Julie Thomas

Marielle Brunette
email: marielle.brunette@inrae.fr

Antoine Leblois

« Adapting forest management practices to climate change: Lessons from a survey of French private forest owners » Auteurs

Keywords: adaptation, forest, survey, French private forest owners. JEL codes: Q23 (Forestry); Q54 (Climate

Climate change seriously impacts forest ecosystems. In order to maintain forest cover, adaptation strategies should be implemented. In France, adaptation decisions are mainly in the hands of private forest owners. However, little is known about the way they perceive climate change or about their decisions related to adaptation. The aim of this article is precisely to obtain such information through a survey conducted among more than 900 French private forest owners. We identified determinants to the adoption of adaptation (gender, area, profession, having a management document, perception of climate change impact). More importantly, we show that the decision of adaptation should not be thought of in general but strategy-by-strategy because we identified strategy-dependent drivers. The article concludes with a discussion about the public policy implications of the results.

Introduction

Climate change will have serious impacts on forest ecosystems, altering the provision of goods and services worldwide. The increase in temperature and reduction in the precipitation regime will affect growth and productivity and will result in decline and mortality [START_REF] Bergh | Modelling the short-term effects of climate change on the productivity of selected tree species in Nordic countries[END_REF][START_REF] Jump | Rapid climate change-related growth decline at the southern range edge of Fagus sylvatica[END_REF]). In the same way, the increase in frequency and intensity of natural events [START_REF] Flannigan | Climate change and forest fires[END_REF][START_REF] Fuhrer | Climate risks and their impact on agriculture and forests in Switzerland[END_REF] suggests large losses in the coming years. Forest disturbance damage in Europe has increased throughout the 20th century [START_REF] Schelhaas | Natural disturbances in the European forests in the 19th and 20th centuries[END_REF] and has continued to rise in the first decade of the 21st century [START_REF] Seidl | Increasing forest disturbances in Europe and their impact on carbon storage[END_REF]) mainly due to climate change [START_REF] Seidl | Unraveling the drivers of intensifying forest disturbance regimes in Europe[END_REF]. Damage from wind, bark beetles and forest fires is likely to increase further in coming decades, and the rate of increase is estimated at +0.91 × 10 6 m 3 of timber per year until 2030 [START_REF] Seidl | Increasing forest disturbances in Europe and their impact on carbon storage[END_REF]. In France, where the forest cover encompasses 31% of the territory with a total of 16.8 million hectares [START_REF] Ign | La surface forestière[END_REF], and where the forest sector directly employs 378,000 people, for an added value of €25 billion and representing 1.1% of the French GDP (VEM 2017), these impacts may be detrimental.

The speed of environmental changes is such that implementation of adaptation strategies by foresters is required to maintain a forest cover [START_REF] Spittlehouse | Adaptation to climate change in forest management[END_REF]. In this context, a wide range of adaptation strategies are recommended: reduction of rotation length, reduction of density at the time of plantation, adoption of species better adapted to the future climate, species mix, uneven-aged stands, etc. [START_REF] Spittlehouse | Adaptation to climate change in forest management[END_REF]. However, to implement adaptation, foresters must be aware that climate change is actually occurring, they must perceive the threat that climate change represents for their forests, and they must be able to make decisions, often irreversible, to allow forest adaptation.

In the framework of international negotiations about climate change, forests have a main role to play in terms of mitigation. Public authorities are thus under pressure to implement policies and projects that facilitate adaptation [START_REF] Van Aalst | The impacts of climate change on the risk of natural disasters[END_REF][START_REF] Hochrainer-Stigler | Funding public adaptation to climate-related disasters estimates for a global fund[END_REF]). However, little information exists about the French foresters' adaptation decisions, whereas information is required to implement relevant public policy.

In this context, many research questions have emerged: Are French foresters aware of climate change? How do they perceive the impact of climate change? Have they already modified their management practices? If yes, which adaptation strategies have they adopted and why? If not, why choose to not adapt?, etc. More generally, we address the question of the determinants of the adaptation decisions of French foresters in order to identify levers to encourage them to adapt.

Forest adaptation towards climate change has been widely addressed in the literature. Several economic methodologies have been put into practice. For example, some articles have used costbenefit analysis to study the economic relevance of some adaptation strategies: adoption of betteradapted tree species (Hanewinkel et al. 2013;[START_REF] Brunette | Economics of species change subject to risk of climate change and increasing information: a (quasi-) option value analysis[END_REF], species mixture (Yousefpour and Hanewinkel 2014), reduction of rotation length [START_REF] Bréda | Are 40 years better than 55? An analysis of the reduction of forest rotation to face drought event in a Douglas fir stand[END_REF], near-natural forestry [START_REF] Schou | An economic evaluation of strategies for transforming even-aged into near-natural forestry in a conifer-dominated forest in Denmark[END_REF]), among others. The main conclusion is that, in general, implementation of an adaptation strategy appears relevant from an economic point of view in comparison to business-asusual. Some papers also compared different adaptation strategies [START_REF] Jönsson | Forest management facing climate change -an ecosystem model analysis of adaptation strategies[END_REF][START_REF] Brèteau-Amores | An economic comparison of adaptation strategies towards a drought-induced risk of forest decline[END_REF], and found that a combination of strategies may be the best option in economic terms. Another widely used methodology is surveys to better understand individuals' behaviours. The first surveys were about perception of climate change with no direct link to the forester's adaptation decision, such as, for example, in [START_REF] Blennow | Climate Change: Believing and Seeing Implies Adapting[END_REF]Eriksson (2014). Other surveys directly questioned the foresters about potential adaptation options [START_REF] Ogden | Application of structured decision making to an assessment of climate change vulnerabilities and adaptation options for sustainable forest management[END_REF]Lidskog and Sjödin 2014). The last category of articles attempts to link both the perceived climate change and adaptation decisions. Using a "paper and pencil" survey, [START_REF] Yousefpour | Forestry professionals' perceptions of climate change, impacts and adaptation strategies for forests in South-West Germany[END_REF] questioned 262 German forestry employees working in either public or private forests or for state authorities about the perceived impact of climate change, adaptive forest management and the potential of forestry to mitigate climate change. They showed that most of the respondents perceive climate change as real, human-induced, and significant. They also reported that adaptation strategies like using better-adapted tree species and origins were mainly perceived as helpful. Through an online survey of 391 forest owners and managers from Belgium, [START_REF] Sousa-Silva | Adaptation of forest management to climate change as perceived by forest owners and managers in Belgium[END_REF] studied how they perceive the role of their forest management in the context of climate change and the impediments that limit their ability to prepare and respond to these changes. They show that most of the respondents are aware of the changing climate, although only one third of them said that they had changed their practices to address climate change. The main brake to this implementation was the lack of information. Using data from online surveys of 1131 forest owners and managers from seven European countries (203 respondents from France), [START_REF] Sousa-Silva | Adapting forest management to climate change in Europe: Linking perceptions to adaptive responses[END_REF] assessed how they perceive their role in adapting forest management to climate change. The surveys deal, among other things, with the impacts of climate change and the way foresters consider climate change in their management decisions. Their main conclusion is that results are country-dependent with variability in terms of perceptions and actions. They identified some relevant actions such as species mix and assistance in tree regeneration. They also found that the French foresters (along with the Slovakian ones) are among the most numerous to have undertaken adaptation strategies. [START_REF] Brunette | Risk aversion hinders forestry professionals to adapt to climate change[END_REF] focused on the role of risk aversion in the forest adaptation process of 88 forestry professionals from France and Germany. They addressed both the propensity and the intensity of adaptation, and identified risk aversion as a new obstacle to adaptation. They confirmed that species mix and assistance in tree regeneration are prioritised by foresters.

On the basis of this short literature review, several comments can be made and make it possible to justify our article. First, the nature of ownership is very important when dealing with adaptation to climate change because it determines the actors that make decisions and act in the field. While most of the literature evoked above deals with samples of forest owners, forest managers and/or forestry professionals from the private and/or public sector, the relevant decision unit in France is the private forest owner. Indeed, France is an exception in Europe because 75% of the forest area is privately owned by 3.3 million private forest owners. Better knowledge of this population in terms of perceptions and actions towards climate change is a prerequisite towards an efficient adaptation plan. Second, French foresters are rarely considered, and when they are, they are rarely private forest owners and the number of respondents is not very high -203 in [START_REF] Sousa-Silva | Adapting forest management to climate change in Europe: Linking perceptions to adaptive responses[END_REF] and 49 in [START_REF] Brunette | Risk aversion hinders forestry professionals to adapt to climate change[END_REF] -and the individuals are randomly selected (no representative sample), probably due to the way data are collected (paper and pencil, online). Third, the literature converges towards the idea that some adaptation strategies seem to be prioritised or will be prioritised in the future by the foresters, like the increase in the species mix and assistance in tree regeneration [START_REF] Sousa-Silva | Adapting forest management to climate change in Europe: Linking perceptions to adaptive responses[END_REF][START_REF] Brunette | Risk aversion hinders forestry professionals to adapt to climate change[END_REF], or the use of better-adapted tree species and origins [START_REF] Yousefpour | Forestry professionals' perceptions of climate change, impacts and adaptation strategies for forests in South-West Germany[END_REF]. However, to our knowledge, no article has yet to explain what the determinants are that encourage foresters to adopt one of these strategies rather than another.

In this context, we propose to analyse the French private forest owners' revealed behaviours when faced with climate change, and their choices in terms of adaptation. For that purpose, we ran a phone survey with 960 respondents, selected by plot size and region using a stratified sampling method, in eight regions and four forest area classes. Descriptive statistics make it possible to characterise French private forest owners, their property, the way they perceive climate change and their adaptive capacity. We used probit regression to identify the determinants of the adaptation choice. In addition, the high number of respondents allows us to run a probit regression per adaptation strategy to identify strategydependent determinants. We confirm some classical results from the literature, and we also provide new insights in order to improve knowledge about French private forest owners' adaptation decisions. In particular, we show that variables like gender, area, profession, having a management document and the perception of climate change impact are significant determinants of the adaptation decision. More importantly, we show that the decision of adaptation should not be thought of in general but adaptation-by-adaptation because we identified strategy-dependent drivers. We discuss the results in light of potential public policy implications.

The rest of the paper is as follows. Section 2 presents the materials and methods used. Section 3 describes the results, and Section 4 is devoted to a discussion about them. Section 5 concludes the article.

Materials and Method

Questionnaire design

The qualitative survey was conducted in 2018 on 944 private forest owners from metropolitan France by the Research Centre for the Study and Observation of Living Conditions (CREDOC). It consisted of a phone survey with 37 questions that took approximately 10 minutes to answer.

The questionnaire was composed of different parts, as indicated in Figure 1. The first part of the questionnaire is dedicated to the characteristics of the forest owner and the forest. The second part deals with variables related to climate change (perception, impact, cause), and the last part with changes in the practices (already implemented or not, reasons, motivations, type of actions).

Sampling

The sample was drawn up from a double stratification, by region and area class.

We randomly selected the same numbers of potential respondents for each region. We thus had eight regions (vs. 13 in the official sub-national divisions. This was due to the groups of regions made on the basis of representativeness of forest management by the French National Centre for Private Forest Owners) represented by approximately equal samples in each one: (1) Auvergne-Rhône Alpes (119 respondents), (2) Corse-Provence-Alpes-Côte d'Azur-Occitanie (114), (3) Bourgogne-Franche Comté (119), (4) Grand-Est (119), (5) Centre-Val de Loire-Ile de France ( 112), (6) Nouvelle Aquitaine ( 117), (7) Bretagne-Pays de Loire ( 123), ( 8) Hauts de France-Normandie (121).

We considered four forest area classes: from 4 to 10 ha, from 10 to 25 ha, from 25 to 100 ha, and more than 100 ha. The distribution was as follows: 314 owners in [4-10 ha], 161 in [10-25 ha], 399 in [25-100 ha] and 70 in >100 ha].

Econometric strategy

In the first step, we ran a probit regression on a binary variable, taking the value of 1 for forest owners who had already begun adaptation, and 0 otherwise (no adaptation). We then created a variable Change_practices that encompassed all the forest owners who had adopted adaptation strategies in the past, both in the past five years and before. This regression allowed us to identify the determinants of the private forest owner's decision to adapt.

In the second step, we ran a probit regression per adaptation strategy, among the five included in the survey. This regression aims to highlight potential strategy-dependent drivers that can only explain some strategies and not the general decision of adaptation.

Three models were run for each regression: a regression with a clustering at the department level, a regression with a clustering at the department level and regional fixed effects, and a regression considering a clustering at the inter-regional level and regional fixed effects. Standard errors are more robust when clusters are large, and coefficients more precise with a lower level of fixed effects, which makes the third regression the most robust.

Results

Descriptive statistics

Table 1 presents the descriptive statistics related to the first part of the questionnaire, the characteristics of the forest owner and of the forest. Table 2 presents the variables of the second part of the questionnaire about climate change. Finally, part 3 of the questionnaire is presented in Table 3 with the decisions in terms of adaptation.

Our sample is mainly composed of middle-aged men (45 to 65 years old). They show very heterogeneous education levels, with well-represented extremes: a large proportion of the sample has an education level lower than A level and the second largest share reached a master's degree. The two most highly represented socio-professional categories (SPC) are farmers and executives.

Regarding the characteristics of the forest, we can observe that the average forest area owned in our sample is about 40 hectares, with a large variability: minimal area of 4 hectares and maximal of 2300 hectares. Most of the forest owners have forests of between 4 and 100 hectares; very few (less than 1%) own more than 100 ha. Private forest owners mainly own their forests for biodiversity conservation (Obj_Biodiversity) and leisure-related reasons (Obj_Leisure), although the answer to such a question could be relatively sensitive. Among the seven possible main reasons for owning forests, owners selected 4.5 of them on average, confirming the multi-functional characteristics of French forests and the non-specialisation of French forestry. Approximately half of the people in the sample own at least one formal document for forest management and public regulation (Manag_document). The three documents considered are: "Plan simple de gestion", "Règlement type de gestion", and "Codes des bonnes pratiques". When owners hold more than 25 hectares of forest, they have to provide a "Plan simple de gestion". It is mandatory by law and well enforced.

Finally, for 44% of the private forest owners, forest brings revenue over the last 12 months (Revenue_12months) and mainly from logging (51.8%).

The number of respondents is almost identical in each of the eight regions considered, approximately 12% of the sample in each region. Approximately 73% of the private forest owners are aware of climate change (Perception) and most of them think that it is human-induced (Anthropic). Most of the respondents are persuaded that climate change will have an impact (either small or large), and they think that the impacts are already observable today (Timing). Generally, the respondents are not very worried about climate change impacts for their own forest property. We also questioned them about how climate change reveals itself in their forests and most of them said that climate change increases the frequency and intensity of drought as well as storm events.

Table 3 presents the results in terms of adaptation choices. We can see that 16.1% have already changed their practices (Change_practices). Among those who already adapt (Past), they mainly changed the way they thin (Thinning) and move towards irregular stands (Irregular) as adaptation strategies. The triggering of the changes is specialised information in the forestry sector (Specialised info). The motivation to adapt is mostly the desire to reduce the damage due to climate change (Damage reduction). To better support them in their changes in practices, forest owners indicated that they were interested in specialised training (Training) on climate change and its regulations.

The forest owners who do not plan to adapt evoked the following reasons: they think they can still wait (Can wait), current regulations limit their means of action (Admin rules), lack of money (Money) and other priorities regarding forest management (Other priorities). When looking at effective (Past) management practices, heterogeneities by area owned and region are relatively limited, as presented in Tables 4 and5. However, we will see in the next section that when controlling by individual characteristics, adaptation is much lower in regions with the two largest cities (Paris and Lyon).

Statistical analysis

We first present the determinants of the adaptation decision and, second, the determinants associated with each of the five adaptation strategies.

Adaptation vs. non-adaptation: the determinants

Table 6 presents the results of the three regressions conducted. The variable regressed is binary: Change_practices. This variable encompasses all the private forest owners who have already adopted adaptation in the past 5 years and for more than 5 years (Past). As a consequence, these regressions allow us to compare the determinants of those who have already adopted adaptation (Past) and the others (Plan, No plan, Don't know).

Model (1) presents regression with a clustering at the department level and Model (2) adds regional fixed effects to the departmental clustering. Finally, Model (3) considers a clustering at the regional level and regional fixed effects. These precisions appear at the end of the table.

We controlled for individual, property and location characteristics. We tested standard individual controls such as age, education level and socio-economic status (socio-professional categories) of the owners, as well as administrative variables (documents provided related to forest management). In addition, we looked at the relationship between reasons for owning woods and the climate changerelated beliefs of owners and their propensity to adapt.

The results are almost the same regardless of the model. Since education level and owner's age were not found to be significant drivers in any specifications, they were dropped from the result tables. Some characteristics of the forester and the forest are significant. Being a woman has a significant and negative effect on the adaptation decision. All of the SPC also have a significant and positive effect compared to the category Never worked. Regarding the forest, the area has a significant and positive impact. The fact of having received revenue from logging in the last 12 months always has a negative impact but is significant only for Models (1) and ( 2), while revenue from hunting is always negative and has a significant impact with respect to Other objectives. Some objectives indicated by the forest owners for their forests appeared to always be positive and highly significant: Biodiversity, Heritage, Leisure and Timber. Being able to provide a management document (Manag_document) has a significant and positive impact on the decision. The location of the forest somewhere other than in NOUVELLE-AQUITAINE generally has a significant and negative impact on the adaptation decision.

One exception is BOURGOGNE-FRANCHE-COMTE where the impact, although negative, is not significant. Impact has been coded as follows: Impact = 1 for "Large impact" and "Small impact"; Impact = 0 for "No impact" and "Don't know". Concerning the variables related to climate change, we observed that replying "Yes" to the question "Do you think the climate is changing?" (Perception_Yes) has a significant and positive impact on the adaptation decision. We can observe that respondents who think that climate change will have an impact (Impact) have a higher chance to adapt their management. Regarding the way climate change manifests itself among the respondents indicates less clear results: More_drought is significant only for Model (1), while Less_frost and More_winter_rain are significant for Model (3). Finally, people who consider that climate change has an anthropic origin (Anthropic) have a lower chance to adapt than the others, and it is significant for Models (2) and (3).

Respondents who had not changed their practices and did not wish to do so in the next five years (N = 429) were asked about the reasons for this refusal. Theses reasons are presented in Table 7. Anthropic has been coded as follows: Anthropic = 1 for "Yes" and "Somewhat yes"; Anthropic = 0 for "Somewhat not", "Not at all" and "Don't know".

The answer "Prefer to wait" was the most frequently given. The notion of information is also very important -it is cited by many respondents as either absent or contradictory. For those respondents who do not plan to change their practices, would certain aids or accompaniment encourage them to do so? Approximately 50% of the owners who do not wish to change their practices in the next 5 years are not interested (and/or do not know) in the proposals we have made to them. This may mean that our proposals were not varied enough or that these owners do not identify with the policies promoted by the forest and wood industry.

Drivers of the adaptation strategies

We first present bilateral correlations between the five adaptation strategies in Table 8. We observe that the correlations between strategies are low except in two cases that present negative correlation coefficients: between Late harvest and Early harvest, and between Regular and Irregular. This result seems obvious since the two strategies are the opposite of each other each time and, consequently, it is impossible to apply them at the same time on the same stand. Table 9 presents the regressions per adaptation strategy with regional fixed effects and clustering at the regional level (corresponding to Model (3) in Table 6).

Several observations can be made on the basis of Table 9. First, a quick look at the table shows that none of the variables has a significant impact on the five strategies. Second, we identify several relevant drivers for Early harvest and Late harvest, while it is more difficult to identify some for Thinning, Regular and Irregular. A third interesting (and reassuring) result is that we have opposite significant impacts of variables for Early harvest and Late harvest, and for Irregular and Regular.

They are different adaptation strategies that are opposed in terms of management and, consequently, it seems obvious that the impact should be opposite as well. For example, thinking that the impact of climate change will be small encourages people to adopt Late harvest and discourages them from adopting Early harvest. In the same way, thinking that climate change is not human-induced has a significant and positive effect on Irregular and a significant and negative one on Regular.

Table 9. Drivers by strategy, inter-regional clusters and regional fixed effects. Table 9 shows in greater detail that having collected revenue from the forest over the last 12 months significantly and negatively impacts the Thinning strategy.

The impact of the SPC is less clear. The SPC has no significant impact on Irregular and Regular and sometimes has significant impacts on the three other strategies. For example, being a Farmer has a significant and negative impact on Late harvest, whereas being an Employee has a significant and negative effect on Thinning, etc.

Having a forest management document acts like a high incentive to adopt Early harvest and Regular as adaptation strategies.

Having collected revenue in the last 12 months from logging and hunting (compared to other sources) has a significant effect on Late harvest. This effect is positive when revenue comes from logging and negative when it comes from hunting.

Owning a forest mainly for biodiversity conservation (Obj_Biodiversity) and leisure-related reasons (Obj_Leisure) has a significant and positive impact on Early Harvest.

Respondents who consider that the impact of climate change will be real (either Large or Small) are discouraged to adopt Early harvest, while those who think that climate change will have no impact are encouraged to postpone the harvest (Late harvest).

Being sure that the origin of climate change is anthropic has a significant and negative effect on Thinning, whereas it has a significant and positive one on Late Harvest.

Discussion

In a context where countries are engaged in international negotiations to limit the impact of climate change, forests have a main role to play and it may be in the interest of governments to encourage forest owners to adapt (at least to maintain or, at best, to increase forest cover and, consequently, carbon stocks). Our article provides insights into the way government may encourage owners to adapt as well as into potential vectors that may be used for public support.

The intuition that the determinants of the adaptation decision are strategy-dependent turns out to be true since none of the variables has the same significant impact on the five adaptation strategies considered. This means that talking about adaptation in general may make no sense and that the incentives and design of public policies should probably be conducted at the scale of the adaptation strategy itself. One can thus imagine encouraging strategies that favour both adaptation and mitigation. This complementarity is not always possible and trade-offs may be necessary.

In line with that observation, we identify a large number of significant drivers for the adaptation strategies based on harvest management (Early harvest or Late harvest). Advancing or delaying the final harvest has been a classical risk management strategy in forestry for a long time now and it is easy to implement throughout the rotation process. Moreover, this strategy offers flexibility compared to the other ones like Irregular or Regular. This result is in line with [START_REF] Brunette | Risk aversion hinders forestry professionals to adapt to climate change[END_REF] who observed that forestry professionals are afraid of changing routines and that current forest management practices are characterised by inertia.

In order to eliminate this inertia, the improvement and clarification of the information available to owners concerning climate change and its impact on forest management is an issue. Moreover, knowing that the climate is changing is not sufficient to initiate an adaptation process. Indeed, private forest owners have to be convinced that the impacts of climate change will be real, either small or large, to make the decision to adapt. This result confirms anecdotal evidence based on descriptive statistics that show that private forest owners are in need of specialised information in the forestry sector as well as training on climate change and its regulations. This result is also in line with [START_REF] Yousefpour | Forestry professionals' perceptions of climate change, impacts and adaptation strategies for forests in South-West Germany[END_REF] who show that "forest decision-makers must be aware of the nature and implications of climate change in order to develop management strategies that may help to reduce adverse effects and sustain productive forests".

An interesting vector that may be used for public policy is the management documents. Indeed, our results reveal that having a forest management document increases the forest owner's propensity to adapt to climate change. Although we cannot discuss the channels behind those relationships as they are beyond the scope of this paper, it seems that owners who were able to provide a document to certify their forest management (half of the people in the sample were able to provide either a simple or more detailed forest management plan or at least a list of good practices) are more inclined to adapt their management practices.

Finally, when looking at the propensity of specific owners to adapt to climate change per region, we observed a higher propensity in NOUVELLE-AQUITAINE (where pines are grown intensively for paper pulp production and related products) and in BOURGOGNE-FRANCHE-COMTE. Alternatively, CENTRE-VAL-DE-LOIRE-Ile de FRANCE (the region encompassing Paris, the capitol) and AUVERGNE-RHONE-ALPES (the region with the second biggest city in France: Lyon) seem to be the two regions with the lowest propensity to adapt. This regional heterogeneity shows that our results should be interpreted with caution (also, because we do not have owner fixed effects that would make it possible to more robustly control for individual and especially unobservable, specific characteristics). This is also in line with Spathef et al. (2014) who said that it is "of utmost importance to implement regionally-based adaptation measures that are accepted by the stakeholders involved".

Conclusion

This paper focuses on the determinants of the French forest owner's adaptation decisions. We show that the characteristics of the forest (area, management document, location, objective) and of the forest owners (gender, SPC, source of revenue), as well as the variables linked to climate change (perception, impact, origin), may explain the decision to adapt or not. From a more original perspective, we look at the determinants according to adaptation strategy. We found that the determinants are strategydependent, thus allowing us to identify levers to encourage forest owners to adapt. Some of the limits of this study can be identified. The literature has already shown that the forest owner's attitude towards risk is a driver for many decisions that imply risk, such as harvesting [START_REF] Brunette | Attitude towards Risk and Production decision: An Empirical analysis on French private forest owners[END_REF], insurance [START_REF] Sauter | To insure or not to insure? Analysis of foresters' willingness-to-pay for fire and storm insurance[END_REF]) and adaptation decision [START_REF] Brunette | Risk aversion hinders forestry professionals to adapt to climate change[END_REF]. However, in this study we do not have this variable as a potential characteristic of the forest owner. This article focuses on five adaptation strategies, whereas other ones are widely recommended to forest owners, such as reduction of density, better-adapted tree species, species mix, etc.

Figure 1 .

 1 Figure 1. Schematic representation of the questionnaire.

Table 1 . Characteristics of the private forest owners and of the forests.

 1

	Variable	Mean	Std. Dev.	N
	FORESTER
	Gender (female = 1)	0.078	0.269	944
	Age < 44 years	0.034	0.181	944
	45-65 years	0.682	0.466	944
	> 65 years	0.284	0.451	944
	Education: No diploma	0.055	0.229	944
	< A level	0.416	0.493	923
	A level	0.132	0.339	923
	2 to 3 years after A level	0.192	0.394	923
	Master	0.205	0.404	923
	SPC: Never worked	0.014	0.117	944
	Farmer	0.329	0.47	944
	Artisan	0.132	0.339	944
	Superior (executive)	0.256	0.437	944
	Intermediary	0.127	0.333	944
	Employee	0.07	0.255	944

Table 2 . Climate change variables.

 2

	Variable	Mean	Std. Dev.	N
	Perception: Yes	0.304	0.46
	Somewhat yes	0.43	0.495
	Somewhat not	0.103	0.304
	Not at all	0.078	0.269
	Don't know	0.085	0.279
	Anthropic: Yes	0.466	0.499
	Somewhat yes	0.395	0.489
	Somewhat not	0.053	0.225
	Not at all	0.081	0.273
	Don't know	0.004	0.066
	Impact: Large impact	0.443	0.497
	Small impact	0.364	0.481
	No impact	0.049	0.216
	Don't know	0.144	0.352
	Timing: Today (already observable)	0.546	0.498
	In 10 years	0.172	0.377
	In 30 years	0.186	0.389
	Don't know	0.097	0.296
	Feeling: Very worried	0.104	0.306
	Not very worried	0.747	0.435
	Don't know	0.148	0.356
	Manifestation: More drought	0.563	0.496
	More winter rain	0.341	0.474
	More storm	0.607	0.489
	Less frost	0.436	0.496

Table 3 . Changes in management practices.

 3

	Variable	Mean	Std. Dev.	N
	Change_practices	0.161	0.368	663
	Past (for more than 5 years)	0.073	0.26	703
	Past (in the past 5 years)	0.08	0.271	703
	Plan (in the next 5 years)	0.181	0.385	703
	No plan	0.61	0.488	703
	Don't know	0.057	0.232	703
	Among which "Past"
	Thinning	0.644	0.481
	Early harvest	0.467	0.501
	Late harvest	0.265	0.443
	Irregular	0.635	0.484
	Regular	0.5	0.502
	Triggering: Professional advice	0.141	0.349	191
	Friendly advice	0.068	0.253	191
	Specialised info	0.529	0.5	191
	Renewal_doc	0.262	0.441	191
	Motivation: Ecosystem	0.004	0.064
	Resilience	0.018	0.132
	Productivity	0.052	0.222
	Damage reduction	0.161	0.367
	Support: Financial/tax	0.066	0.249
	Technical assistance	0.087	0.282
	Scientific answers	0.24	0.428
	Training	0.607	0.49
	No change: Limited info	0.01	0.102
	Contradicting info	0.026	0.16
	Can wait	0.34	0.474
	Other priorities	0.147	0.354
	Admin rules	0.186	0.39
	User pressure	0.12	0.326
	Money	0.17	0.376

Table 4 . Adaptation strategies by area class.

 4

		Thinning	Early harvest	Late harvest	Irregular	Regular	N
	4 to 10 ha	0.67	0.33	0.50	0.71	0.48	48
	10 to 25 ha	0.69	0.41	0.23	0.52	0.33	29
	25 to 100 ha	0.49	0.49	0.45	0.50	0.50	118
	> 100 ha	0.70	0.68	0.15	0.67	0.56	27

Table 5 . Adaptation strategies by region.

 5

		Thinning	Early harvest Late harvest Irregular Regular	N
	AUVERGNE -	0.60	0.32	0.26	0.57	0.45	31
	RHONE-ALPES
	BOURGOGNE -	0.70	0.55	0.25	0.74	0.30	33
	FRANCHE-COMTE
	BRETAGNE -PAYS	0.70	0.35	0.30	0.43	0.60	23
	de la LOIRE
	CENTRE -VAL de	0.75	0.40	0.36	0.44	0.38	16
	LOIRE -ILE de F
	CORSE -PACA -	0.86	0.21	0.38	0.62	0.38	14
	OCCITANIE
	GRAND EST	0.61	0.49	0.29	0.76	0.42	37
	HAUTS de FRANCE -	0.65	0.40	0.37	0.55	0.57	37
	NORMANDIE
	NOUVELLE-	0.53	0.50	0.28	0.58	0.68	32
	AQUITAINE

Table 6 . The determinants of the change in practices.

 6

		Model (1)	Model (2)	Model (3)
	Area	0.00224 *	0.00211 *	0.00208 *
		(0.00117)	(0.00116)	(0.00109)
	Revenue_12 months	-0.0521	-0.0401	-0.0367
		(0.288)	(0.290)	(0.415)
	Gender	-1.407 **	-1.026 **	-1.020 **
		(0.427)	(0.440)	(0.473)
	Farmer	4.229 ***	4.148 ***	4.144 ***
		(0.253)	(0.281)	(0.240)
	Artisan	3.660 ***	3.629 ***	3.624 ***
		(0.296)	(0.327)	(0.293)
	Superior	4.259 ***	4.209 ***	4.203 ***
		(0.255)	(0.285)	(0.253)
	Intermediary	4.239 ***	4.160 ***	4.155 ***
		(0.270)	(0.309)	(0.281)
	Employee	3.929 ***	3.868 ***	3.840 ***
		(0.404)	(0.408)	(0.362)
	Worker	4.831 ***	4.750 ***	4.745 ***
		(0.366)	(0.385)	(0.241)
	Manag_document	0.436 **	0.450 **	0.453 **
		(0.171)	(0.185)	(0.200)
	Revenue_logging	-0.565 **	-0.530 *	-0.529
		(0.267)	(0.272)	(0.361)
	Revenue_hunting	-0.327 *	-0.379 *	-0.377 *
		(0.195)	(0.211)	(0.180)
	Obj_Biodiversity	3.718 ***	3.909 ***	3.917 ***
		(0.394)	(0.486)	(0.384)
	Obj_Heritage	4.067 ***	4.099 ***	4.107 ***
		(0.694)	(0.823)	(0.863)
	Obj_Leisure	4.029 ***	4.209 ***	4.216 ***
		(0.377)	(0.487)	(0.441)
	Obj_Timber	3.821 ***	4.006 ***	4.014 ***
		(0.543)	(0.626)	(0.742)
	Impact 4	0.292	0.336 *	0.334 *
		(0.188)	(0.196)	(0.168)
	More_drought	0.281 *	0.271	0.269
		(0.170)	(0.179)	(0.201)
	4

Table 7 . Reasons for "no adaptation".

 7

	Variable	Mean	Std. Dev.	Min. Max.	N
	Reasons for not adapting
	Not enough information	0.14	0.347	0	1	429
	Contradictory information	0.133	0.34	0	1	429
	Prefer to wait	0.321	0.467	0	1	429
	Other priorities	0.105	0.307	0	1	429
	Money	0.111	0.314	0	1	429
	Administrative rules	0.094	0.292	0	1	429
	User pressure	0.048	0.214	0	1	429
	Incentives to change
	Climate change assessment	0.114	0.318	0	1	429
	Need insurance	0.042	0.2	0	1	429
	Sanitary assessment	0.111	0.314	0	1	429
	Experimental plot (impact evaluation) tests 0.108	0.311	0	1	429
	Money	0.143	0.35	0	1	429
	5

Table 8 . Bilateral correlations between the adaptation strategies.

 8

		Thinning	Early harvest	Late harvest	Irregular	Regular
	Thinning	1.0000
	Early harvest	0.0753	1.0000
	Late harvest	0.0948	-0.2512	1.0000
	Irregular	0.1465	0.0759	0.0518	1.0000
	Regular	-0.0171	0.0513	0.0942	-0.3770	1.0000

Acknowledgments

The MACCLIF project was carried out within the framework of the actions of the RMT AFORCE (www.reseau-aforce.fr) thanks to the financial support of the French Ministry of Agriculture and the France Bois Forêt joint trade organisation. It has also benefited from government funding overseen by the French National Research Agency (ANR) under the programme, Investissements d'Avenir (Investments for the Future), reference no. ANR-11-LABX-0002-01 (Laboratoire d' Excellence TREE). The questionnaire and its results presented here were carried out together with the private foresters observation network of the National Centre for Private Forest Owners (CNPF) and financed by France Bois Forêt. The UMR BETA is supported by a grant overseen by the French National Research Agency (ANR) as part of the "Investissements d'Avenir" programme (ANR-11-LABX-0002-01, Laboratoire d' Excellence ARBRE).


Xavier Bonnetain
email: xavier.bonnetain@inria.fr

Akinori Hosoyamada
email: hosoyamada.akinori@lab.ntt.co.jp

María Naya-Plasencia
email: maria.nayaplasencia@inria.fr

Yu Sasaki
email: sasaki.yu@lab.ntt.co.jp

André Schrottenloher
email: andre.schrottenloher@inria.fr

Quantum Attacks without Superposition Queries: The Offline Simon's Algorithm Extended Abstract

Context

Assume that there exists exactly one i ∈ {0, 1} m such that f i ⊕ g has a hidden period, i.e.: ∀x ∈ {0, 1} n , f i0 (x) ⊕ g(x) = f i0 (x ⊕ s) ⊕ g(x ⊕ s) for some s. Furthermore, assume that the other functions are sufficiently "far from being periodic". Then find i 0 and s.

We are not looking for the hidden period of a single boolean function, but for the only periodic function in some search space. Furthermore, this function search space is of the form {f i ⊕ g|i ∈ {0, 1} m }. Previously, we would have solved this problem using Grover's quantum search [START_REF] Grover | A Fast Quantum Mechanical Algorithm for Database Search[END_REF] among the indices i. This requires to test whether an index i is i 0 or not: we do that by running Simon's boolean hidden shift algorithm [START_REF] Simon | On the Power of Quantum Computation[END_REF] on f i ⊕ g, which recovers a hidden period, if it exists, with O (n) superposition queries to f i and g. In total, this requires O n2 m/2 queries to F and to g and quantum access to both.

Our new idea is to exploit the "asymmetry" of the problem Assume that we have stored the quantum state:

|ψ g := ( x |x |g(x) )
⊗cn (where c is a small constant). Assume that we want to compute whether f ⊕ g is periodic. By making cn quantum oracle queries to f , we can make the quantum state

|ψ f ⊕g := ( x |x |(f ⊕ g)(x) )
⊗cn . Then we run Simon's algorithm reversibly and get the information whether f ⊕ g has a period. We uncompute back to |ψ f ⊕g , then |ψ g by redoing the queries to f . Hence all the queries to g can be made before the Grover search, and |ψ g needs to be set up only once.

This new idea leads to a long list of cryptographic applications. In the superposition query model, we can use this algorithm to reduce the amount of queries of many attacks. But we can also obtain new attacks in the standard query model. We take the Even-Mansour cipher as an example. It is defined as E k1,k2 (x) = k 2 ⊕ P (k 1 ⊕ x) where P is a random permutation. The comparison with previous works is done in Table 1.

Table 1. Previous and New Quantum Attacks on the Even-Mansour cipher (n is the block length, the total key length is 2n).

Model

Queries Time Q-memory C-memory Reference

Superposition O (n) O n 3 O (n) O n 2 [30] Standard O 2 n/3 O 2 n/3 O 2 n/3 O 2 n/3 [30] Standard O 2 3n/7 O 2 3n/7 O (n) O 2 n/7 [23] Standard O 2 n/3 O n 3 2 n/3 O n 2 O (n) This paper
Besides the polynomial time attack in the superposition model, Kuwakado and Morii also developed an attack in the standard model with O 2 n/3 classical queries and O 2 n/3 quantum RAM [START_REF] Kuwakado | Security on the quantum-type even-mansour cipher[END_REF]. An extension of this attack by Hosoyamada and Sasaki [START_REF] Hosoyamada | Cryptanalysis against symmetric-key schemes with online classical queries and offline quantum computations[END_REF] recovers the key with O 2 3n/7 classical queries, O 2 3n/7 quantum computations, polynomially many qubits and O 2 n/7 classical mem-ory. Our attack in the standard model only uses polynomially many qubits, yet only requires O 2 n/3 classical queries, O n 3 2 n/3 quantum computations and poly(n) memory.

New Attack on Even-Mansour. We split

k 1 = k (1) 1 ||k (2) 1 into k (1) 1
of n/3 bits and k

(2) 1 of 2n/3 bits (Figure 1). We define g : {0, 1} n/3 → {0, 1} n by g(x) := E k1,k2 (x 0 2n/3 ). Then we can make the quantum state |ψ g by classically querying g(x) for all x ∈ {0, 1} n/3 . This requires 2 n/3 classical queries. After that, we find k

(2) 1 using Grover's algorithm. Given a guess k ∈ {0, 1} 2n/3 , we define f k : {0, 1} n/3 → {0, 1} n by f k (x) := P (x k ). Then our guess is correct if and only if the function f k ⊕ g has a period k

Discussion

When the number of classical queries is limited to 2 n/3 (a standard restriction), the best classical attack on Even-Mansour requires finding an n-bit collision between 2 n/3 stored data and some offline queries to the permutation P . Hence, not only does it need O 2 2n/3 time, but also O 2 2n/3 accesses to a memory of size O 2 n/3 .

With the same classical data limitation, our algorithm has a time complexity O n 3 2 n/3 , hence almost a square-root speedup, and a memory complexity (quantum and classical) of O n 2 . It seems that, by embedding a hidden structure in the memory used, we are able to replace it by the state |ψ g defined above. We wonder whether this idea, that we applied to many popular ciphers and modes of encryption, could also prove itself worthy in the context of other quantum algorithms and attacks.

Fig. 1 .

 1 Fig. 1. Attack on the Even-Mansour construction.

Acknowledgements. The authors thank Léo Perrin for proofreading this article and Elena Kirshanova for helpful remarks. This project has received funding from the European Research Council (ERC) under the European Union's Horizon 2020 research and innovation programme (grant agreement n o 714294acronym QUASYModo).


Julio Lopez-Fenner

Samuel Sepúlveda
email: samuel.sepulveda@ufrontera.cl

Luiz Fernando Bittencourt

Fabio Moreira Costa

Nikolaos Georgantas

Privacy Preserving Multi Party Computation for Data-Analytics in the IoT-Fog-Cloud Ecosystem

Keywords: Secure Multi Party Computation, Internet of Things, Edge/Fog computing, Security and Trust

In this paper, we propose an architecture for privacy preserving protocols in an IoT-Fog-Cloud ecosystem computing hierarchy. We consider the paradigms of Fog and Edge computing, together with a multi-party computation mechanism that enables secure privacy-preserving data processing in terms of exchanged messages and distributed computing. We discuss the potential use of such an architecture in a scenario of pandemics where social distancing monitoring and privacy are pivotal to manage public health yet providing confidence to citizens.

Introduction

The Internet of Things (IoT) is bringing countless ways of collecting and processing data as more and more smart devices and sensors (IoT devices, for short) are deployed and connected to the Internet.

IoT devices are scattered at the edge of the network. They produce vast amounts of heterogeneous data that does not generate value by itself by uploading it to a -say -database [START_REF] Raafat | Fog intelligence for real-time iot sensor data analytics[END_REF] but needs computing power to be either further processed in order to generate a desired output or to produce an immediate response for a data query, may be even to produce intermediate data results that need to be further acquired or with higher levels of processing.

Examples of these requirements can be easily found in smart agriculture domains [START_REF] Elijah | An overview of internet of things (iot) and data analytics in agriculture: Benefits and challenges[END_REF], healthcare, industry and energy, transportation, and urban infrastructures, to name a few [START_REF] Mohammadi | Deep learning for iot big data and streaming analytics: A survey[END_REF][START_REF] Manyika | Disruptive technologies: Advances that will transform life, business, and the global economy[END_REF].

In this context, privacy concerns upon data being transmitted to and from the cloud arise naturally, as IoT devices and their data constitutes major targets for security and privacy attacks, including data breaching, data integrity, and data collusion [START_REF] Tao | Secured data collection with hardware-based ciphers for iot-based healthcare[END_REF]. Moreover, very often the data collected -if leaked and not protected by suitable encryption -can breach the user's privacy and be used for non authorized virtual profiling [START_REF] Hossain | Application of big data and machine learning in smart grid, and associated security concerns: A review[END_REF].

On the other hand, however, data collected from IoT devices can also be used for the common good and social profitability, as knowledge gathered from those data sets can help in improving people's quality of life, for example, by offering personalised services, precise and up-to-date information about people's surroundings and interests, and information for improving planning and efficiency of cities as well as for policy making [START_REF] Vorakulpipat | Recent challenges, trends, and concerns related to iot security: An evolutionary study[END_REF]. Therefore, there is ample need for the design and implementation of mechanisms for both, enabling and preserving privacy that still allows significant IoT data to be collected, distributed, and processed in a useful manner.

Currently, cloud computing has been used to store and process data collected by IoT devices. This well-established computing paradigm is very convenient for data processing applications that require large processing capacity, and it fits well to computing problems that use data collected from many sources regardless of their location. However, as IoT devices are located and scattered at the very edge of the network, they can easily be brought to consuming data from neighbouring counterparts, which then would not require further transfer to a centralised cloud for processing [START_REF] Zhang | A survey on emerging computing paradigms for big data[END_REF]. In this scenario, Fog Computing [START_REF] Group | Openfog reference architecture for fog computing[END_REF] has emerged to bring and distribute computing capacities closer to the edge. In this computing paradigm, micro data centres, or cloudlets, are deployed throughout the network (e.g. at access points or cellular base stations) to bring computing capacities closer to the IoT devices. Combined, all three layers of edge IoT devices, fog devices, and cloud computing, can provide a hierarchical ubiquitous-like infrastructure for processing IoT data. Notwithstanding, privacy concerns are still present in this scenario and should be addressed. Computational models for SMPC that fit the proposed hierarchical structure in terms of resource allocation need to ensure the privacy of individual users (parties) [START_REF] Liu | A protocol of secure multi-party multidata ranking and its application in privacy preserving sequential pattern mining[END_REF].

In order to present our approach, we introduce next some concepts and discuss challenges in the study of the three components of the IoT-Fog-Cloud ecosystem with regard to privacy preserving algorithms and protocols considering secure multi-party interactions. Then, in section 3 we introduce our proposed architecture and discuss its instantiation. Section 4 presents preliminary results towards such an architecture implementation and in section 5 we discuss some available literature on these topics. Section 6 brings conclusions and remarks.

Background

IoT-Fog-Cloud ecosystem

The Internet of Things (IoT) consists of 'zillions' of (inter-) connected devices that can include sensors/actuators with communication capabilities, i.e., virtually any object with embedded micro-controller and antennae, which can be highly heterogeneous at different levels, as for example energy consumption requirements, communications protocols, computing capacity, and mobility. Therefore, IoT devices management becomes intrinsically challenging in terms of data communication and processing, while it requires significant processing and knowledge extraction capabilities in order to provide relevant insight and, hence, constitutes an ideal field for developing and testing of Big Data tools. The challenge is precisely to transform gathered data into actual information knowledge by (secure) privacy-preserving processing. Examples of data collected by IoT devices with such requirements are: location-based services, security cameras, personalised preference tracking mechanisms (e.g. for advertisement), medical data collected by body sensors or by professional equipment at hospitals and clinics, see for example [START_REF] Reddy | Design of High Security Smart Health Care Monitoring System using IoT[END_REF].

Cloud computing represents nowadays a largely adopted computing paradigm servicing a variety of applications, providing dynamic configuration possibilities such as elasticity and pay-per-use. Resource virtualization allows providers to share slices of computing resources among users through the use of virtual machines and containers, where they appear to be logically isolated for each tenant. On-demand provisioning/de-provisioning, elasticity, ubiquitous access, lower upfront investments with reduced capital expenditures and faster time to market, are a few properties offered by cloud computing.

Clouds can partially fulfil applications requirements for IoT but may fall short for low latency, for example. Fog computing can be combined with the cloud to provide an ecosystem that furnishes full potential for IoT application deployments, as it introduces a hierarchy of computing capacity (fog nodes, cloudlets or micro data centres) between the edge and the cloud [START_REF] Group | Openfog reference architecture for fog computing[END_REF]. This hierarchy can provide a wider range of services that may not be supported solely by the cloud. Thus, a fog computing infrastructure can attend applications with a variety of Quality of Services (QoS) by using different hierarchical levels to meet latency and computing requirements.

A consequence of bringing processing closer to the edge with fog computing, as illustrated in Figure 1, is to reduce total bandwidth used in the network along the path between edge and cloud, as data can be aggregated at the edge before being transferred to the cloud. This computing hierarchy provided by the IoT-Fog-Cloud ecosystem enables thus processing to occur closer to where the data is being generated. This is useful for applications that depend upon very low delays or response times, but also for applications that only need data from constrained or specific geographic locations, as in this scenario the data does not need to be transferred all the way up to the cloud. Such a scenario demands the implementation of privacy-preserving mechanisms so that data shared from said IoT devices are not unintentionally available to third-parties.

Examples of such applications include real-time traffic estimation, autonomous cars traffic control, collision avoidance in non-signalised road intersections, localisationbased risk assessment, monitoring in disaster scenarios, actuators in dynamically changing environments, and so on. We are interested in the modelling and design of efficient processing data protocols for applications in a privacy-preserving context. We posit that Secure Multi-Party Computation (SMPC) [START_REF] Lindell | Secure multiparty computation for privacy preserving data mining[END_REF][START_REF] Von Maltitz | Data Querying and Access Control for Secure Multiparty Computation[END_REF], understood as the joint computation of a desired function in terms of an appropriate splitting and distribution among a number of parties under the constraint that all data has to remain private, naturally furnishes a setting for privacy-preserving data processing and correctness:

-Privacy, in the sense that no party learns anything new other than its prescribed jointly computed output; and correctness, in the sense that parties can trust that the computed quantities are indeed correct. This is useful, e.g., for the distributed evaluation of trust, as in [START_REF] Dumas | Dual protocols for private multi-party matrix multiplication and trust computations[END_REF], where parties or players compute a joint confidence level by combining their mutual degrees of trust. See the survey in [START_REF] Yan | A survey on trust management for internet of things[END_REF] (and the references therein) for a nice description of the role of SMPC in the IoT field.

In view of potential applications, technologies should also consider, at least, designs providing Confidentiality, Integrity and Availability (CIA triad) [START_REF] Von Maltitz | Secure and Privacy-preserving Services Based on Secure Multiparty Computation[END_REF]. Other requirements may be further imposed, for example on the side of independence of inputs, fairness, etc. (see [START_REF] Lindell | Secure multiparty computation for privacy preserving data mining[END_REF]).

Privacy preservation in the IoT

Secure multiparty computations (SMPC) allows n players to compute together the output of some function, using private inputs without revealing them to other parties and without gaining access to knowledge entrusted to another party. This is useful, e.g., for distributed evaluation of trust. In this context, players compute a confidence level by combining their mutual degrees of trust. See for example the survey in [START_REF] Yan | A survey on trust management for internet of things[END_REF] (and the references therein) for a nice description of the role of SMPC in the IoT field.

Notice that while SMPC protocols have been present in the literature for more than thirty years, their application to a data streams in a hierarchy of IoT devices (in terms of computational power), which are continuously producing data worth analysing while preserving privacy, can be considered as a relatively recent development [START_REF] Kerschbaum | Privacy-preserving computation[END_REF], in contrast to the more typical reception, storage and analysis of source data by a third-party centralised server that is not under the administrative control of the smart environment and hence potentially untrustworthy.

In the proposed architecture, the server should not obtain access to the raw data of the sources; it only fulfils management and orchestration purposes to carry out SMPC computations that are executed by the sources themselves [START_REF] Von Maltitz | Data Querying and Access Control for Secure Multiparty Computation[END_REF]. This enables privacy-preserving data processing while the sources can be dynamic. The role of an edge-IoT gateway, understood as middle-ware between IoT devices and the cloud that facilitates computations and is a communication gateway as well [START_REF] Papcun | Edgeenabled iot gateway criteria selection and evaluation[END_REF], may be further extended to be able to receive queries regarding the outcomes of the computations still without revealing any private information about the sources.

Performance and resource consumption characteristics of SMPC methods are key limitations for their application in resource constrained environments. A detailed assessment of these characteristics is carried out in [START_REF] Von Maltitz | A performance and resource consumption assessment of secret sharing based secure multiparty computation[END_REF]. The authors reach the conclusion that SMPC methods can be applied, in practice, in Intranet environments, but with limitations in Internet settings. This shows the need for new SMPC-based solutions where the resource environment performs in close collaboration with privacy-preserving mechanisms.

Privacy towards the Edge

This section describes an overview for the proposed privacy-preserving multiparty computation architecture for IoT using fog computing.

Hypotheses and Objectives

In order to develop a framework of theoretical nature and a test pilot for the hierarchical architecture in layers: from IoT to Edge and from Edge to Fog computing, in which multi party protocols can be proposed, we first consider current techniques and methods for Fog/Edge technologies and Multi party computations.

Since cloud computing cannot rely exclusively upon cryptographic protocols alone [START_REF] Van Dijk | On the impossibility of cryptography alone for privacypreserving cloud computing[END_REF] and, furthermore, the data collected by cyber-physical (IoT) sensors is known to be securely (and privately) processed using zero-knowledge proofs, as in [START_REF] Goldwasser | The knowledge complexity of interactive proof systems[END_REF], we propose to undertake our approach of Privacy Preserving Multi Party Computation for Data Analytic in the Iot-Edge-Fog ecosystem by first establishing a hierarchy of devices, as in Figure 2 and then to follow the lines proposed by [START_REF] Sousa | The present and future of privacy-preserving computation in fog computing[END_REF] and [START_REF] Pallas | Fog computing as privacy enabler[END_REF]. Fig. 2: Edge/Fog Computing hierarchy together with secure multi-party computation brings resource allocation challenges.

Architectural Principles

At the edge, we propose that IoT devices are grouped, either statically or dynamically, to be considered as data generators for a specific application or user query. Grouping is based on criteria such as resource allocation (at the fog), scalability and geographic location. These devices are assumed to be capable of executing SMPC in the context of the group which they currently belong to. The output of such computation may either be used immediately, to answer localised queries posed by users/consumers, or sent up (to services running in the same or a different micro-datacenter in the fog) as intermediate outputs that in turn are used in conjunction with outputs from other SMPC computations performed by other IoT device groups. This pattern of dynamically grouping SMPC parties that receive inputs from SMPC groups located underneath in the hierarchy repeats at the fog and cloud levels to produce intermediate outputs and/or to answer user queries.

To illustrate how this works, we consider the current pandemic scenario: Consider an end-user who is willing to know how safe it is to go to a specific place. Assume we can come up with a safety metric based on several pieces of information from the neighbourhood and/or place where this user is willing to go. A combination of data from IoT devices at the location of interest can be used to compute such safety metric and respond to the user query. However, it is clear that such information can often include personal data that raises privacy concerns, as for example medical conditions of people in that area, real-time and accurate information about people's location, data on how those people interact or have interacted on that location, information collected from cameras about the amount of people wearing masks, and so on. A privacy-preserving mechanism using multi-party computation would need to first choose sources to obtain all that data to be processed, and this is an example of how devices are to be grouped into sets that are able to generate data in response to a query. Then, the data set obtained from those devices can be first processed using multi-party computation protocols, and then be further moved to the closest cloudlet/micro data center at the fog level for further processing. With privacy already in place, it remains to aggregate the data and compute the necessary safety metrics of interest to that query.

Note that more complex scenarios, with more data or data from multiple geographic locations, can involve multiple cloudlets at the fog level or even involve the cloud to provide enough capacity or enough data sets to allow a proper computation of the desired metric.

To enable SMPC in the discussed scenario, many challenges arise. First, a candidate set of SMPC protocols must be identified, studied, and potentially adapted for the proposed infrastructure. Second, the composition of IoT device groups should be enabled by distributed computing mechanisms. Third, once these groups have been defined for a specific application or query, data processing should occur in an efficient manner throughout the system through proper resource allocation and scheduling mechanisms.

Architecture Instantiation

It is known that effective mechanisms addressing stacked fog layers (cloudlets) constitutes still a challenge and open issue [START_REF] Bittencourt | The internet of things, fog and cloud continuum: Integration and challenges[END_REF], since a universal standard of multi-layered fog computing architecture has not yet been adopted. We address this issue by considering data privacy aspects as inherent to a multi-layered fog architecture, in which resource allocation mechanisms are needed to efficiently process privacy-sensitive information.

Indeed, Fog computing technology enables the deployment of cloud-like computing services at the edge of the network. Fog-aware mechanisms and procedures to implement efficient resource management for applications with different levels of latency requirements remains a non trivial challenge [START_REF] Mahmud | Latency-Aware Application Module Management for Fog Computing Environments[END_REF]. Several efforts have addressed this body of work to provide a latency-driven fog computing environment for IoT applications using only one fog layer (i.e. cloudlets, micro data centres, or fog nodes) between the edge and the cloud (as illustrated in the proposed fog-cloud topology in Figure 1) [START_REF] Shah-Mansouri | Hierarchical Fog-Cloud Computing for IoT Systems: A Computation Offloading Game[END_REF][START_REF] Bittencourt | Mobility-Aware Application Scheduling in Fog Computing[END_REF][START_REF] Souza | Handling service allocation in combined Fog-cloud scenarios[END_REF][START_REF] Peterson | Democratizing the Network Edge[END_REF].

Next, it is common knowledge that some architectures [START_REF] Pinto | Iioteed: An enhanced, trusted execution environment for industrial iot edge devices[END_REF] for IoT assume that infrastructural elements in fog and edges are trusted entities. Thus, to preserve data privacy, those architectures may adopt data randomisation techniques such as differential privacy [START_REF] Dwork | Calibrating noise to sensitivity in private data analysis[END_REF] based on a trust curator model [START_REF] Rao | Privacy techniques for edge computing systems[END_REF]. But, in a complete untrustworthy component model, which is at the centre of our considerations, infrastructural components are not necessarily assumed to be trusted entities, so they should not access sensible data. We propose hence that our model should adopt techniques of secure multi-party computation to preserve data privacy.

Adoption of these techniques will have a direct impact on resource usage adequacy for IoT, in terms of processing power and exchanged messages among devices. In particular, they produce a huge increase in both the length and the number of messages, so they should be adapted to large-scale scenarios with IoT.

Finally, for the deployment of these protocols, end-to-end automated systems for deploying large-scale SMPC protocols between end users, called MPSaaS (acronym for system-as-a-service) have been designed and tested [START_REF] Barak | An end-to-end system for large scale p2p mpc-as-a-service and low-bandwidth mpc for weak participants[END_REF].

Preliminary Results and Discussion

In the field of smart homes with IoT, secure communications between smart devices endowed with low computational capabilities and a home gateway are frequently established via unsecured wireless communication channels. In [START_REF] Díaz Arancibia | On-The-Fly Diffie-Hellman for IoT[END_REF] we explored secure data transfer generated by IoT using standard Diffie-Hellman secret sharing which can be applied via buffering to higher throughput communications. Our assumptions were that at setup both the user and the gateway have enough processing power to perform -say -one time secured RSA encrypted communication, hence relaxing the need for a trusted secure server outside the domain, and that the protocol should at least be secure for a range of known attacks, as replay or DoS attacks. In turn, the approach failed impersonation attacks via Man in the Middle (MiM) so that a possible way out may lie in the implementation of SMPC as proposed in the architecture proposed here, since authentication would require a consensus (for example defined using Shamir's secret schem) to be build upon trusted devices. Hence, as mentioned above, joint computation of trust among parties can be performed by matrix multiplication, as in [START_REF] Dumas | Secure multiparty matrix multiplication based on strassen-winograd algorithm[END_REF], where we proposed an ad hoc Strassen-Winograd multiplication protocol that use a combination of partial homomorphic encryption schemes and additive masking techniques together with a (novel) schedule for the location and encryption layout of all intermediate computations, such that privacy is preserved. It turned out that the asymptotic communication volume and computational time was reduced from O(n 3 ) to O(n 2.81 ).

Thus, the main challenge now is to incorporate the developed protocols to the proposed computing hierarchy. This involves the prior study of performance of devices from the edge to the cloud to evaluate the possible ways of allocating resources for protocol processing and also assess communication costs. As a second step, evaluating the performance of the protocols in a real-world scenario, considering requirements as the amount of data inputs and needed response time (e.g. in the pandemics scenario described in Section 3), is key for establishing limitations and pinpoint where research must be focused to enable performanceeffective multiparty computation at the edge.

This involves developing optimization algorithms for dynamic grouping or clustering, as presented in Figure 2, which should consider multiparty computation aspects both in terms of privacy and response times: a too large set of IoT devices may impair performance for response time, while a too small set may result in poor output for the application requiring data collection and processing.

A set of requirements for privacy preservation mechanisms in the context of distributed and ubiquitous environments, such as in the IoT, was presented in [START_REF] Ankele | Applying the trustworthy remote entity to privacy-preserving multiparty computation: Requirements and criteria for large-scale applications[END_REF]. Among those requirements, they highlight the importance of ensuring privacy of the outputs of SMPC, which may be as important as the privacy of the inputs (as normally targeted in SMPC approaches), since data profiling might be used to de-anonymize the inputs or obtain sensitive information about the parties.

We address this issue to some extent, as the outputs at a lower level of the hierarchy are handled as inputs to the immediate upper level, and thus are subject to the usual privacy requirement. It remains to assess the effects of such privacy handling in relation to the use of the intermediate outputs for answering localised queries in a multi-layered fog architecture.

Some architectures for IoT assume that infrastructural elements in fog and edges are trusted entities [START_REF] Pinto | Iioteed: An enhanced, trusted execution environment for industrial iot edge devices[END_REF]. Thus, to preserve data privacy, those architectures adopt data anonymization techniques such as differential privacy [START_REF] Dwork | Calibrating noise to sensitivity in private data analysis[END_REF] based on a trust curator model [START_REF] Rao | Privacy techniques for edge computing systems[END_REF]. In an untrusted component model, which is the center of this proposal, infrastructural components are not assumed as trusted entities so they should not access sensible data. This model usually adopts techniques of secure multi-party computation to preserve data privacy.

In IoT, the adoption of those techniques differs in terms of the mechanism for privacy preservation, resource usage adequacy and the architectural-style for IoT platforms. The mechanisms for privacy preservation vary from differential privacy [START_REF] Dwork | Calibrating noise to sensitivity in private data analysis[END_REF], homomorphic encryption (partial or full) [START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF] and secure multi-party computation. Adoption of those techniques have a direct impact on resource usage adequacy for IoT, but also in terms of requirements of processing power and exchanged messages among devices. In particular, they produce a huge increase in the length and number of messages, so they should be adapted (e.g. [START_REF] Barak | An end-to-end system for large scale p2p mpc-as-a-service and low-bandwidth mpc for weak participants[END_REF]) to be applied in large-scale scenarios of IoT. Section 2.2 above discusses relevant approaches for privacy preservation in the IoT.

The architectural-style of an IoT platform may be exploited to satisfy resource limitations (e.g., processing power) or to decrease the number of disseminated messages, by transferring processing from devices or servers to intermediary components. Approaches of privacy preservation for IoT assume architectures such as cloud-based [START_REF] Barak | An end-to-end system for large scale p2p mpc-as-a-service and low-bandwidth mpc for weak participants[END_REF] platforms, mixed-mesh [START_REF] Tonyali | Privacypreserving protocols for secure and reliable data aggregation in iot-enabled smart metering systems[END_REF] networks, edge networks [START_REF] Ghinita | Private queries in location based services: Anonymizers are not necessary[END_REF], fog [START_REF] Saleem | Fesda: Fog-enabled secure data aggregation in smart grid iot network[END_REF], and mixed architectures with trusted entities [START_REF] Ankele | Applying the trustworthy remote entity to privacy-preserving multiparty computation: Requirements and criteria for large-scale applications[END_REF]. In particular, fog and edge-fog architectures allow multiple levels of processing and they are more adaptable to the dynamicity and diversity of IoT devices. We hypothesize that fog-edge architectures allow the development of efficient privacy preservation techniques, in terms of exchanged messages and distributed processing power.

Conclusions and future work

This work presented the main concepts and initial findings about the design and evaluation of privacy preserving protocols in an IoT-Fog-Cloud ecosystem computing hierarchy. We briefly discussed how this can be applied in a scenario as the present times of pandemics, but also covered general aspects that need attention for a generalized application of privacy-preserving mechanisms at the edge of the network.

We considered the paradigms of Fog and Edge computing, together with a multi-party computation mechanism to enable secure privacy-preserving data processing at the edge. The proposed architecture demands further developments in terms of understanding performance limitations and also in terms of resource allocation for data collection and processing of multiparty computation protocols, which can be the focus for further research. Also, the formalization of the proposal, with the modeling of inputs and outputs for multiparty computation at the edge, is a key future work to enable proper evaluation of efficiency and limitations of the proposal.

Fig. 1 :

 1 Fig.1: Overview of the IoT-Fog-Cloud infrastructure (adapted from[START_REF] Bittencourt | The internet of things, fog and cloud continuum: Integration and challenges[END_REF]).

Acknowledgments

This work was partially funded by the São Paulo Research Foundation (FAPESP), grants #2018/23126-3 and #2015/24494-8, CAPES, and CNPq, Brazil, grants 432943/2018-8 and 309562/2019-8. Partial support from Universidad de La Frontera, Vicerrectoría de Investigación grant DI20-0060 is also acknowledged.