Mohammed Nafi
email: mohammed.nafi@univ-bejaia.dz

Mohamed-Lamine Messai

Samia Bouzefrane

Mawloud Omar

IFKMS: Inverse Function-based Key Management Scheme for IoT networks

Keywords: storage, communication, computation overhead, and energy consumption Security, Key management, IoT, Inverse function, BAN logic Variable refresh period, Hash function, One-one function

Due to the rapid growth of the Internet of Things (IoT), secure communication is becoming a significant concern. Nodes that compose such a dynamic network need to exchange sensitive and valuable data. The data must be kept safe against attacks. This protection requires the development of efficient key management protocols. However, this task is challenging because of the high resource constraints of most IoT devices in terms of storage, communication, processing, and energy capabilities. Some existing key management techniques have certain weaknesses since sensitive parameters are not protected during transmission, and cryptographic keys are stored in plain text and usually renewed at a fixed period of time. This paper proposes a new key management protocol aiming to secure communications before and after key establishment. Our scheme uses hash and one-one functions to achieve security during the key establishment process. The symmetrical character of the invertible functions is thus exploited to conceal critical data and pairwise keys stored in nodes' memories. Moreover, the key refresh period is variable, which can be adjusted according to the number of occurred attacks in the network. BAN (Burrows Abadi Needham) logic is employed to assess the correctness of the proposed scheme. The results show that our scheme operates correctly and does not have redundancies or security flaws. Furthermore, the security and performance analysis point out that the proposed scheme is resilient against well-known attacks, and efficient in terms of

Introduction

Internet of Things (IoT) refers to a system that interconnects various types of autonomous and heterogeneous everyday objects. These devices are connected to the Internet and are provided with unique identifiers and communication capabilities. This allows them to exchange data with each other and with their environment over a network without any human intervention [START_REF] Bi | Internet of things for enterprise systems of modern manufacturing[END_REF]. IoT belongs to the dynamic networks category since its composition is not fixed and frequently changes following the addition and deletion of nodes after deployment. The goal is to extend the network and replace faulty nodes [START_REF] Eschenauer | A key-management scheme for distributed sensor networks[END_REF]. These networks have gained a lot of interest due to their wide range of application fields, including health care, smart home, smart cities, environment, agriculture, etc.

Devices that compose such a dynamic network sometimes have to exchange sensitive data. For instance, in a healthcare scenario, the sensors collect and transmit patients' physiological data toward the server to be reachable and analyzed by doctors. So, two legitimate entities need to communicate securely. An adversary may try to intercept, alter or delete exchanged sensitive data. Securing such communication is a real challenge. Nodes mainly communicate over vulnerable wireless channels, subject to passive and active attacks. Devices have high resource constraints in storage, processing, communication, and energy capabilities. Heterogeneity in terms of resources and dynamic topology resulting from nodes' mobility and frequent changes in network composition, etc. To provide security, one or more cryptographic keys is required. However, key management is complex, including key establishment, distribution, revocation, renewal, and addition.

Several security solutions have been proposed in the literature to address the issue of key management in dynamic networks. However, most of them suffer from two main problems that must be fulfilled. The first one is that sensitive parameters such as nodes' and keys' identifiers are usually transmitted alone and in clear text during the keys discovery phase. This is a point of weakness that may be exploited by an adversary to easily attack the network by doing man-in-the-middle and denial of service (DoS) attacks. Thus, recipient nodes cannot detect changes that an attacker might make during the transmission of these sensitive data over an insecure wireless communication channel. The second problem is that keys are always renewed at a specific moment. The key refresh period is fixed and does not adapt to the network's dynamic over time. An attacker only needs to compromise a node once to obtain this information. Consequently, he or she only has to strengthen his or her attack during its expiration in order to succeed.

This paper proposes a new key management scheme, termed IFKMS (Inverse Function-based Key Management Scheme for IoT networks), which corrects the previously highlighted shortcomings of some existing solutions. The main objective is to support both resilience and efficiency. In fact, the proposed scheme mainly uses one-one functions to conceal the stored keys and the sensitive data sent over an insecure channel before the key establishment phase. The critical parameters are thus never sent alone, but coupled with other information, which gives the recipient the ability to detect any message alteration. Moreover, our scheme uses a variable refresh period, which increases resilience because not only it adds difficulties to the adversary to find out the value of the refresh period, but also the current keys are frequently refreshed in the presence of attacks. It also improves efficiency since nodes save their energy in the absence of attacks.

The main features of the proposed key management scheme are enumerated in the following points:

-The proposal better secures communications between different legitimate entities not only after pairwise keys establishment, but also during this process;

-The sensitive data are never sent in plain text but always transmitted in a secure manner. Indeed, the data is hidden by using both one-one and hash functions or encrypted with the established pairwise keys;

-The established pairwise keys are protected using invertible functions associated with nodes before their storage;

-The refresh period is not fixed and can be dynamically adjusted according to the number of occurred attacks. In fact, this period increases if no attacks are detected and decreases otherwise. As a result, our scheme supports both efficiency and resilience;

-Efficiency in terms of energy consumption is guaranteed because in the absence of attacks, the constrained devices must wait for a long time before renewing their secret keys;

-Resilience is also ensured because the secret keys are frequently refreshed in the presence of attacks;

-The key revocation phase does not require any exchange of messages between current members, which considerably reduces costs in terms of communication and energy consumption;

-The proposed scheme allows node addition and revocation after the initial deployment phase.

The proposed scheme can be used in many areas, including the Medical Internet of Things, where wearable devices and sensors continuously collect patient physiological data, and securely transmit it to the server so that doctors can access and process it in real-time. This allows them to intervene in time and thus improve patients care.

The remainder of this paper is organized as follows. Section 2 recalls some basic mathematical concepts used in this paper. An overview of some related works is given in Section 3. Our proposed key-management scheme is described in detail in Section 4. Section 5 discusses the scheme's formal and informal security analysis. Section 6 highlights the performance evaluation of our scheme compared with recent existing schemes according to storage, communication, computation costs, and energy consumption. Finally, Section 7 concludes the paper and gives some future directions.

Mathematical preliminaries

This section briefly gives the basic concepts of one-one and inverse functions used in our scheme for security purposes.

One-one function

A one-one function f is a function where each element x in the domain D f corresponds exactly to one element, called image y = f(x) in the range or co-domain R f and vice versa. This means, no two different elements in the domain of f have the same image in the range, and no element y in the range is the image of more than one element x in the domain. A one-one function f can therefore be expressed as :

if f(x1) = f(x2) =⇒ x1 = x2, or equivalently, if x1 ̸ = x2 =⇒ f(x1) ̸ = f(x2).
It is important to note that only one-one functions have an inverse that is also a one-one function.

Inverse of one-one function

The inverse of a one-one function f with domain D f and range R f , denoted f -1 , is the function with domain R f and range D f , which is defined by f -1 (y) = x for any y = f(x) in the range of f. In other words, the inverse function f -1 of f is defined as: {(y, x)|(x, y) ∈ f}, that means f -1 is obtained by interchanging the coordinates in each ordered pair of f.

Properties of one-one function

The main properties of an invertible function f are listed as follows:

-The domain of f equals to the range of

f -1 (D f = R f -1
) and the range of f equals to the domain of

f -1 (R f = D f -1 ).
-Each function reverses what the other function does. That means, f -1 (f(x)) = x for all x in the domain of f and f(f -1 (x)) = x for all x in the domain of f -1 .

-The graph of an invertible function and the graph of its inverse are symmetric with respect to the line y = x. That means, (x, y) is on the graph of f if and only if (y, x) is on the graph of f -1 .

-Strong-collision resistance: It is impossible to find two different input values that give the same output or image.

Related work

This section reviews some related works presented in the literature to address key management issue in dynamic networks. These key establishment schemes can be classified into two main categories, namely probabilistic and deterministic. This paper mainly focuses on key pool-based, polynomial pool-based, and hybrid schemes. The last technique consists on the combination of both key and polynomial pool-based schemes.

In [START_REF] Eschenauer | A key-management scheme for distributed sensor networks[END_REF], the authors proposed a random key pre-distribution scheme (RKP) for sensor networks, called the basic scheme. Before deployment, each sensor is assigned a subset of keys, called key ring, randomly chosen from a large key pool. Every node broadcasts the list of keys' identifiers belonging to its key ring in the key discovery phase. Any pair of sensors share at least one key with a certain probability. If they do not find a common key, a path key is established by relying on an intermediate node, which has a common key with both sensors. The main drawback of this scheme is its resilience to node capture attack. Since the keys are chosen randomly from the same key pool, more than one pair of nodes may share the same key. Hence, compromising a node affects its links and some other links in the network. Thus, when the number of compromised nodes increases, the fraction of affected links quickly increases. In addition, whenever the key identifiers are sent in clear text during key discovery, an attacker could use them to launch attacks.

A key management scheme based on symmetric polynomial is presented by Blundo et al. [START_REF] Blundo | Perfectly secure key distribution for dynamic conferences[END_REF]. The idea is that a server selects a symmetric bivariate polynomial P(x, y) of degree t with coefficients randomly chosen over F q , where q is a prime number large enough q > n. The server gives each user i the polynomial P(i, y), which is obtained by evaluating the initial polynomial P(x, y) at point x = i. The scheme enables a pair of sensors i and j to establish a pairwise key by evaluating P(i, j) and P(j, i) respectively. The scheme is t-secure since it can resist to t captured nodes. Moreover, it does not require any communication during pairwise keys establishment. However, when the network size increases, an adversary may easily compromise more than t sensors, which may compromise the whole network.

Liu et al. [START_REF] Liu | Establishing pairwise keys in distributed sensor networks[END_REF], proposed a framework for polynomial pool-based key predistribution that enables two sensors to establish a pairwise key between them. This scheme is similar to the probabilistic key distribution or key pool [START_REF] Eschenauer | A key-management scheme for distributed sensor networks[END_REF] when the degree of all the polynomials is equal to zero, and it is equivalent to the polynomial-based key pre-distribution protocol [START_REF] Blundo | Perfectly secure key distribution for dynamic conferences[END_REF] when the size of the polynomial pool is equal to one. The scheme provides better security when compared to the previous ones. It is more resilient to a node capture attack since an attacker has to find out more than t shares of the same polynomial to be able to disclose pairwise keys of non-compromised nodes. In addition, unlike the previous scheme, the same key is never shared by multiple couples of sensors. However, some sensitive data like polynomial IDs are sent in clear text during polynomial share discovery.

An efficient multi-party key management scheme (EKM) for securing group communication in resources constrained networks is proposed by Mahmood et al. [START_REF] Mahmood | A polynomial subset-based efficient multi-party key management system for lightweight device networks[END_REF]. The network is first organized into clusters. After receiving an encrypted identifier from each member, cluster heads perform XOR operations on the subset of randomly picked hash values of these identifiers to generate the polynomial. The latter is then securely sent to members. The scheme preserves the anonymity of nodes because their identifiers are not transmitted in clear text. When generating the polynomial, it also reduces computation cost by performing light XOR operations instead of expensive multiplication. Moreover, EKM allows node addition and migration. However, its communication overhead remains high, and the polynomial needs to be refreshed after each node addition or deletion. Furthermore, too many operations are still performed by cluster heads, which may become a point of weakness for the network.

The authors in Kumar et al. [START_REF] Kumar | Polynomial based non-interactive session key computation protocol for secure communication in dynamic groups[END_REF] presented a k-degree multivariate polynomialbased session key computation protocol for securing communication in a dynamic group called NISKC. The scheme is non-interactive because the session key is computed at the group members' side without exchanging them. Initially, a trusted server generates polynomial shares for every member who wants to participate in group communication. The private values of group members constitute the polynomial variables. The polynomial shares are then securely distributed to participants. The latter have to insert their values into the polynomial to be able to compute a common session key. The scheme allows new members to join and current ones to leave the group during the communication process. The scheme also reduces the communication and computation overhead during the generation of the symmetric session key. However, the polynomial must be regenerated every time there is a change in group membership.

The authors in [START_REF] Zhang | Key establishment scheme for wireless sensor networks based on polynomial and random key predistribution scheme[END_REF] proposed a key establishment scheme for wireless sensor networks based on both polynomial and probabilistic key pre-distribution schemes. Before network deployment, the server generates a polynomial and key pools. Each polynomial and key are assigned with a distinct identifier. The server randomly assigns a set of polynomials shares and keys with their corresponding identifiers for each sensor. Two nodes can establish a communication key if they have at least one shared key, a common polynomial, or the pre-loaded keys of one node are computed using the polynomial shares selected for the other node. This scheme provides better resilience against node capture attacks than the previous works. However, it requires a large amount of memory to store keys and polynomial shares. In addition, the more polynomials and keys are stored in each node, the greater the connectivity and the lower the security. Thus, a trade-off between storage, connectivity, and resilience to node capture attacks must be established. Lu et al. proposed in [START_REF] Lu | A framework for a distributed key management scheme in heterogeneous wireless sensor networks[END_REF] a distributed key management framework in heterogeneous wireless sensor networks. The proposed framework is based on a random key pre-distribution scheme and a polynomial key pre-distribution scheme. The network is divided into several classes, where each class contains sensors having the same resource capabilities. The lower class holds the least powerful nodes, and the higher one includes larger resource nodes in terms of communication, processing, and energy capabilities. Like previous key establishment schemes, this framework also consists of three phases: initialization, direct key, and path key setup. In the first step, the server considers the heterogeneity features of sensor nodes when distributing them polynomial shares. Direct and path keys are then established during the second and third steps, respectively. Classifying sensors based on their communication ranges, processing capability, and energy levels helps designing the network. However, the authors do not present how these classes are formed and how classes evolve through the network lifetime when the energy levels of sensors decrease.

In Manasrah et al. [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF], a key management scheme in wireless sensor networks (WSN) is proposed. The scheme combines polynomial pool-based and matrix-based schemes and uses the block LU decomposition algorithm presented in [START_REF] Chen | Implementation of block algorithm for lu factorization[END_REF]. This approach consists of three phases, namely polynomial pool generation, polynomials pre-distribution, and key generation. In the first phase, a large pool of bivariate symmetric t-degree polynomials is generated by the base station. In the second phase, an n by n matrix is constructed from a set of polynomials chosen from the pool, where n is the size of the network. An LU decomposition of the obtained matrix is then performed. Each sensor i is pre-loaded with a row i of the matrix L and the corresponding column i of the matrix U, as well as the univariate polynomial P(i, y). In the last phase, two sensors generate a common key after authenticating each other by exchanging their identifiers and the rows of their L matrices. In this scheme, each sensor needs to store (t + 1) coefficients of the polynomial and N/2 elements of the row of the matrix L and the same number of the column of the matrix U. However, this approach did not address new node addition, key renewal, and revocation that are important in WSNs.

Ashwag Albakri et al. [START_REF] Albakri | Hierarchical key management scheme with probabilistic security in a wireless sensor network (wsn)[END_REF] proposed a new polynomial-based key distribution scheme in hierarchical WSN. The proposed scheme aims to reduce the impact of sensor capture attacks. The scheme includes three phases that are token generation, key establishment, and revocation. Three types of polynomials are used: trivariate, bivariate, and univariate, which are held respectively by the sink, cluster heads, and sensors. Sensors' tokens are generated using a trivariate polynomial F(x, y, z) and a prime number p. The parameters x, y, and z are of degree (k -1), (t -1), and (h -1), respectively. Two types of keys are also employed: unicast and broadcast keys. The scheme requires low communication overhead, and its resistance to node capture attack is mainly related to the thresholds k, t, and h. The scheme withstands the capture of (k-1) cluster heads (CH). In other words, if more than k CH are captured, an attacker can reconstruct the trivariate polynomial and thus compromise the whole network. Moreover, if at least t sensors of the same cluster are captured, an attacker can recover the bivariate polynomial and thus compromise all the clusters. However, the addition of new nodes to the network is not considered in this scheme.

A distributed and dynamic key management scheme for homogeneous wireless sensor networks has been introduced in [START_REF] Kumar | Scalable and storage efficient dynamic key management scheme for wireless sensor network[END_REF]. This scheme uses three types of keys: network key shared by all the sensors, cluster key known only to the cluster's members, and pairwise key established by a couple of nodes. Every node is pre-loaded with a recursive function with the first term. It is also assigned with m keys picked from m selected key chains. Two nodes can securely communicate if they share a common key or establish a pairwise key using the nonconvergent numerical sequence. The scheme is scalable and efficient in terms of communication overhead. It also allows node addition and key refresh. However, the storage overhead remains high.

A new set of hybrid hierarchical key distribution protocols in the context of smart cities, called H2KD are proposed in [START_REF] Abualghanam | A new hierarchical architecture and protocol for key distribution in the context of iot-based smart cities[END_REF]. The scheme uses both elliptic curve and symmetric cryptography. It is composed of four phases, which are key pre-deployment, key initialization, key establishment and key updating. Required parameters are first distributed to the nodes during the first and second phases. Master, public/private and session keys are then established at the third phase. New keys are generated in the last phase when a mobile node changes its location. The scheme supports mobility, heterogeneity, scalability and resilience. However, some messages are transmitted in clear text during key updating phase for instance. As a result, an adversary could easily alter them in order to disturb the key establishment process.

Recently, a new key establishment scheme based on Rabin cryptosystem is proposed in [START_REF] Bai | A practical lightweight anonymous authentication and key establishment scheme for resourceasymmetric smart environments[END_REF]. The Rabin cryptosystem is an asymmetric encryption algorithm which relies on integer factorization problem. The proposed scheme is considered in a smart home IoT application where a trustworthy third party initializes the system and registers all devices in the smart home. The third party generates keys and a hash function is used to register devices. Then, different steps for establishing session keys are described to secure communication. The proposed scheme lacks an energy evaluation for the use of an asymmetric cryptography algorithm. The presence in the network of a trusted third entity does not apply to all IoT network applications more precisely where the devices are deployed in hostile places. In addition, the proposed scheme is vulnerable to integer factorization attacks.

More recently, authors in [START_REF] Hussein | A secure and efficient method to protect communications and energy consumption in iot wireless sensor networks[END_REF] presented a key distribution method based on elliptic curve cryptography (ECC) in IoT networks. An improved version of the well known protocol, called LEACH [START_REF] Heinzelman | An application-specific protocol architecture for wireless microsensor networks[END_REF] has also been proposed. The network is organized into clusters. The proposed method consists of four phases. First, the number of clusters is identified and cluster-heads are selected after authentication of all nodes. Next, IoT nodes use the ECC method to establish and distribute keys. Then, routing tables are generated. Finally, the re-keying method is described when the topology of the clusters changes. A drawback of this method is that the authors do not present how the number of clusters is identified. In addition, the use of ECC is still an energy consuming process which can shorten the lifetime of nodes. Moreover, the re-keying step requires an exchange of messages between IoT nodes, but the authors do not show its impact on the resources of nodes.

IFKMS: Inverse Function-based Key Management Scheme

This section presents our solution for key management in IoT networks by focusing mainly on the system models, the notations used in this paper, and the different phases of the proposed scheme.

System models

This subsection presents the two models adopted in the proposed scheme: the network and threat models.

Network model

The proposed key management approach uses the network model presented in [START_REF] Nafi | Matrix-based key management scheme for iot networks[END_REF], which is illustrated in Fig. 1 and includes the following three components:

-Server node (S): This performs several heavy operations, such as the computation of the inverse functions corresponding to the selected invertible functions. Moreover, we assume that the server is equipped with an Intrusion Detection System (IDS) and can detect attacks.

-Gateway node (G): This acts as an intermediary between the server and the highly constrained nodes since the latter are not within the communication range of the server.

-Constrained node (N): these nodes carry out operations that are as light as possible to preserve their resources.

Threat model

We use the widely known Dolev-Yao threat model [START_REF] Dolev | On the security of public key protocols[END_REF], where each participant transmits messages over an unsecured medium. According to this model, an adversary may:

-eavesdrop on all the messages sent in an insecure way; -alter, delete or replay intercepted messages; -capture any node and have access to its memory.

Notations

The notations with their corresponding descriptions used in this paper are illustrated in Table 1.

Phases of the proposed scheme

The proposed scheme includes five important phases, namely (1) initialization, (2) key establishment, (3) key refresh, (4) node addition, and (5) key revocation. These phases are detailed below.

Initialization phase

The setup phase is carried out for the purpose of initializing IoT devices with involved key materials prior to network deployment. First, the server node randomly generates a pool of n invertible functions f over a definition domain D f , and computes the pool of their corresponding inverse functions, denoted f -1 , where n represents the network size. After that, for each node i, the server assigns a one-one function f i with its corresponding inverse function f -1 i . Initially, each device i that compose the network is pre-loaded with one 3-tuple (i, f i , f -1 i ) and (n -1) 2-tuples (j, f j ), with j = 1, ..., n and j ̸ = i. The nodes are also pre-distibuted with a common hash function h(), and the refresh period T r along with its minimum T min and maximum T max values. Note that the refresh period is set to the medium value between the two last ones, that is T r = (T min + T max )/2.

Key establishment phase

The present phase includes two steps: neighbor discovery and pairwise key generation, which are described in the following.

a) Neighbor discovery

This step is performed for neighborhood discovery purposes. Once the network deployment is established, each node i proceeds to discover the adjacent devices within its communication range. This is carried out by broadcasting its identifier i along with its masked identifier obtained with its one-one function f -1 i . A node i maintains a neighbors vector vi, wherein it stores the received identifiers from the authentic and direct neighbors.

At the end of this step, each node i keeps in its memory only its 3-tuple (i, f i , f -1 i ) and the 2-tuples (j, f j ), where j ∈ vi, and erases all the remaining 2-tuples.

b) Pairwise key generation

When a node i needs to communicate securely, for the first time, with its direct neighbors j, it first generates a random number ri. It uses its oneone function f -1 i to hide this sensitive data by calculating its image. After that, this node sends a request composed of two parts: the first one includes its identifier and the masked information, which is the image of both its identifier i and the secret value ri concatenated together. The second part contains the hash value obtained after applying the hash function to the previous concatenated values before being masked.

Nodei → Nodej : Request, i, f -1 i (i || ri), h(i || ri) (1)
Upon receiving this request, the recipient node j uses the appropriate inverse function f i to extract the initial values hidden by the sender, namely its identifier and the random number. After that, the node checks whether that request is not tampered with by an adversary during its transmission. If the verification is successful, then the latter generates a new random number rj, and responds with a reply message that also consists of two parts: the first one is composed of its identifier concatenated with the image of its identifier j, the nonce rj, and the successor of the received random number ri+1 all concatenated together. The second part includes the digest of these three last pieces of information concatenated together.

Nodej → Nodei : Reply, j, f -1 j (j || rj || ri + 1), h(j || rj || ri + 1) (2)
After the reception of the reply, the node i checks whether it is authentic and has not been altered by an attacker. If the verification succeeds then both nodes i and j proceed to compute the common pairwise key k ij as in the following Eq. 3.

K ij = h(ri || rj), with ri < rj (3)
The node i replies with a message that mainly contains the successor of the received random number encrypted with the established pairwise key

K ij afterward. Nodei → Nodej : {ri||rj + 1} K ij (4)
Finally, the node j receives and decrypts the cipher message using the established pairwise key K ij . The key generation phase is depicted in Fig. 2.

Node i Node j m 1 m 2 m 3 m 1 : Request, i, f i -1 (i || r i ), h (i || r i ) m 2 : Reply, j, f j -1 (j || r j || r i +1), h (j || r j || r i +1) m 3 : {r i || r j +1}K ij Time r i r j K ij K ij
Fig. 2 Pairwise key generation phase

It is important to note that keys are subsequently concatenated with the secret values and stored in nodes' memories after they have been concealed with their appropriate one-one functions. As a result, this avoids storing keys in plain text, which reduces the impact of capture node attacks. As an example, the node i stores f i (K ij ||r i ), with r i is the random value.

Illustrative example. The Fig. 3 gives an example of the key establishment process between the two nodes 1 and 2. The network is composed of three nodes. During the setup phase, each node i, i=1,2,3 is pre-loaded with one 3-tuple (i, f i , f -1 i ) and two 2-tuples (j, f j ), with i ̸ = j. At the deployment phase, each node i broadcasts a message i, f -1 i (i) in order to discover its neighbors. For instance, the node 1 broadcasts 1, f -1 1 (1). Both nodes 2 and 3 receive that message. Therefore, they update their neighbor vector by adding the node 1. At the end of this phase, each node keeps in its memory only its one 3-tuple and the 2-tuples of its neighbors. For example, the node 2 has one neighbor 1. Thus, it has one 3-tuple (2, f 2 , f -1

2 ) and one 2-tuple (1, f 1 ). Finally, to establish a pairwise key with the node 2, the node 1 sends a request and receives a reply. As a result, both nodes 1 and 2 generate the same pairwise key K 12 .

1 3 2 ID F i F i -1 1 F 1 F I -1 2 F 2 - 3 F 3 - 1 3 2 1, F 1 -1 (1) 2, F 2 -1 (2) 3, F 3 -1 (3)
Phase 2. a). Neighbor discovery (the begining) Phase 1. Initialization

ID F i F i -1 1 F 1 - 2 F 2 F 2 -1 3 F 3 - ID F i F i -1 1 F 1 - 2 F 2 - 3 F 3 F 3 -1 ID F i F i -1 1 F 1 F I -1 2 F 2 - 3 F 3 - 1 3 2
Phase 2.a) Neighbor discovery (the end)

ID F i F i -1 1 F 1 - 2 F 2 F 2 -1 ID F i F i -1 1 F 1 - 3 F 3 F 3 -1 1 3 2 (2)

Phase 2.b). Pairwise Key generation between node 1 and 2 (with r1=12 , r2=21)

(1), ( 3)

(1): Req, 1, F 1 -1 (1||12 ), H(1||12 ) (2): Rep, 2, F 2 -1 (2|| 21|| 13), H(2|| 21||13) (3)

Key refresh phase

The keys must be refreshed periodically to counter some security attacks. When the same keys are used for a long time, an adversary would be able to discover them by a brute-force attack. In the proposed scheme, the nodes refresh the keys by generating new random numbers after each period T r, and re-run the key generation phase. Furthermore, when the expiration time of (2 * T r) is reached, the server chooses a set of new invertible functions, computes their corresponding inverses, and transmits them to end devices through gateways in a secure manner. Therefore, every device replaces the old inverse functions with the appropriate new ones and performs the key generation phase. Note that the value of the timer changes continuously depending on the number of occurred attacks in the system. Whenever no attack happens during the renewal period T r, the server will not send any refresh message to the network members. Hence, the latter wait for the expiration of their timer before renewing the keys and update the period T r as follows: T r = T r + α, if the timer has not yet reached its maximum threshold T max , where α is the security parameter. The attack window is thus increased. Otherwise, if one or more attacks have been detected during this period, the members receive a refresh message from the server via the gateway node to which they are attached. This message is encrypted with the appropriate pairwise keys and contains a nonce and the number of attacks that occurred cpt. In this case, the recipient nodes do not wait for the expiration of their timer, but they immediately carry out key renewal and update the period as follows: T r = (T r -cpt * α), if the minimum threshold T min has not been reached yet. The attack window will therefore decrease. The different values taken by the timer T r according to the number of occurred attacks, are summarized in Eq. 5 and Eq. 6 below, and also shown in Fig. 4.

• Absence of attacks (cpt = 0) T r = T r + α if T r ⩽ T max -α T max otherwise (5)
• Presence of attacks

(cpt ̸ = 0) T r = T r -(cpt * α) if T r ⩾ T min + (cpt * α) T min otherwise (6)

T r

No attack?

T r ← T max T r ≤ T max -α? T r ≥ T min + cpt*α?

Yes No

T r ← T r + α T r ← T min

Yes

Yes

No No

T r ← T r -cpt * α

Fig. 4 Refresh period updates

Node addition phase

When a node intends to join the network or participate in its operations, it must go through the server. First of all, the server pre-loads current key materials into the memory of that new node before its deployment in the network. The pre-loaded parameters include: the minimum T min and maximum T max thresholds of the timer T r , hash function h(), security parameter α and the current one-one function of the gateway node f g to which the new node will be attached. Moreover, the server generates and assigns to this node a unique identifier n, a one-one function f n with its corresponding inverse f -1 n . As soon as the deployment is established, the new node generates a random number r n , then broadcasts a join message. This latter contains the information hidden with the one-one function of the gateway and a digest so that the other entities could not read its content.

Node n → * : Join, n, f g (n || f n || r n ), h(n || f n || r n ) (7)
Upon receiving the previous message, the gateway proceeds to check whether or not it is authentic. In the case of successful verification, the gateway in turn broadcasts the following message inviting the current members to deal with this addition. In this time, the content of the message is masked with the inverse function f -1 g of the gateways node.

Node g → * : g, f -1 g (g || (n || f n || r n )), h(g || (n || f n || r n )) (8)
A current member that has received a join message waits for the reception of another message that would stem from its gateway. If the member does not receive the second message, that means the new node fails its authentication with the gateway, so the join message will be ignored. Otherwise, the member checks the authenticity and integrity of the last message. If the verification succeeds, the member will send to the new node an acknowledgment Ack message containing essentially its one-one function and the current timer that are hidden with the one-one function of the new node.

Node i → Node n : Ack, i, f n (i || f i || r i || r n + 1 || T r ), h(i || f i || r i || r n + 1 || T r ) (9)
When receiving an Ack message, the new node uses its inverse and the hash functions to check it. After that, it updates its neighbors vector v n by adding the identifier i and saves the timer T r as well as the 2-tuple (i, f i ), with i ∈ v n , when the verification is succeed. Accordingly, both the member and new node use Eq. 3 to compute their shared pairwise key that will be used when they want to communicate securely. Finally, the new node closes the addition process by sending the last message encrypted with the established pairwise key. The node addition process is illustrated in the Fig. 5 Note that the pool of one-one functions and their corresponding inverse functions are populated with new functions after each node addition.

Key revocation phase

The key revocation phase is carried out according to two cases: when a node leaves the network with its willingness or does not correctly interact with other members or send any message for a long time. That node is automatically excluded from the network. Therefore, its neighbors delete the pairwise keys and security parameters, such as the one-one function shared with that node, so it will not succeed when trying to communicate with them later. That way, the current members do not save obsolete information about nodes having already left the network. Consequently, this allows them to gain some precious memory space. Note that the size of both pools of invertible and their corresponding inverse functions are reduced after each node revocation.

Security analysis

In this section, we discuss our scheme's formal and informal analysis. The formal analysis is performed using BAN logic.

Formal analysis

Formal verification is required to analyze and prove the correctness of the proposed scheme. For this purpose, we use Burrows Abadi Needham (BAN) logic [START_REF] Burrows | A logic of authentication, Proceedings of the Royal Society of London[END_REF] to check whether the proposed key establishment protocol works correctly and does not have redundancies or security flaws. We mainly evaluate secrecy, authentication, and freshness aspects. a) Notation The symbols P and Q denote principals, X and Y range over statements, and K represents the encryption key. A comma denotes the conjunction. The rest of the notations used in this analysis is given in Table 2.

Notation Description P | ≡ X P believes X P∢X P sees X or P has received a message containing X P ⊢ X P once said X or P has sent a message including X P K ↔ Q K is the shared key known only to P and Q P | ⇒ X P controls or has jurisdiction over X #(X) Formula X is fresh (X, Y)

Concatenation of X and Y {X} K X is encrypted under the key K Table 2 Notations b) Inference rules The main logical postulates or rules used in our analysis are listed in the following.

(1) The selection: -R-Select: if a principal P sees a formula, then he also sees its components.

R 11 : P∢(X, Y) P∢X ; P∢(X, Y) P∢Y (11)
-BS-Select: If P believes that Q said (X,Y), then P believes that Q said X.

R 12 : P | ≡ Q ⊢ (X, Y)) P | ≡ Q ⊢ X (12)
(2) From the message meaning rule for shared keys, we can deduce the following rule for shared functions. That is, if P believes that the function F is a public function of Q and P sees or receives a message X hidden with

Message 2. B-> A : F -1 b (rb, ra), H(rb, ra) Message 3. A-> B : rb, A K ab ↔ B K ab
From the previously exchanged messages, we get the following idealized forms expressed differently:

I1: B∢(F -1 a (ra), H(ra)) I2: A∢(F -1 b (rb, ra), H(rb, ra)) I3: B∢( rb, A K ab ↔ B K ab )

2) Goals

The main goal of the proposed key establishment protocol will be achieved when two principals A and B generate a pairwise key K ab , which must be authentic and known only to them. This results in the following statements:

G1: B | ≡ A K ab ↔ B; G2: A | ≡ B K ab ↔ A; G3: B | ≡ A | ≡ B K ab ↔ A

3) Assumptions

To analyze this protocol, we first give the following assumptions, which state the initial beliefs of the principals at the beginning of the protocol. Initially, each device must trust the one-one and hash functions pre-shared with each of its neighbors, which results in the following assumptions:

A1: A | ≡ F a ↔ A, A2: B | ≡ F a ↔ A, A3: A | ≡ F b ↔ B A4: B | ≡ F b ↔ B, A5: A | ≡ A H ↔ B, A6: B | ≡ A H ↔ B
In addition, each principal also believes in the integrity, authenticity, and freshness of the generated secret value, which leads to the following formulas:

A7: A | ≡ ra, A8: A | ≡ #(ra), A9: B | ≡ rb, A10: B | ≡ #(rb), A11: B | ≡ #(ra)
Finally, every principal knows that its neighbor controls or has jurisdiction over the secret value that it generates, which results in the following:

A13: A | ≡ B | ⇒ rb, A14: B | ≡ A | ⇒ ra

4) Formal proof or verification

The main steps of the proof are described as follows.

-The principal B receives the first message from A, and by applying the R-select rule R 11 to the idealized form I1 or by breaking conjunction, we get: F1: B∢F -1 a (ra) Since we have the hypotheses A2 and F1, the message-meaning rule R2 for shared functions applies and yields the following: F2: B | ≡ A ⊢ ra By using the freshness rule R3 over the assumption A11 and the previous result F2, we obtain:

F3: B | ≡ A | ≡ ra
Since we have the assumption A14 and F3, the jurisdiction rule R4 applies and yields the following: F4: B | ≡ ra From F4, A9 and R6, we get: F5: B | ≡ (ra, rb) From A6 and F5, we obtain the first goal G1: B | ≡ H(ra, rb), with ra < rb, that means G1:

B | ≡ A K ab ↔ B.
-The principal A receives the second message from B and by applying the R-select rule R 11 to the idealized form I2 or by breaking conjunction, we have: F6: A∢F -1 b (rb, ra) Since we have the hypothesis A3 and F6, the message-meaning rule R2 for shared functions applies and yields the following: F7: A | ≡ B ⊢ (rb, ra). By applying the refresh inject rule on the assumption A8, we get: F8: A | ≡ #(rb, ra). We use the nonce verification rule R3 over the results F8 and F7 to get:

F9: A | ≡ B | ≡ (ra, rb).
From the received message, the principal A can deduce the following result:

F10: A | ≡ B | ⇒ (ra, rb)
The jurisdiction rule R4 is applied to the results F9 and F10 to obtain: F11: A | ≡ (ra, rb). From A5 and F11, we obtain the second goal: G2: A | ≡ H(ra, rb), with ra < rb, that means G2:

A | ≡ B K ab ↔ A.
-The principal B receives the third message from A, and by applying the message meaning rule for shared keys to the goal G1 and the idealized form I3, we will have:

F12: B | ≡ A ⊢ B K ab ↔ A.
On the other hand, when applying the rule R5 on A10, we obtain

F13: B | ≡ #(B K ab ↔ A).
Finally, we use the nonce verification rule on the results F12 and F13 to deduce the third goal G3:

B | ≡ A | ≡ B K ab ↔ A.

Informal analysis

We informally discuss the resilience of the proposed scheme against some well-known attacks, such as eavesdropping, man-in-the-middle, node compromising, replay, and forward and backward secrecy attacks.

Eavesdropping attack

An intruder can eavesdrop on and intercept the relevant network traffic exchanged between legitimate participants for further analysis. During the pairwise key generation process, an attacker can obtain neither the pairwise keys nor key materials, allowing him/her to compute these secret keys. No sensitive data is transmitted in plain text, but it is always sent securely. They are all hidden or protected with both inverse and hash functions. Furthermore, after the key establishment phase, all the communications between two legitimate entities are protected by the use of appropriate established pairwise keys. The proposed scheme is therefore resilient against such attacks.

Man-in-the-middle attack

We distinguish two attack scenarios where an adversary captures and alters the content of the request and/or reply messages exchanged during the pairwise key establishment phase between two legitimate nodes.

Attack 1. When an adversary changes the identifier of the sender i to k, the recipient j will be able to detect such an attack. Two cases may arise.

-k ∈ vj: that means k belongs to the neighbor vector of the receiver j. In other words, k is also a neighbor of j. In this case, the recipient node j finds and uses the inverse function of k, noted f k , instead of the function f i of i, to calculate the image of the first part of the received message. As a result, it gets a completely different image or value.

After that, when it applies the hash function to the last result, it will find a footprint different from the one emitted by the sender. Hence, the recipient immediately detects that the message has been altered.

-k / ∈ vj: this means that k is not in the neighborhood of the recipient node j. In this case, the receiver fails when it attempts or tries to retrieve the initial hidden information because it does not find the appropriate inverse function to be used for this purpose. As a result, this node suspects an attack and thus discards the message.

Attack 2 Whenever an intruder replaces the hidden information or the image f -1 i (x) with another one, let's say, f -1 k (x) with k ̸ = i, the recipient also detects such attack, because it obtains a hash value that will not match one of the senders. Thus, the proposed scheme is secure against the Man-in-themiddle attack.

Node capture attack

In this type of attack, when an adversary captures a node, he/she can gain access to its memory. The proposed scheme resists this kind of attack well since, on the one hand, each node holds a small number of keys, allowing it to communicate securely with its direct neighbors. On the other hand, these keys are not stored in clear text, but they are hidden or masked by using the inverse function of the node. Therefore, the compromise of a given device has no impact on the other nodes and communication links.

Replay attack

A replay attack is a security threat where the malicious entity repeats or re-injects the old valid messages intercepted during previous communication sessions into the network. The proposed scheme can withstand this security attack since transmitted messages contain random secrets. On the other hand, when an adversary replies a captured message after a waiting time equals to t, If t > T r, upon the reception of that replay message, the verification does not succeed because all devices have already refreshed their pairwise keys. When t > 2T r, verification fails because all inverse functions have been updated. As a result, the recipients will reject this old replayed message coming from the malicious node.

Forward and backward secrecy

Forward and backward secrecy is guaranteed because all pairwise keys are renewed after the expiration of the timer T r. On the other hand, the old one-one functions are erased from the memories of nodes and replaced by the new ones after the timer 2T r elapses. Thus, the new secret keys are independent of the old keys. Therefore, the old keys become unusable, and they can not be able to decrypt new encrypted messages. In the same way, the new keys can not be used to decrypt old messages sent in the previous communication sessions.

Performance analysis

The performance of the proposed scheme is compared with the recent protocols [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF] and SSEKM [START_REF] Kumar | Scalable and storage efficient dynamic key management scheme for wireless sensor network[END_REF] introduced in the related work section. The evaluation is performed according to storage, communication, computation costs, and energy consumption metrics. The simulations are conducted using MATLAB environment. We consider a network where nodes are randomly deployed in a square area of 100 m 2 . Nodes are equipped with wireless communication antennas with a range of 10 meters. Moreover, the energy model presented by Heinzelman et al. [START_REF] Heinzelman | Energy-efficient communication protocol for wireless microsensor networks[END_REF] is used to estimate the amount of dissipated energy. According to this model, when a node sends a data of k bits length over a distance d, it dissipates a quantity of energy (joule) estimated to

E t (k, d) = k * (E elec + E amp * d 2 ) (18)
whereas when it receives the same amount of data, it consumes

E r (k) = E elec * k (19)
where E elec = 50 * 10 -9 j/bit and E amp = 100 * 10 -12 j/bit/m 2 . The notation used in this section is summarized in Table 3.

Storage overhead

The storage overhead can be defined as the total memory space required to store keys and security parameters. In IFKMS, each node saves a refresh period T r along with its thresholds T min , T max , one 3-tuple, and as many 2-tuples as it has neighbors in its communication range. Furthermore, a node with d neighbors has to store at most d pairwise keys.

In the experiments, it is assumed that the values of l id , l f and l k are set to 4, 16 and 16 bytes respectively. Furthermore, the value of m in SSEKM, is fixed to 50 since the probability of sharing at least one key is high when the pool contains 1000 keys. The overall storage overhead in the function of the network size is shown in Fig. 6. From the figure, we can observe that the storage overhead increases in the compared schemes with the number of nodes in the network. However, IFKMS has less storage overhead when compared to the other protocols. When the network size is equal to 10, for instance, our scheme saves about

Communication overhead

The communication cost can be measured as the total amount of data exchanged in the whole network. In our scheme, nodes do not have to communicate during the setup phase. That is why we were just interested in communication load during the key establishment phase. In this second phase, to establish pairwise keys with all adjacent members, a node must send one request, receive d responses and send back d encrypted messages, where d represents the number of nodes in its direct neighborhood.

The communication cost, expressed in bytes, in the function of the hash algorithm during the key establishment phase is illustrated in Fig. 7. Note that we considered a network of 100 nodes in the simulations. The figure indicates that the communication cost progressively increases in the network when increasing the hash value for the compared schemes. However, the results show that IFKMS is comparable to SSEKM and it is better than [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF]. The amount of data required to be exchanged between adjacent nodes for key establishment purposes in IFKMS is less than the latter. For instance, when the hash value is equal to 16 bytes, the total quantity of information exchanged is about 18.6 Kbytes in our scheme against 128.6 Kbytes in [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF]. Consequently, our scheme requires roughly 85.54% fewer data exchanged than that protocol. This gain in terms of communication progressively decreases up to 67.92% when the hash value reaches 64 bytes. The impact of the network size on the communication overhead during the pairwise key establishment phase is given in Fig. 8. Note that the hash value is set to 16 bytes during simulations while the network size ranges from 10 to 100 nodes. As depicted in this figure, IFKMS considerably reduces the number of messages exchanged during this phase when compared with the scheme [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF]. The figure shows that the communication overhead increases slowly in IFKMS and SSEKM, whereas this raises quickly in the other scheme. For instance, when the number of nodes reaches 100, the overall communication load in the network rises to 129.56 kbytes in [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF], while it is only 18.71 kbytes in ours. That is a difference of about 85.58%.

Comparative study

A comparison between IFKMS with the related schemes introduced in Section 3 is summarized in Table 4. This comparison concerns the storage, communication, and computation overhead at the constrained node side. Notice that the evaluation of the two last requirements is performed when computing just one pairwise key between a pair of nodes. In addition, the established keys are not considered in the memory occupation estimation for all the compared schemes. For example, concerning the storage overhead, every node in our scheme needs to store (d + 2) one-one functions, (d + 1) nodes identifiers, and 3 refresh values. At the same time, in [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF], each sensor stores a t-degree polynomial shares, as well as a row of BL and a column of BU matrices of (N/2) elements each, with N represents the size of the network. Whereas, in SSEKM [START_REF] Kumar | Scalable and storage efficient dynamic key management scheme for wireless sensor network[END_REF], to each node is assigned an identifier, m keys and a non-convergent recursive sequence with its first term. For the communication overhead, to compute one pairwise key in IFKMS, a node needs to send a request with an encrypted message and receive a reply from the adjacent node. Both the request and the response contain a message type, a node identifier as well as a hidden and hash values. Meanwhile, in [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF], a sensor sends its identifier, the row of BL matrix, and an encrypted identifier. At the same time, it receives an ACK, a row of BL matrix, an identifier, an encrypted message, and a MAC. While in SSEKM, one node has to send and receive an identifier, a key chain identifier as well as a nonce and hash value. Finally, in terms of computation overhead, to establish one key in IFKMS, a node needs to perform two one-one function evaluations, three hash operations, and one encryption, while in [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF], a sensor carries out polynomial evaluation, vector multiplication, encryption/decryption, and MAC operations. Whereas, a node performs only two recursive function evaluations in SSEKM.

Energy consumption

We evaluate the performance of IFKMS with respect to dissipated energy in the entire network when nodes exchange required messages for pairwise key computation purposes. This energy consumption is directly related to the size and the number of messages sent and received by each node in the network. This explains why the Fig. 9 is very similar to Fig. 7, and the Fig. 8 and Fig. 10 are very close. Fig. 9 shows the dissipated energy in communication in the function of the hash algorithm during the key establishment phase. The network size is set to 100 nodes as in Fig. 7. As illustrated in this figure, the energy consumption increases with increasing the hash value for the compared schemes. However, IFKMS and SSEKM widely outperform the scheme proposed in [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF]. This can be explained by the high amount of data required to be exchanged between nodes in the latter scheme compared with IFKMS and SSEKM. For instance, when the hash value is equal to 64 bytes, the total energy dissipated in IFKMS is about 19633.06µJ against nearly 60551.97µJ in [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF]. As a result, our protocol saves roughly 67, 58% of energy compared with that scheme. Fig. 10 plots the impact of the network size on the communication energy during pairwise key establishment. Note that during simulations, we have kept the same values of the hash and the network size as those in Fig. 8. As shown in this figure, IFKMS and SSEKM considerably reduce the energy consumption during this phase when compared to the scheme [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF]. We can observe that when the number of nodes reaches approximately 40 nodes in the network, the dissipated energy starts to rise rapidly in [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF]. At the same time, it remains stable and increases slowly in ours. For example, whenever the network size reaches 100 nodes, the energy consumed in the entire network is 7951.6µJ in IFKMS against about 54352.12µJ in [START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF]. As a result, our scheme saves up 46400, 52µJ of energy.

Conclusion

IoT networks are increasingly used in various applications such as Medical Internet of Things. Securing communications in such systems is challenging due to severe resource constraints and heterogeneity of IoT devices. In this paper, we proposed a new key management scheme that exploits the features of inverse functions to protect communications between devices. Therefore, sensitive data is hidden during message exchanges by employing one-one functions to defeat security attacks. Moreover, a variable re-keying period is used, making our scheme more adaptable and resilient to attacks. The security and performance analysis showed that IFKSM meets basic security goals including secrecy, integrity and authentication, and ensures resilience since keys are refreshed frequently in the presence of attacks in the system. It is also efficient in terms of energy consumption as well as memory, communication, and computation overheads when compared with most studied protocols, and it has approximately the same performance as other ones.

As further work, we intend to extend the proposed scheme by integrating the group key establishment mechanism to deal with group communication, and implement this solution in a real application of IoT environment.

Fig. 1

 1 Fig. 1 Network model

:Fig. 3

 3 Fig. 3 Example of pairwise key generation phase

Fig. 5

 5 Fig. 5 Node addition phase

Fig. 6

 6 Fig. 6 Storage overhead vs. Network size (m=50)

Fig. 7

 7 Fig. 7 Communication overhead vs. Hash algorithm (n=100 Nodes)

Fig. 8

 8 Fig. 8 Communication overhead vs. Network size (h=16 bytes)

Fig. 9

 9 Fig. 9 energy vs. Hash algorithm (n=100 Nodes)

Fig. 10

 10 Fig. 10 Communication energy vs. Network size (h=16 bytes)

Table 1 Notations

 1

	Notation Description
	i	Identifier of the node i
	f i	Non-usual invertible function assigned to node i
	D f , R f	Domain and range of the function f respectively
	f -1 i	Inverse function of f i
	ri	Random number generated by node i
	xi || xj	Concatenation of xi with xj
	T r	Refresh period
	T min	Minimum value of refresh period
	T max	Maximum value of refresh period
	K ij	Shared key between nodes i and j
	{M} k	Message M encrypted with the key k
	α	Security parameter

  as follows:Node n → Node i : {r n ||r i + 1} K in

			(10)
	Node g	m 2
	Node n	m 1
		m 3	m 4
	Node i
			Time
	m 1 : Join, n, f g (n||f n ||r n ), h(n||f n ||r n )
	m 2 : g, f g -1 (g||(n||f n ||r n )), h(g||(n||f n ||r n ))
	m 3 : Ack,i,f n ((i||f i ||r i )||r n +1||T_{r}),h((i||f i ||r i )||r n +1||T_{r})
	m 4 : {r n ||r i +1}K in

Table 3

 3 Notations3, 83% of memory space in comparison with the protocol[START_REF] Manasrah | Key pre-distribution approach using block lu decomposition in wireless sensor network[END_REF]. This gain progressively increases to reach approximately 67, 54% when the number of nodes reaches 100 in the network. That is a growth of about 63, 71%.

Table 4

 4 * l id + (d + 2) * l f 2(l t + l id + l of + 2F + 3H + E +l h ) + l e RKP [2] (k + 1) * l k + k * l id 2k * l id or 2k * l e k * (E + D) [4] s ′ (l f + l id ) (s ′ + 1) * l id or PE or D 4s ′ * l id + l e EKM [5] l k + l f 2 * l e 2H + E + D + PE NISKC [6] l id + l f l t + l f PE [7] s * l k + g * l f + 2 * (3s + g + 1) * l id PE or H (3s + g + 1) * l id [9] N * l id + l f (2 + N) * l id + (N/2) * M+ l t + 2 * l e + l Overhead comparison of different schemes

	Scheme	Storage	Communication	Computation
	IFKMS	(d + 4)

h E + D + H + PE [11] 2 * l f + l k l e PE + Mod + D SSEKM [12] m * l k + 2 * l id + l f 8 * l id + 2 * l h 2 * F H2KD [13] l id + l k 3 * l id + l e -[14] l id + l k + l h 6 * l id + 2 * l h 3 * (XOR + H)

Acknowledgments

This work has been carried out under the research activities of CEDRIC laboratory at CNAM, Paris, France, and jointly with LIMED laboratory, which is affiliated to the Faculty of Exact Sciences, University of Bejaia, Algeria. It has been sponsored by the General Directorate for Scientific Research and Technological Development Program of the Ministry of Higher Education and Scientific Research (DGRSDT), Algeria.

the corresponding private function F -1 , then P believes that Q once said X.

(3) The nonce verification or freshness: if P believes on the freshness of the statement X and P also believes that Q once said X, then P believes Q believes the statement X.

(4) The jurisdiction: if P believes that Q has jurisdiction over the statement X and P believes that Q believes the statement X, then P believes the statement X.

R4 :

(5) The fresh inject: If P believes that some part X of a formula is fresh, then the whole formula (X,Y) must also be fresh.

(6) The belief : If a principal P believes part X of a statement and the remaining part Y of the same statement, he believes the whole statement (X.Y).

R6 :

c) Analysis Security analysis using BAN logic goes mainly through four steps: (1) idealization of the protocol to be analyzed, (2) definition of security goals to be achieved, (3) formulation of initial assumptions, and (4) the analysis or the verification of the protocol itself.

1) Idealization

The idealized form of our key establishment protocol is presented as follows: Message 1. A-> B : F -1 a (ra), H(ra)


Marie Dupuy

Frédéric Dutheil

Al'ai Alvarez

Thomas Godet

Oluwaseun John Adeyemi

Maëlys Clinchamps

Jeannot Schmidt

Céline Lambert

Dr Jean-Baptiste Bouillon-Minois
email: jbbouillon-minois@chu-clermontferrand.fr

Influence of COVID-19 on stress at work during the first wave of the pandemic among emergency health care workers

Keywords: COVID-19, Stress, Pandemic, Emergency Department, Heart Rate Variability, Visual Analogue Scale

Key points: Does the apparition of a new pandemic induce more stress than daily job among emergency healthcare workers? Findings: Emergency healthcare workers had higher stress levels between the two waves of the pandemic, considered as "control" period. But this period had also a higher level of daily admission.

Meaning: Overcrowding of Emergency Department induce more stress than a new pandemic. Taking care of our healthcare workers should be a priority for all politics.

INTRODUCTION

For more than 2 years, Coronavirus-19 (COVID-19) pandemic impacted an already overwhelmed healthcare system. The local epidemic quickly became a global pandemic that caused worldwide governments to adapt [START_REF] Gebru | Global burden of COVID-19: Situational analyis and review[END_REF] . During the first pandemic wave (from April 10 to May 10, 2020), no vaccine was available, with some areas being more overwhelmed than others [START_REF] Bouillon-Minois | SARS-CoV-2 pandemic and emergency medicine: The worst is yet to come[END_REF][START_REF] Bouillon-Minois | Emergency Department and Overcrowding During COVID-19 Outbreak; a Letter to Editor[END_REF] . Healthcare workers (HCWs), especially emergency and intensive care HCWs, were on the frontlines managing patients affected by this novel disease [START_REF] Nguyen | Risk of COVID-19 among front-line health-care workers and the general community: a prospective cohort study[END_REF] . Occupational stress leads to burnout and impacts individual morbidity and mortality [START_REF] Kivimaki | Work stress and risk of cardiovascular mortality: prospective cohort study of industrial employees[END_REF] . Emergency HCWs are particularly at risk for stress and burnout because of the complex interaction between lifethreatening emergencies, emergency department (ED) overcrowding, vicarious trauma [START_REF] Roden-Foreman | Secondary traumatic stress in emergency medicine clinicians[END_REF][START_REF] Nydoo | The second victim phenomenon in health care: A literature review[END_REF][START_REF] Stehman | Burnout, Drop Out, Suicide: Physician Loss in Emergency Medicine, Part I[END_REF] , lack of sleep, unhealthy diet [START_REF] Bouillon-Minois | The Negative Impact of Night Shifts on Diet in Emergency Healthcare Workers[END_REF] , and accumulated fatigue [START_REF] Moukarzel | Burnout Syndrome among Emergency Department Staff: Prevalence and Associated Factors[END_REF][START_REF] Durand | Stress and burnout among professionals working in the emergency department in a French university hospital: Prevalence and associated factors[END_REF] . Frontline workers were more likely to experience burnout, post-traumatic stress disorders, and poor sleep quality [START_REF] Shanafelt | Understanding and Addressing Sources of Anxiety Among Health Care Professionals During the COVID-19 Pandemic[END_REF][START_REF] Shanafelt | Changes in Burnout and Satisfaction With Work-Life Integration in Physicians and the General US Working Population Between 2011 and 2020[END_REF][START_REF] Prasad | Prevalence and correlates of stress and burnout among U.S. healthcare workers during the COVID-19 pandemic: A national crosssectional survey study[END_REF][START_REF] Sinsky | COVID-Related Stress and Work Intentions in a Sample of US Health Care Workers[END_REF][START_REF] Yin | Posttraumatic stress symptoms of health care workers during the corona virus disease 2019[END_REF] . Furthermore, HCWs, especially those on the frontlines, reported high rates of depression, anxiety, and insomnia compared to the general public [START_REF] Zhang | Occupational Stress and Mental Health: A Comparison Between Frontline Medical Staff and Non-frontline Medical Staff During the 2019 Novel Coronavirus Disease Outbreak[END_REF] .

The Karasek Job-demand scale or the Perceived Stress Scale is a validated tool that assesses subjective stress at work [START_REF] Karasek | The Job Content Questionnaire (JCQ): an instrument for internationally comparative assessments of psychosocial job characteristics[END_REF] . However, because of its length and complexity, the time commitment for completion makes this test impractical in the clinical setting. The Visual Analog Scale (VAS) was initially developed to assess pain [START_REF] Heller | How to analyze the Visual Analogue Scale: Myths, truths and clinical relevance[END_REF] . It has also been used and validated to evaluate stress [START_REF] Lesage | Clinical stress assessment using a visual analogue scale[END_REF] . VAS is attractive because it is simple to implement, easy to understand, and time efficient. Currently, VAS is the most common tool used by occupational physicians to assess stress among workers [START_REF] Lesage | Clinical stress assessment using a visual analogue scale[END_REF][START_REF] Dutheil | At-risk and intervention thresholds of occupational stress using a visual analogue scale[END_REF] . In addition, stress can be objectively evaluated using biomarkers 22,23(p8), [START_REF] Bouillon-Minois | Leptin as a Biomarker of Stress: A Systematic Review and Meta-Analysis[END_REF][START_REF] Bouillon-Minois | Ghrelin as a Biomarker of Stress: A Systematic Review and Meta-Analysis[END_REF][START_REF] Dutheil | DHEA as a Biomarker of Stress: A Systematic Review and Meta-Analysis[END_REF] such as heart-rate variability (HRV) [START_REF] Dutheil | JOBSTRESS study: comparison of heart rate variability in emergency physicians working a 24-hour shift or a 14-hour night shift -a randomized trial[END_REF] .

Measuring HRV is noninvasive, easy to use, reproducible, and measurable over more extended periods (over 24 hours) [START_REF] Malik | Heart rate variability: standards of measurement, physiological interpretation and clinical use. Task Force of the European Society of Cardiology and the North American Society of Pacing and Electrophysiology[END_REF] . Linked to the autonomous nervous system, HRV reflects the cardiovascular response to regulatory impulses affecting heart rhythm [START_REF] Kim | Stress and Heart Rate Variability: A Meta-Analysis and Review of the Literature[END_REF] . Stress among HCWs has been widely studied with the overwhelming observation that this pandemic induced stress, burnout, and post-traumatic stress disorder [START_REF] Couarraze | The major worldwide stress of healthcare professionals during the first wave of the COVID-19 pandemicthe international COVISTRESS survey[END_REF][START_REF] Douplat | Changes over time in anxiety, depression, and stress symptoms among healthcare workers in French emergency departments during the first COVID-19 outbreak[END_REF][START_REF] Guillen-Burgos | Prevalence and associated factors of mental health outcomes among healthcare workers in Northern Colombia: A crosssectional and multi-centre study[END_REF] . Given the dearth of information on stress response during the first wave of the pandemic, we conducted a study among emergency and intensive care unit HCWs. The main objective was to assess the impact of COVID-19 on the subjective and objective stress levels at work. Secondary objectives were to assess the correlation between subjective stress using VAS and objective stress using HRV among HCWs.

METHODS

Study design

We performed a prospective, observational study between April 10 to July 15, 2020, in three departments of the University Hospital of Clermont-Ferrand, France: ED, mobile intensive care unit, and intensive care unit (ICU). The study was divided into two sessions: the first one during the first wave of the COVID-19 pandemic (April 10 to May 10, 2020) and the second one during the interval between the first wave and the 2nd wave (June 10 to July 15, 2022).

We defined this second time point as "control," considering operationally, clinical practice tended to return to pre-COVID practices. The inclusion criteria were all HCWs (physicians, nurses, and nurse's aids) who volunteered to participate in the study. Exclusion criteria included pregnancy, refusal to participate, and being a trainee. At the beginning of each shift, one investigator installed a portable monitor belt that measures heart rate (HR) and HRV. Study volunteers were asked to wear the belt for the duration of the shift. Furthermore, a survey was created by three investigators (M.C., F.D., and J-B.B-M.) regarding stress assessment and the necessity to study the impact of COVID-19 on stress among emergency and ICU HCWs. Completion of the survey took approximately 3 minutes and was divided into 3 parts: 1) Sociodemographics -age, sex, height, weight, body mass index (BMI), profession, seniority, physical activity, and tobacco, 2) The 13 VAS questions -stress to caring for a COVID-19 patient, stress at work, stress at home, fatigue, sleep quality, anxiety, mood, burnout, job control, job demand, leadership support, support from colleagues, and job satisfaction. This part was answered at the beginning and end of the shift, 3) Patient acuity and demographics -number of patients personally cared for by the study participants, including life-threatening emergencies and the number of procedures deemed high-risk for COVID-19 exposure [START_REF] Mick | Aerosol-generating otolaryngology procedures and the need for enhanced PPE during the COVID-19 pandemic: a literature review[END_REF] (endotracheal intubation, thoracostomy, nasogastric aspiration, and nasopharyngeal swabbing of patients under investigation for COVID-19), number of admissions in the ED and number of COVID-19-related admissions by shift.

Data collection

All data from questionnaires were manually extracted in an Excel ® sheet. HRV data were downloaded daily using Bioharness Zephyr ® software. Analysis from Zephyr was performed with the Kubios ® software. All HR records available were analyzed. We deleted incorrect data due to artifacts using the very-low filter on the Kubios ® software [START_REF] Królak | Artifact Correction in Short-Term HRV during Strenuous Physical Exercise[END_REF][START_REF] Ribeiro G Dos | Can RR intervals editing and selection techniques interfere with the analysis of heart rate variability?[END_REF][START_REF] Salo | Ectopic Beats in Heart Rate Variability Analysis: Effects of Editing on Time and Frequency Domain Measures[END_REF][START_REF] Plaza-Florido | Cardiovascular Risk Factors and Heart Rate Variability: Impact of the Level of the Threshold-Based Artefact Correction Used to Process the Heart Rate Variability Signal[END_REF] . When available, the questionnaires were linked to the biometric data monitoring with an anonymized number.

The following biometric parameters were collected: time-domain measurement -RR interval (Interval between every heartbeat), the standard deviation of the regular sinus beats (SDNN), HR mean, root mean square of successive differences between normal (RMSSD), percentage of adjacent NN intervals that differ from each other by more than 50 milliseconds (pNN50), HRV triangular index (HTI), Triangular Interpolation of the NN interval histogram (TINN), the standard deviation of heart rate (STDHR) and frequency-domain measurements to separate HRV into its component VLF (very low frequency), LF (low frequency), and HF (high frequency) rhythms that operate within different frequency ranges [START_REF] Shaffer | An Overview of Heart Rate Variability Metrics and Norms[END_REF] .

Data analysis

Categorical data were expressed as a number of subjects and associated percentages, and continuous data as mean ± standard deviation or median [25 th ; 75 th percentile] according to the statistical distribution,. Characteristics of the participants were compared according to the two sessions using the chi-squared test or Fisher's exact test for categorical variables and the Student's t-test or Mann-Whitney test (if the assumptions of the t-test were not met) for quantitative ones. Normality was verified by the Shapiro-Wilk test and/or histogram, and homoscedasticity by the Fisher-Snedecor test. Factors associated with subjective stress were studied using linear mixed models, considering the participant as a random effect, to account for the repeated measurements per participant. Objective stress was compared according to the two sessions using linear mixed models, considering the session as a fixed effect and the participant as a random effect. If necessary, a logarithmic transformation of the dependent variable was made to achieve normality. Correlations between subjective and objective stress at work (VAS and HRV, respectively) were assessed with Spearman's correlation coefficients (noted ρ). These coefficients were interpreted as follows (absolute value): ≥ 0.70 (strong correlation), 0.50-0.69 (moderate correlation), 0.30-0.49 (low correlation), 0.00-0.29 (no or negligible correlation) [START_REF] Hinkle De Wiersma | Applied Statistics for the Behavioral Sciences[END_REF] . Statistical analysis was performed using the Stata software (version 15; StataCorp, College Station, Texas, USA). All tests were two-sided, with an alpha level set at 0.05. No correction for multiple testing was applied in the analysis of secondary outcomes or subgroup analysis [START_REF] Feise | Do multiple outcome measures require p-value adjustment?[END_REF] . Findings from these analyses were interpreted as exploratory.

RESULTS

Characteristics of the population

April 10 to July 15, 2020, we included 199/283 volunteer participants for 192 records, 182 (94.8%) of whom responded to the survey questions regarding stress at work (subjective stress) and 96 (50.0%) participants provided HR data entries (objective stress). The flowchart is shown in Figure 1. We had a total of 98 (51.0%) subjective stress responders: 94 (95.9%) during the first session and 4 (4.1%) during the second session. We also had 12 (6.3%) responders provide objective biometric data entry without their subjective stress data: 11 (91.7%) during the first session and 1 (8.3%) during the second session. We had 84 (43.8%) responders provide both subjective and objective stress data: 53 (63.1%) during the first session and 31 (36.9%) during the second time session.

The participants' demographics were mostly female (61.5%), with a mean age of 33.7 ± 7.9 years old and a mean BMI of 23.0 ± 3.3 kg/m 2 . 49 (25.5%) were smokers, and 95/190 (50.0%) had a physical activity superior to the World Health Organization recommendations (≥ 2.5 hours per week). Of the study respondents, 93 (48.4%) were physicians, 76 (39.6%) were nurses, 13 (6.8%) were ambulance drivers, and 10 (5.2%) were nurse's aids. Of the patient demographics/acuity survey respondents, 52/141 (36.9%) faced life-threatening emergencies, and 28/141 (19.9%) high-risk COVID-19 transmission procedures. The characteristics of participants were similar between the two sessions (Table 1). However, there was a significant difference in the median number of patient volumes per day, the median number of COVID-19 patients, the work location, and the number of patients per worker (Table 1).

Main objective: impact of COVID-19 on stress

Subjective stress

The mean stress level at work was 3.40 ± 2.34, without any difference between the two session (3.16 ± 2.34 versus 4.39 ± 2.11, p=0.23). No difference was found according to sex, job, and physical activity. However, a higher stress level was found among smokers (p=0.03) and participants who had a life-threatening emergency during their shift (p=0.006) (Table 2). Furthermore, at the beginning of the shift, a moderate correlation (0.52) was observed between the stress of taking care of a COVID-19 patient and anxiety, and a low correlation between stress at home (0.35), tiredness (0.37), burnout (0.40), and job demand (0.38) (Table 3).

Objective stress

We found no significant difference between the two sessions in all frequency-domain measurements (Figure 2). However, during the second session, time-domain measurements, TINN and PNN50, were significantly lower compared to the first session signaling higher stress levels, respectively 760 ms vs 630 ms for TINN and 31.5 % vs 20.6 % for PNN50. In addition, SDNN and HR were lower during the second session but not statistically significant (122.9 ms vs 99.5 ms p=0.06 for SDNN and 98.0/min vs 93.3/min p=0.08 for HR, respectively) (Figure 2).

Secondary objective: correlation between objective and subjective stress

We did not find any correlation between objective and subjective stress except for timesdomain measurements -RR (-0.23, p=0.04) and HTI (-0.28, p=0.01), considering as low Spearman's correlation coefficients. However, no other domain was significant --0.14 for SDNN, 0.17 for HR, -0.15 for STDHR, -0.12 for RMSSD, -0.06 for PNN50 and -0.06 for TINN.

Regarding frequency domain measurements, no correlation was significant --0.17 for VLF, -0.10 for LF and HT and 0.13 for LF/HF. No linear measurement was significant (-0.13 for SD1 and -0.16 for SD2). (Supplementary Table)

DISCUSSION

We found moderate stress levels among emergency HCWs during the first wave and the control period of the novel pandemic in a low-incidence place. Interestingly, our data show that the novel pandemic did not increase the stress levels of emergency HCWs beyond the expected daily stress. Furthermore, we did not find a strong relationship between subjective (VAS) and objective (HRV) data. Prior literature supports this observation [START_REF] Petrowski | Stress load of emergency service: effects on the CAR and HRV of HEMS emergency physicians on different working days (N = 20)[END_REF] .

Period of measurement

We performed the first session during the first wave of the pandemic in France from April 10, to May 7, 2020. At that time, scientists did not know much about the virus, its contagiousness, and its transmissibility [START_REF] Bhagavathula | Knowledge and Perceptions of COVID-19 Among Health Care Workers: Cross-Sectional Study[END_REF] . Since diagnosis using polymerase chain reaction was not readily available compared to today, we used chest tomography as a surrogate for diagnosing COVID-19 [START_REF] Lv | Chest computed tomography for the diagnosis of patients with coronavirus disease 2019 (COVID-19): a rapid review and meta-analysis[END_REF] . Furthermore, no vaccine was available during the time of the study. Emergency and ICU HCWs treated and cared for possible or known COVID-19 patients with only PPE, adding to moral distress. The French Auvergne region was relatively protected from high volumes of COVID-19 admissions during the first pandemic wave following the French government declaring lockdown on March 17, 2020. For example, the average daily entries at the Clermont-Ferrand ED is 160 patients per day. On March 18, 2020, the patient volume was only 60 patients [START_REF] Bouillon-Minois | SARS-CoV-2 pandemic and emergency medicine: The worst is yet to come[END_REF][START_REF] Bouillon-Minois | Emergency Department and Overcrowding During COVID-19 Outbreak; a Letter to Editor[END_REF] . Additionally, all non-urgent surgery and medical hospitalization were canceled. These new constraints decreased overcrowding during the first lockdown [START_REF] Bouillon-Minois | SARS-CoV-2 pandemic and emergency medicine: The worst is yet to come[END_REF][START_REF] Bouillon-Minois | Emergency Department and Overcrowding During COVID-19 Outbreak; a Letter to Editor[END_REF] , and the French Auvergne region took care of patients transferred from other locations [START_REF] Hinkle De Wiersma | Applied Statistics for the Behavioral Sciences[END_REF] . This situation was not anticipated at the time we began the study. We anticipated the ED to be overwhelmed, similar to other EDs [START_REF] Azoulay | Admission decisions to intensive care units in the context of the major COVID-19 outbreak: local guidance from the COVID-19 Paris-region area[END_REF] , and expected a higher stress level in the first session than in the second session. However, our study showed that the control period was more stressful than the pandemic's first wave based on objective stress data using HRV. The main explanation we found is overcrowding, with the number of patients in the ED being significantly higher in the second period, aggravated by the lack of beds available to admit patients. Similar to pre-pandemic observations, overcrowding significantly impacts increasing stress among nurses and physicians [START_REF] Bond | Frequency, determinants and impact of overcrowding in emergency departments in Canada: a national survey[END_REF] .

Subjective stress

During more than 24 months, COVID-19 and its impact on emergency HCWs have been studied. We hypothesize that the pandemic increased the stress levels of HCWs. The best performing concept to assess stress is the job-demand-control model created and validated by Karasek in 1981 [START_REF] Karasek | The Job Content Questionnaire (JCQ): an instrument for internationally comparative assessments of psychosocial job characteristics[END_REF] . The Job Content Questionnaire is derived from Karasek's model and has been developed and validated in several languages [START_REF] Karasek | The Job Content Questionnaire (JCQ): an instrument for internationally comparative assessments of psychosocial job characteristics[END_REF] . Studies have highlighted its psychometrics properties, especially in a French population of 24,486 workers [START_REF] Niedhammer | Study of the validity of a job-exposure matrix for psychosocial work factors: results from the national French SUMER survey[END_REF] . However, this tool is difficult to use daily in the population of HCWs because of its length (18 items) and complexity. Similarly, studies show that the participation rate decreases with the length of the questionnaires and decreases in attention and concentration [START_REF] Aceves-Martins | Self-reported weight and predictors of missing responses in youth[END_REF] . The VAS was developed to assess occupational stress [START_REF] Lesage | Clinical stress assessment using a visual analogue scale[END_REF][START_REF] Dutheil | At-risk and intervention thresholds of occupational stress using a visual analogue scale[END_REF] . It is a suitable tool for clinical activity and has good psychometric characteristics [START_REF] Sung | The Visual Analogue Scale for Rating, Ranking and Paired-Comparison (VAS-RRP): A new technique for psychological measurement[END_REF][START_REF] Abend | Reliability, validity and sensitivity of a computerized visual analog scale measuring state anxiety[END_REF] .

Heart rate variability, However, when people are less able to cope with stressors or if the duration of stress is too long or often repeated, the autonomic nervous system activity is reduced or unbalanced, inducing anxiety and depression [START_REF] Yoo | Heart Rate Variability-Measured Stress and Academic Achievement in Medical Students[END_REF] . Baseline HR and HRV are measures of stress highlighting, a sympathetic shift in sympathovagal balance, and reduced complexity of the cardiac signal [START_REF] Orsila | Perceived mental stress and reactions in heart rate variability--a pilot study among employees of an electronics company[END_REF] . Although we did not find any statistically significant baseline HRV between the two sessions, we were able to find a tendency. Second session HRV seems to be lower than firsts.

We hypothesize that our sample size is not strong enough. However, we will not be able to perform such study before decades. Indeed, the first wave of the COVID-19 pandemic was the first worldwide pandemic since the Spanish flu in early 20 th century. No HCWs have already live this type of pandemic. To perform the exact same study with a stronger sample, we need a long term wash out period to study new HCWs free of pandemic as worker. We can only hypothesize on our results -and so on tendencies. One of the main differences between the two periods was the number of daily consults, which is known to be stressfull [START_REF] Eriksson | Registered nurses' perceptions of safe care in overcrowded emergency departments[END_REF] .

However, we had a lot of cofounding factors that could decrease its impact. SDNN explores short-term stress, i.e. less than two hours, while PNN50 and TINN explore both acute and long-term stress. SDNN and stress index positively correlate when the stress level is correctly adapted. SDNN increases when stress increases. Our data showed that SDNN levels were lower in the second period, assuming lower stress levels; in the context of long-term stress, it is important to remember that SDNN is the best marker for long-term stress. On the contrary, PNN50 is low during stress exposure, explores short-time variability, and is influenced by both acute and long-term stress [START_REF] Hernando | Validation of the Apple Watch for Heart Rate Variability Measurements during Relax and Mental Stress in Healthy Subjects[END_REF][START_REF] Hernando | Validation of heart rate monitor Polar RS800 for heart rate variability analysis during exercise[END_REF] . We found that PNN50 was lower during the second period highlighting higher stress levels. Lastly, TINN, a well-known HRV parameter to be higher when the stress is lower, is also higher during the first period, signaling lower stress levels during the first period [START_REF] Orsila | Perceived mental stress and reactions in heart rate variability--a pilot study among employees of an electronics company[END_REF] .

Limitations

Our study has some limitations. Our study period covered the first wave of the pandemic, which had comparably less impact in the French Auvergne region, mainly due to early lockdown and public adherence. It may be interesting to perform new measurements during different periods of the COVID-19 pandemic (e.g., first wave, second wave, when the vaccine became available, after the third wave), and also during "non-COVID-19" and during pandemic recovery periods.

Additionally, we used Bioharness Zephyr ® , and participants were asked to place the belt themselves after a demonstration, which introduced a lot of artifacts and uninterpretable data. To counter this issue, we used the very-low artifact correction option of Kubios® software. It may be relevant to train participants to use the belt before the beginning of the measurement. Data collection was only obtained during regular business hours and missed those working overnights. Nocturnist schedules may pose unique stressors. Furthermore, there were some missing data for each variable (not all participants provided both HRV data and the VAS survey). The VAS survey is based on the Karasek model for measuring stress, although it has not been validated. Biometric data obtained were limited to HRV and did not include respiration rates, depth, or amplitude of respiration. Although less studied, evidence for HRV biomarkers is mostly focused on acute stress. Also, we did not study the impact of COVID-19 on neuroendocrine indexes such as plasmatic cortisol or catecholamine levels. Finally, we recruited a sample of young, healthy participants, which impairs the generalization of our results, although it represents the population of our departments.

CONCLUSION

COVID-19 alone did not increased stress levels during the first wave of the pandemic. This is likely because the French Auvergne region faced fewer COVID-19 patients during the first wave. We found that a higher volume of patients that daily consult in the ED, active smoking, and exposure to life-threatening emergencies were associated with higher stress levels at work during the COVID-19 pandemic. We also found no significant correlation between subjective and objective stress at work.

EthicsA

  French Ethics committee (Comité de Protection des Personnes Sud-Est VI, University hospital of Clermont-Ferrand) approved this study protocol in April 2020 (reference 2020/CE15), and the protocol was registered in ClinicalTrials (NCT04954105).

Figures legendFigure 1 :

 1 Figures legend

Figure 2 :

 2 Figure 2: Comparison of heart rate variability according to the two sessions.

0n:

  number of observations; rho (ρ): Spearman's correlation coefficient; SD: standard deviation. Spearman's correlation coefficients were interpreted as follows (absolute value): ≥ 0.70 (strong correlation), 0.50-0.69 (moderate correlation), 0.30-0.49 (low correlation), 0.00-0.29 (no or negligible correlation). Session 1: during the first wave of the pandemic (April 10 to May 10, 2020); session 2: after the first wave of the pandemic (June 10 to July 15, 2020).

Table 1 :

 1 Characteristics of the population.

Table 2 :

 2 Factors associated with subjective stress at work measured by a visual analog scale.

Table 3 :

 3 Correlation between work and personal environment (at the beginning and end of the shift) and subjective stress at work (measured by a visual analog scale).

Table 1 : Characteristics of the population.

 1

	Total	Session 1	Session 2	p-value
	(n=192)	(n=156)	(n=36)

Number of patients per day 97 [91; 106] 96 [91; 104] 138 [102; 152] <0.001 Number of COVID patients per day 19 [3; 23] 22 [19; 23] 0 [0; 3] <0.001 Number of patients per worker per

		7 [5; 15]	6 [4; 14]	15 [7; 20]	<0.001
	day
	Life-threatening emergencies	52/141 (36.9) 42/106 (39.6) 10/35 (28.6)	0.24
	High-risk actions	28/141 (19.9) 22/106 (20.8)	6/35 (17.1)	0.64
	Data are presented as a number of subjects (percentages), mean ± standard deviation, or median [25 th ; 75 th
	percentile]. VAS: visual analog scale. Session 1: during the first wave of the pandemic (April 10 to May 10, 2020);

session 2: the time interval after the first wave of the pandemic (June 10 to July 15, 2020).

Table 2 : Factors associated with subjective stress at work measured by a visual analog scale.

 2

		Total			Session 1		Session 2
		n	Mean ± SD or ρ	p-value	n	Mean ± SD or ρ	p-value n	Mean ± SD or ρ	p
	Age (years)	182 -0.01	0.85	147 -0.01	0.92	35	0.03	0
	Sex
	Female	112	3.67 ± 2.37	0.38	92	3.42 ± 2.28	0.69	20	4.80 ± 2.47	0
	Male	70	2.97 ± 2.25		55	2.74 ± 2.39		15	3.83 ± 1.40
	Body mass index (kg/m 2 )	182 0.00	0.99	147 0.00	1.00	35	-0.02	0
	Tobacco
	No	136	3.13 ± 2.29	0.03	113	2.97 ± 2.30	0.27	23	3.87 ± 2.11	0
	Yes	46	4.21 ± 2.34		34	3.79 ± 2.38		12	5.38 ± 1.81
	Physical activity
	< 2.5 hours per week	92	3.15 ± 2.21	0.70	78	2.96 ± 2.21	0.54	14	4.21 ± 1.93	0
	≥ 2.5 hours per week	88	3.69 ± 2.46		67	3.43 ± 2.48		21	4.50 ± 2.26
	Job
	Paramedic	96	3.59 ± 2.67	0.19	82	3.26 ± 2.61	0.69	14	5.57 ± 2.15	0
	Physician	86	3.18 ± 1.90		65	3.05 ± 1.95		21	3.60 ± 1.71
	Number of patients per day	124 0.04	0.64	89	0.01	0.93	35	0.025	0
	Number of possible COVID-19 patients	124 -0.01	0.27	89	-0.10	0.34	35	0.183	0
	Number of patients per worker per day	142 0.12	0.15	107 0.22	0.02	35	-0.24	0
	Life-threatening
	emergencies Yes No	52 89	4.32 ± 2.26 3.54 ± 2.30	0.006	42 64	4.07 ± 2.18 3.37 ± 2.44	0.07	10 25	5.35 ± 2.43 4.00 ± 1.89	0
	High-risk aerosolizing
	procedures No Yes	113 28	3.58 ± 2.26 4.84 ± 2.29	0.07	84 22	3.34 ± 2.26 4.82 ± 2.39	0.03	29 6	2.28 ± 2.14 4.92 ± 2.06