Key Encryption (APO-PKE), allows the judge to open all messages sent between two given dates. The number of ciphertexts is potentially infinite but the judge decryption capability is limited to the a posteriori chosen interval. It contains, like a standard public key encryption, a key generation function, an encryption function and a decryption function. It also has an extraction function that, given two ciphertexts and a secret value, generates an interval-key for the judge. Using this interval-key he can then open all messages encrypted by different public keys between the two ciphertexts for which the key has been created. Our scheme is generic since it only relies on any IND-CPA secure RCD-PKE and hash functions.

Performances: Our scheme has reasonable encryption and decryption execution time overhead comparing to the PKE we use, because the size of ciphertexts generated by our scheme is approximately the double of the size of the PKE encryption. Moreover the generation of the interval-key, its size and the stored information are also independent of the number of messages contained in the interval of time. Finally, there is no restriction neither about the total number of generated ciphertexts nor about the number of ciphertexts in a time interval.

Security: We provide the security models to prove the security of our schemes in the Random Oracle Model (ROM). We prove that the judge colluding with some users cannot learn more than the messages for which he received the interval-key. We also show that several users cannot collude in order to learn information about plaintexts contained in an interval of ciphertexts with the judge interval-key. We also demonstrate that the judge gets the same plaintext as the one received by the owners of the secret keys. This means that it is not possible to forge fake messages that the judge can open and not the owners of the secret keys, and vice-versa.

Our construction allows us to use the extraction algorithm only once per judge (or per set of encrypted mails). Our security model captures this situation. It is not going against our motivation as long as we consider that two judges having an interval key in two different court cases (for the same set of mails) do not collude. To avoid this drawback, we need to reinitialize the secret values stored by a user after the generation of an interval-key, in order to be able to produce new interval-key on the next encrypted data. We leave the construction of an APO-PKE with constant interval key generation complexity and constant interval key size allowing several interval key generations for the same judge and the same set of encrypted mails as an open problem.

Related work: Functional encryption [START_REF] Sahai | Fuzzy identity-based encryption[END_REF] is a public-key encryption primitive that allows a user to evaluate a function on the plaintext message using a key and a ciphertext. This cryptographic primitive was formalized in [START_REF] Boneh | Functional encryption: Definitions and challenges[END_REF]. It generalizes many well know cryptographic primitives such identity based encryption [START_REF] Boneh | Identity-based encryption from the Weil pairing[END_REF] or attribute based encryption [START_REF] Sahai | Fuzzy identity-based encryption[END_REF]. Moreover, some schemes that evaluate an arbitrary function have been proposed in [START_REF] Goldwasser | How to run turing machines on encrypted data[END_REF][START_REF] Goldwasser | Reusable garbled circuits and succinct functional encryption[END_REF]. A posteriori openable encryption can be seen as a functional encryption, where all ciphertexts (resp. plaintexts) that are encrypted by one user correspond to a unique large ciphertext (resp. plaintext). Then the interval-keys allow a user to find only some parts of the corresponding plaintext. Our proposal scheme is an efficient solution for this kind of functional encryption.

Deniable encryption [START_REF] Canetti | Deniable encryption[END_REF][START_REF] Klonowski | Practical deniable encryption[END_REF] is an encryption system that allows to encrypt two messages (original and hidden messages) in the same ciphertext. Using his secret key, the receiver can retrieve the original message. Using another shared secret key, the receiver can also decrypt the hidden message. It is not possible for the sender to prove that his encryption does not contain an hidden encrypted message. In our a posteriori openable encryption, the judge is only convinced that the plaintext that he decrypts is the same message that the plaintext decrypted by the secret key of the receiver. This notion differs from undeniability since the judge is convinced that a message he decrypts using interval key has actually been sent and received, but does not deal with message from another channel that the given encryption system (including different way to encrypt or decrypt a message in the same ciphertext). Some cryptographic primitives deal with time in decryption mechanism or rights delegation. Timed-Release Encryption (TRE), first proposed in [START_REF] May | Time-release crypto[END_REF], is a public key encryption where encrypted messages cannot be opened before a release-time chosen by the person who encrypted the messages. In this primitive, it is generally a time server that allows the receiver to decrypt the message in the future at a given date. Several TRE with diverse security properties have been proposed [START_REF] Blake | Scalable, server-passive, user-anonymous timed release public key encryption from bilinear pairing[END_REF][START_REF] Cathalo | Efficient and non-interactive timedrelease encryption[END_REF][START_REF] Cheon | Timed-release and key-insulated public key encryption[END_REF]. More recently, an extension of TRE, called Time-Specific Encryption (TSE), has been proposed in [START_REF] Paterson | Time-specific encryption[END_REF] and deals with time intervals. Somehow these primitive are close to our because APO-PKE allows somebody to give decryption capabilities in the future, after that encrypted messages has been sent. However, TRE and TSE cannot be used to achieve APO-PKE, because TRE ciphertext are intended to only one user and decryption capabilities cannot be delegated to another party. Moreover, in TRE, time of decryption capability must be chosen during the encryption phase, while in our primitive it can be chosen at any time (a posteriori ).

It is interesting to note that some TRE possess a pre-open mechanism [START_REF] Hwang | Timed-release encryption with pre-open capability and its application to certified e-mail system[END_REF] that allows the sender to give decryption capabilities before the pre-specified release-time. In this case, a security requirement (called binding property) ensures that the decrypted message from the pre-open mechanism is the message decrypted by the receiver after the release-time [START_REF] Dent | Revisiting the security model for timed-release encryption with pre-open capability[END_REF]. For our primitive, we define a similar property, called integrity, since we require that decrypted messages using an interval key must be equal to the messages decrypted by the legitimate receivers.

Finally, Key-Insulated Encryption (KIE) [START_REF] Dodis | Key-insulated public key cryptosystems[END_REF][START_REF] Hanaoka | Generic constructions of parallel key-insulated encryption[END_REF][START_REF] Libert | Parallel key-insulated public key encryption without random oracles[END_REF] is a public key encryption primitive where messages are encrypted from a tag corresponding to a time period and a public key. At each time period corresponds a partial secret key computed from a master key and the previous partial secret key. Moreover, the public key is never changed. The motivation of this primitive is to provide secret keys that can be stored in an untrusted device without compromising the master key. Indeed, the leakage of a secret key compromises only messages received in a specified time interval, and future encryptions remain secure. In the motivation of [START_REF] Dodis | Key-insulated public key cryptosystems[END_REF], the authors give another interesting use of this primitive based on [START_REF] Goldreich | Self-delegation with controlled propagation -or -what if you lose your laptop[END_REF]. They provide a secure delegation of decryption rights in a time period. However, this type of delegation allows them to delegate decryption rights only on predefined time period. For example, if the time period corresponds to one month then right delegation cannot be restricted to the last week of a month and the first week of the following month without revealing all messages of these two months. Moreover, delegator must give a different secret key to each time period, so the decryption keys are proportional to the number of time periods contained in the interval. Our goal is to propose decryption delegation capabilities to the sender, while KIE only focuses on receiver decryption right delegation. Thus this primitive cannot solve our problem.

Outline: In the next section, we introduce some cryptographic tools and define the notion of RCD-PKE. In Section 3, we present a generic A Posteriori Openable Public Key Encryption. Then in Section 4, we provide security models and analyze the security of our scheme before concluding in the last section. All the proofs of our security results are given in the full version of this paper [START_REF] Bultel | A posteriori openable public key encryption[END_REF].

Random Coin Decryptable Public Key Encryption

We first recall the definition of probabilistic public key encryption.

Definition 1 (Probabilistic Public Key Encryption (PKE)). A probabilistic PKE is a triplet of polynomial time algorithms (Gen, Enc, Dec) such that Gen(1 k ) returns a public/private key pair (pk, sk), Enc pk (m; σ) returns a ciphertext c from the public key pk, the message m and the random coin σ, and Dec sk (c) returns a plaintext m or a bottom symbol ⊥ from a secret key sk and a ciphertext c. Moreover the following equation holds:

Dec sk (Enc pk (m; σ)) = m. Exp IND-CPA Π,A (k): b $ ← {0, 1} (pk, sk) ← Gen(1 k ) (m 0 , m 1 , st) ← A 0 (1 k , pk) c ← Enc pk (m b ; σ) b ← A 1 (st, pk, c) return (b = b ) Fig. 1. IND-CPA experiment.
A PKE scheme Π is said indistinguishable under chosen-plaintext attack (IND-CPA) [START_REF] Goldwasser | Probabilistic encryption[END_REF] if for any polynomial time adversary A, the difference between 1 2 and the probability that A wins the IND-CPA experiment described in Fig. 1 is negligible.

We introduce the notion of Random Coin Decryptable PKE (RCD-PKE). A public key encryption scheme is said RCD-PKE, if there exists a second way to decrypt the ciphertext with the random coin used to construct the ciphertext. This primitive is a kind of PKE with double decryption mechanism (DD-PKE) which is defined in [START_REF] Galindoa | On the security of public key cryptosystems with a double decryption mechanism[END_REF]. Actually RCD-PKE is a DD-PKE where the second secret key is the random coin and is used once. Definition 2 (Random Coin Decryptable PKE (RCD-PKE)). A probabilistic PKE is Random Coin Decryptable if there exists a polynomial time algorithm CDec such that for any public key pk, any message m, and any coin σ, the following equation holds:

CDec σ (Enc pk (m; σ), pk) = m.
For instance, ElGamal encryption scheme is RCD-PKE. It is possible, from a ciphertext c = Enc pk (m; σ) = (c 0 , c 1 ) = (g σ , pk σ • m) to use the algorithm CDec σ (c, pk) that computes c 1 /pk σ to retrieve the plaintext message m. Many probabilistic encryption schemes in the literature are RCD-PKE, e.g. [START_REF] Abdalla | DHIES: an encryption scheme based on the Diffie-Hellman problem[END_REF][START_REF] Cramer | Design and analysis of practical public-key encryption schemes secure against adaptive chosen ciphertext attack[END_REF][START_REF] Fujisaki | Secure integration of asymmetric and symmetric encryption schemes[END_REF]. Algorithms CDec of these two cryptosystems PKE are given in the full version of this paper [START_REF] Bultel | A posteriori openable public key encryption[END_REF]. We also introduce the concepts of valid key pair and of verifiable key PKE. Definition 3 (Verifiable Key PKE (VK-PKE)). We say that a key pair (pk, sk) is valid for PKE = (Gen, Enc, Dec) when for any message m and any random coin σ the equation Dec sk (Enc pk (m; σ)) = m holds. We say that a probabilistic PKE is verifiable-key (VK) when there exists an algorithm Ver such that Ver(pk, sk) = 1 if and only if (pk, sk) is valid for PKE.

In many probabilistic public key cryptosystems, the public key is generated from the secret key by a deterministic algorithm. For example, the ElGamal public key is the value g x computed from the secret key x. In this case, it suffices to check that g sk = pk in order to be convinced that a key pair (pk, sk) is valid. It is easy to see that [START_REF] Abdalla | DHIES: an encryption scheme based on the Diffie-Hellman problem[END_REF][START_REF] Cramer | Design and analysis of practical public-key encryption schemes secure against adaptive chosen ciphertext attack[END_REF] are also VK-PKE.

A Posteriori Openable Public Key Encryption

An APO-PKE is a public key encryption scheme, where Alice can use receiver public keys to send them encrypted messages that can be opened thanks to the corresponding secret keys. The goal of an APO-PKE is to allow Alice to keep enough information to be able to construct a key to a posteriori open a sequence of messages that she had encrypted during an interval of time. We do not consider real time but a sequence of n successive ciphertexts {C x } 1≤x≤n that have been encrypted by Alice with possibly different public keys. Then with an APO-PKE, it is possible for Alice to extract a key for a judge that opens all ciphertexts between the message C i and the message C j where 1 ≤ i < j ≤ n. We call this key an interval-key denoted by K pko i→j where pko is the public key of the opener (here the judge). Moreover before encrypting her first message with a public key, Alice needs to initialize a secret global state denoted st. The goal of st is to keep all required information to generate an interval-key and to encrypt a new message. Naturally each time Alice encrypts a message with a public key, st is updated (but has a constant size). Finally an APO-PKE, formally described in Definition 4, contains an algorithm that opens all ciphertexts in a given interval of time thanks to the interval-key forged by Alice.

Note that all key pairs come from the same algorithm APOgen. However, for the sake of clarity, we denote by pko and sko (for opener public key and opener secret key) the keys of an interval-key recipient, e.g. a judge that can open some messages, denoted by O (for opener) in the rest of the paper. APOext st pko (C i , C j ): This algorithm generates an interval-key K pko i→j that allows the owner O of the public key pko to decrypt all messages {C x } i≤x≤j using algorithm APOpen. APOpen sko (K pko i→j , {C x } i≤x≤j , {pk x } i≤x≤j ): Inputs of this algorithm contain a ciphertext set {C x } i≤x≤j and all the associated public keys {pk x } i≤x≤j . This algorithm allows a user to decrypt all encrypted messages sent during an interval using his secret key sk and the corresponding interval-key K pko i→j .It returns a set of plaintexts {m x } i≤x≤j or ⊥ in case of error.

In Scheme 1, we give a generic construction of APO-PKE based on an IND-CPA secure RCD-PKE and three hash functions.

Scheme 1 (Generic APO-PKE (G-APO)) Let k be a security parameter, E = (Gen, Enc, Dec) be a RCD and VK PKE scheme, R be the set of possible random coins of E and F : {0, 1} * → {0, 1} k , G : {0, 1} * → R and H : {0, 1} * → {0, 1} 2k be three universal hash functions. Our generic APO-PKE is defined by the following six algorithms where ⊕ denotes the exclusive-or, |x| denotes the bit size of message x and y||z the concatenation of y with z:

APOgen(1 k ): This algorithm generates (pk, sk) with Gen and returns it.

= (K|| σ N || σ N ), C i = ( C i || C i ||D i ) and C j = ( C j || C j ||D j ), this algorithm computes σ i-1 || σ i = D i ⊕ H(K|| C i || C i ) and σ j-1 || σ j = D j ⊕ H(K|| C j || C j ). It picks r $ ← R and returns K pko i→j = Enc pko (( σ i-1 || σ j ); r). APOpen sko (K pko i→j , {( C x || C x ||D x )} i≤x≤j , {pk x } i≤x≤j ): This algorithm begins to re- covering values σ i-1 || σ j = Dec sko (K pko i→j ). -For all x in {i, i + 1, . . . , j}, it computes R = G( σ x-1 ) and opens C x as follows m x || σ * x = CDec R ( C x , pk x ). It computes the next σ x = σ * x ⊕ F( σ x-1 ). If Enc pk x (( m x || σ * x ); G( σ x-1 )) = C x then it returns ⊥. -For all x in {j, j -1, . . . , i}, it computes R = G( σ x ) and opens C x as follows m x || σ * x-1 = CDec R ( C x , pk x ). It computes the previous σ x-1 = σ * x-1 ⊕ F( σ x ). If Enc pk x (( m x || σ * x-1 ); G( σ x )) = C x then it returns ⊥. Finally, it returns { m x ⊕ m x } i≤x≤j .
The encryption algorithm APOenc separates the plaintext m in two parts using xor operation such that m = m ⊕ m. We generate two random coins σ and σ. Using the two previous coins σ N and σ N in the state st, we encrypt into two different ciphertexts C and C the following two messages m||( σ ⊕ F( σ N )) and m||( σ N ⊕ F( σ)). Finally we hide the usefull random elements with H(K|| C|| C).

Knowing the secret key it is possible to recover m and m and then to obtain the plaintext m thanks to the algorithm APOdec.

An interval-key for the owner O of a public key pko is constructed using the algorithm APOext. It is simply the encryption with pko of σ N and σ. At each encryption, the values σ i-1 and σ i are masked by a "one time pad" with the digest H(K|| C i || C i ) in D i . Then with the ciphertexts C i , C j and the secret value K we can construct an interval-key that contains these values σ i-1 and σ j .

Using an interval-key K pko i→j it is possible to open all ciphertexts encrypted during an interval of time with the algorithm APOpen: thanks to the RCD property, someone who knows values σ N and σ for one ciphertext can open each part C and C of it in order to recover σ and σ N , and m and m, hence m. We also notice that with σ i it is possible to decrypt all ciphertexts in { C x } (i+1)≤x≤N . In the other hand, with σ j it is possible to decrypt all ciphertexts in { C x } 1≤x≤j . Then it is possible to recover all messages between C i and C j . Thus, it is possible to decrypt all messages between C i and C j with the knowledge of σ i-1 and σ j .

If the interval always contains the first message, we give a more efficient algorithm. The idea is to only keep one part of the ciphertext, by consequence we do not need to split into two the message m. Hence the size of the ciphertext is smaller. Similarly if the algorithm always ends with the last encrypted message, we can also drop one half of the ciphertext and the tag value following the same idea. These simpler schemes are given in the full version of this paper [START_REF] Bultel | A posteriori openable public key encryption[END_REF].

Model and Security

We present the security properties of an APO-PKE scheme and we analyze the security of our G-APO scheme. The first security property corresponds to a chosen-plaintext attack scenario where the adversary has access to interval-keys on intervals that do not contain the challenge. We next introduce the notion of indistinguishability under chosen sequence of plaintext attack security (IND-CSPA) that corresponds to a chosen-plaintext attack scenario where the challenge is an interval of ciphertexts and the corresponding interval-key generated for a given judge public key. The last property is integrity, and captures the integrity of messages decrypted by APOpen algorithm. All security proofs are detailed in [START_REF] Bultel | A posteriori openable public key encryption[END_REF].

IND-CPA security

It concerns the resistance of an APO-PKE against a collusion of adversaries that have access to interval-keys in a chosen-plaintext attack scenario. For example, if we consider a judge who receives an interval-key to open a sequence of ciphertexts and who colludes with ciphertext recipients; then it ensures that they cannot deduce any information about messages that are not in the sequence. Indeed, he cannot request an interval-key for an interval containing the challenge. We define the OT-IND-CPA security when only one interval-key can be asked during the experiment. Our scheme is proved secure in this model.

Definition 5 (OT-IND-CPA experiment).

Let Π be an APO-PKE, let k be a security parameter, and let A = (A 0 , A 1 ) be a pair of polynomial time algorithms. We define the one-time indistinguishability under interval opener chosenplaintext attack (OT-IND-CPA) experiment as follows:

Exp OT-IND-CPA Π,A (k): b $ ← {0, 1} (pk * , sk * ) ← APOgen(1 k ) st * ← APOini(1 k ) (m0, m1, state) ← A0(1 k , pk * ) C * ← APOenc st * pk * (m b ) b ← A1(state, C * ) If b = b return 1, else 0
The adversaries A 0 and A 1 have access to the following oracles: We also define the IND-CPA experiment as the same as the OT-IND-CPA experiment except that the adversary can ask the oracle APOext several times.

Definition 6 (OT-IND-CPA advantage). The advantage of the adversary A

against OT-IND-CPA is defined by:

Adv OT-IND-CPA Π,A (k) = |Pr[Exp OT-IND-CPA Π,A (k) = 1] - 1 2 |
We define the advantage on OT-IND-CPA experiment by:

Adv OT-IND-CPA Π (k) = max{Adv OT-IND-CPA Π,A (k)
(k) (resp. Adv IND-CPA Π (k)) is negligible.
Our construction is not IND-CPA since if a judge has two interval-keys for two different intervals of time given by the same user and computed with the same secret value then he can open all messages between the two extreme dates. Similarly, we then prove that no adversary can win using the oracle in an interval of next ciphertexts of the challenge. Finally, using this two results, we show that our scheme is OT-IND-CPA in any case.

IND-CSPA security

A sequence of ciphertexts coupled with an interval-key can be seen as an unique ciphertext that encrypts a sequence of plaintexts because the open algorithm allows a judge to decrypt all the messages of the sequence with the knowledge of any secret key. Thus, we define a security model where the adversary must distinguish the sequence of plaintexts used to produce a challenge sequence of ciphertexts associated to an interval-key. The IND-CSPA security captures this security property. In this model, the adversary is a collusion of users that must distinguish the sequence of plaintexts used to produce a sequence of ciphertexts given the corresponding interval-key generated for the judge.

Definition 7 (IND-CSPA φ experiment). Let Π be an APO-PKE, let k be a security parameter, and let A = (A 0 , A 1 ) be a pair of polynomial time algorithms. We define the indistinguishability under chosen sequence of plaintext attack (IND-CSPA φ ) experiment as follows, where n denotes the number of calls to the encryption oracle during the first phase and φ denotes the number of calls to the generation oracle:

Exp IND-CSPA φ Π,A (k): b, d $ ← {0, 1} (pko * , sko * ) ← APOgen(1 k ) st * ← APOini(1 k ) (q, {m 0 x } n<x≤n+q , {m 1 x } n<x≤n+q , {pk x } n<x≤n+q , state) ← A0(1 k , pko * ) ∀ x ∈ {n + 1, n + 2, ..., n + q} : if pk x comes from O CSPA gen then C * x = APOenc st * pk x (m b x ) else, C * x = APOenc st * pk x (m d x ) K pko * (n+1)→(n+q) ← APOext st * pko * (Cn+1, Cn+q) b ← A1(state, {C * x } n<x≤n+q , K pko * (n+1)→(n+q) ) If b = b return 1, else 0
The adversaries A 0 and A 1 have access to the following oracles:

O
= APOext st * pko * (C i , C j ).
In the first phase The challenger generates (pko * , sko * ) from APOgen(1 k ) and a state st * from APOini(1 k ). He sends the public key pko * to the adversary. The challenger initializes a counter n that counts number of calls to the oracle O CSPA enc during this phase. Finally, the adversary sends to the challenger values (q, {m 0

x } n<x≤(n+q) , {m 1 x } n<x≤(n+q) , {pk x } n<x≤n+q , state). In second phase, the challenger computes a sequence of ciphertexts from the adversary's output. He encrypts messages of one of the two sequences. The sequence of produced ciphertexts forms the challenge. More formally, the challenger picks two random bits b and d. Then, ∀ x ∈ {n + 1, n + 2, ..., n + q}, if pk x corresponds to an honest user (i.e. Proof idea: In [START_REF] Bellare | Public-key encryption in a multi-user setting: Security proofs and improvements[END_REF] authors prove that any IND-CPA PKE is still secure in multiuser setting, i.e. where the adversary can ask several challenges for several different public keys. Without interval-key oracle, the IND-CSPA security of our scheme can be reduced to the IND-CPA of the PKE in multi-user setting since the challenge corresponds to ciphertexts of several messages from several public keys. Moreover, since the interval-keys from the oracle are encrypted, then the adversary must break the IND-CPA security of PKE to use it. It is possible to prove that no adversary can efficiently break the IND-CSPA of our scheme using these two arguments.

Integrity

The last security property for APO-PKE is the integrity. This property is similar to binding property of TRE defined in [START_REF] Dent | Revisiting the security model for timed-release encryption with pre-open capability[END_REF]. The judge must be sure that the messages he decrypts with APOpen algorithm are the sent messages.

Definition 9 (Integrity experiment). Let Π a APO-PKE, let k be a security parameter, and let A a polynomial time algorithm. We define the integrity experiment as follows: The challenger generates (pko * , sko * ) from APOgen(1 k ) and sends the public key pko * to the adversary. The adversary A sends to the challenger an integer N , an ordered set of N ciphertexts {C x } 1≤x≤N and an ordered set of N public keys {pk x } 1≤x≤N . The adversary then sends two integers i and j and the corresponding interval-key K pko * i→j . He finally sends the integer l and the secret key sk l corresponding to pk l . If (pk l , sk l ) is not a valid key pair then the challenger aborts and returns 0. The challenger then computes {m x } i≤x≤j ← APOpen sko * (K pko * i→j , {C x } i≤x≤j , {pk x } i≤x≤j ). If m l = APOdec sk l (C l ) then the challenger returns 1, else he returns 0. Definition 10. The advantage of A against integrity is defined by:

Exp Integrity Π,A (k): (pko * , sko * ) ← APOgen(1 k ) (N, {Cx} 1≤x≤N , {pk x } 1≤x≤N , l, sk l , i, j, K pko * i→j ) ← A(1 k , pk * ) if (pk l , sk l ) is
Adv Integrity Π,A (k) = Pr[Exp Integrity Π,A (k) = 1]
The advantage against integrity by:

Adv Integrity Π (k) = max{Adv Integrity Π,A (k)
} for all A ∈ poly(k). We say that a APO-PKE scheme Π satisfies the integrity property Adv Integrity Π (k) is negligible. Theorem 3. Let E be a RCD and VK PKE that is IND-CPA secure, then G-APO using this PKE satisfies the integrity property.

Proof idea: Since the judge has all the random coins and all the public keys used to encrypt all the opened messages, he can use them to re-encrypt these messages. Thus, if the ciphertexts that he opens correspond to the ciphertexts that he encrypts by himself, then he can conclude that the opened messages are the same as the messages decrypted by the recipient secret keys.

Conclusion

We introduce the notion of RCD-PKE. Based on this notion, we propose an a posteriori openable PKE (APO-PKE) scheme. Our scheme allows a user to prove his innocence by showing to a judge the content of his encrypted communication with several PKE during a period of time. Our construction preserves the privacy of the others communications, meaning that the judge cannot learn any information concerning the other encrypted messages. Moreover the receivers of the encrypted messages cannot collude in order to learn more information that is contained in the received messages. Our construction is proven secure in the Random Oracle Model and is generic because it only requires RCD-PKE and hash functions.

In the future, we aim at proving that is not possible to have a secure construction that supports several generations of interval key with constant size interval-key and stored data (state). Another future work is to design a security model for chosen-ciphertext security of APO-PKE and to provide a generic construction that achieves this higher security. Finally, it may be interesting to design such a scheme in the standard model.

Definition 4 (

 4 A Posteriori Openable Public Key Encryption (APO-PKE)). An APO-PKE is defined by: APOgen(1 k ): This algorithm generates a key pair for a user. It returns a public/private key pair (pk, sk). APOini(1 k ): This algorithm initializes a global state st and returns it. APOenc st pk (m): This algorithm encrypts a plain-text m using a public key pk and a global state st. It returns a ciphertext C and st updated. APOdec sk (C): This algorithm decrypts a ciphertext C using the secret key sk. It returns a plaintext m or ⊥ in case of error.

  APOini(1 k ): This algorithm picks three random values σ $ ← {0, 1} k , σ $ ← {0, 1} k and K $ ← {0, 1} k of the same size, and returns the state st = (K|| σ|| σ). APOenc st pk (m): We note that st = (K|| σ N || σ N ). This algorithm picks a random m such that | m| = |m| and computes m = m ⊕ m. Let σ $ ← {0, 1} k and σ $ ← {0, 1} k be two random values of size | σ N |. This algorithm computes C = Enc pk ( m||( σ ⊕ F( σ N )); G( σ N )) and C = Enc pk ( m||( σ N ⊕ F( σ)); G( σ)). It also computes D = ( σ N || σ) ⊕ H(K|| C|| C). Finally it updates the state st with (K|| σ|| σ) and returns C = ( C|| C||D). APOdec sk (C): The decryption algorithm computes the decryption of m|| σ = Dec sk ( C) and the decryption of m|| σ = Dec sk ( C), where C = ( C|| C||D). It returns m = m ⊕ m. APOext st pko (C i , C j ): Using the state st

O 1 .

 1 CPA enc : On the first call to this oracle, it initializes the following values l = 1 and n = This oracle takes as input a public key pk and a message m. It returns C l = APOenc st * pk (m). It increments the counter l. Only in the first phase, it increments the value n that counts the number of calls to the encryption oracle before the generation of the challenge. O CPA ext : The adversary can ask this oracle only one time during the experiment. This oracle takes a public key pko and two ciphertexts C a and C b . In the second phase, if there exists C i = C a and C j = C b such that i ≤ n ≤ j then the oracle rejects the query. Else, if C a = C n or C b = C n , it rejects the query. Else it returns APOext st * pko (C a , C b ).

}

  for all A ∈ poly(k). The advantages on IND-CPA experiment are similar to those of OT-IND-CPA. We say that a APO-PKE scheme Π is OT-IND-CPA (resp. IND-CPA) secure when Adv OT-IND-CPA Π

Theorem 1 .

 1 Let E be an IND-CPA secure RCD-PKE, then G-APO based on E is OT-IND-CPA secure in the random oracle model. Proof idea: To prove the OT-IND-CPA security, we show first that no polynomial adversary wins the experiment with non negligible probability using the oracle O CPA ext in an interval of previous ciphertexts of the challenge. The interval-key allows to open the part C * of the challenge C * , but since the PKE is IND-CPA then the interval-key gives no information about the part of the challenge encrypted in the part C * .

  pk x comes from oracle O CSPA gen ) then he computes C * x = APOenc st * pk x (m b x ) else if pk x corresponds to a dishonest user (i.e. pk x comes from the adversary), he computes C * x = APOenc st * pk x (m d x ). Finally, he computes K pko * (n+1)→(n+q) = APOext st * pko * (C n+1 , C n+q ) and he sends (state, {C * x } n<x≤(n+q) , K pko * (n+1)→(n+q) ) to the adversary A 1 . During the guess phase, the adversary returns the bit b . If b = b then A wins.

  not a valid key pair then return 0{mx} i≤x≤j ← APOpen sko * (K pko * i→j , {Cx} i≤x≤j , {pk x } i≤x≤j ) if m l = APOdec sk l (C l ) then return 1, else 0.

  CSPA gen : At the first call, the oracle creates a keys' list K that contains (pko * , sko * ).At each call, it generates values (pk, sk) from APOgen(1 k ) and adds it to K.Then it returns pk. This oracle can be called only φ times. O CSPA enc : This oracle takes as inputs a public key pk and a message m. Only in the first phase, it increments the value n that counts the number of calls to the encryption oracle before the generation of the challenge.In the two phases, it returns APOenc st * pk (m). O CSPA ext : This oracle takes as input two ciphertexts C i and C j . It returns the interval-key K

	pko *
	i→j

This research was conducted with the support of the "Digital Trust" Chair from the University of Auvergne Foundation. 3 https://www.gnupg.org

Definition 8 (IND-CSPA advantage). We define the advantage of A against IND-CSPA by:

We define by: