Heather J Galipeau

Michelle Wiepjes

Jean-Paul Motta

Jessica D Schulz

Jennifer Jury

Jane M Natividad

Ines Pinto-Sanchez

Daniel Sinclair

Perrine Rousset

Rebeca Martin Rosique

Rebeca Martin-Rosique

Luis Bermudez-Humaran

Jean Christophe Leroux

Joseph Murray

Edgardo Smecuol

Julio C Bai

Nathalie Vergnolle

Philippe Langella

Dr Elena F Verdu
email: verdue@mcmaster.ca.

Novel role of the serine protease inhibitor elafin in gluten-related disorders

Keywords: Gluten-sensitivity, elafin, celiac disease, proteolytic therapy

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

Celiac disease (CD) is triggered by the ingestion of gluten in genetically susceptible individuals. Gluten has been proposed to contribute to health issues other than CD [START_REF] Verdu | Editorial: Can Gluten Contribute to Irritable Bowel Syndrome[END_REF][START_REF] Verdu | Between celiac disease and irritable bowel syndrome: the "no man's land" of gluten sensitivity[END_REF][START_REF] Biesiekierski | Gluten causes gastrointestinal symptoms in subjects without celiac disease: a double-blind randomized placebo-controlled trial[END_REF][START_REF] Ludvigsson | The Oslo definitions for coeliac disease and related terms[END_REF]. Currently, there are no pharmacological treatments available for patients with CD or other gluten-related disorders. A life-long adherence to a gluten-free diet (GFD) is required after the diagnosis of CD is confirmed. However, a GFD is associated with high non-adherence rates [START_REF] Pinier | The copolymer P(HEMA-co-SS) binds gluten and reduces immune response in gluten-sensitized mice and human tissues[END_REF][START_REF] Hall | Systematic review: adherence to a gluten-free diet in adult patients with coeliac disease[END_REF]. Gluten is a common ingredient in many food items, making complete removal of gluten from the diet challenging [START_REF] Lee | Celiac diet: its impact on quality of life[END_REF][START_REF] Stevens | Gluten-free and regular foods: a cost comparison[END_REF]. Although effective in inducing clinical remission of CD, following a strict GFD may have a negative impact on lifestyle and quality of life [START_REF] Hallert | Perceptions of health-related quality of life of men and women living with coeliac disease[END_REF][START_REF] Hallert | Living with coeliac disease: controlled study of the burden of illness[END_REF][START_REF] Black | Impact of coeliac disease on dietary habits and quality of life[END_REF].

Elafin is a human serine protease inhibitor that has potent inhibitory capacity against various forms of elastases as well as proteinase-3 [START_REF] Ying | Kinetics of the inhibition of human leukocyte elastase by elafin, a 6kilodalton elastase-specific inhibitor from human skin[END_REF][START_REF] Ying | Kinetics of the inhibition of proteinase 3 by elafin[END_REF][START_REF] Williams | SLPI and elafin: one glove, many fingers[END_REF]. Elafin is expressed throughout the epithelium of the gastrointestinal tract and its expression and induction is decreased in patients with inflammatory bowel disease [START_REF] Schmid | Attenuated induction of epithelial and leukocyte serine antiproteases elafin and secretory leukocyte protease inhibitor in Crohn's disease[END_REF][START_REF] Eriksson | Real-time PCR quantification analysis of five mucosal transcripts in patients with Crohn's disease[END_REF][START_REF] Motta | Food-grade bacteria expressing elafin protect against inflammation and restore colon homeostasis[END_REF]. However, it is unknown whether elafin expression is altered and whether it plays a role in chronic inflammatory disorders of the proximal small intestine, such as CD.

Elafin has been identified as a substrate for the cross-linking activity of tissue transglutaminase (TG-2) [START_REF] Steinert | The proteins elafin, filaggrin, keratin intermediate filaments, loricrin, and small proline-rich proteins 1 and 2 are isodipeptide cross-linked components of the human epidermal cornified cell envelope[END_REF][START_REF] Baranger | Secretory leukocyte protease inhibitor (SLPI) is, like its homologue trappin-2 (pre-elafin), a transglutaminase substrate[END_REF]. The discovery that TG-2 plays an important role in CD by introducing negatively charged residues in gluten peptides through deamidation, thereby increasing binding affinity to HLA-DQ2/DQ8 molecules, is one of the recent milestones in CD pathogenesis [START_REF] Kristiansen | Tissue transglutaminase selectively modifies gliadin peptides that are recognized by gut-derived T cells in celiac disease[END_REF]. Given the importance of TG-2 to the pathogenesis of CD, its inhibition is an attractive therapeutic target. TG-2, however, is found systemically and has important functions in a number of other biological processes including wound healing, cell migration, cell death, and inflammation [START_REF] Park | Transglutaminase 2: a multi-functional protein in multiple subcellular compartments[END_REF]. Whether the inhibition of TG-2 is reversible and local to the small intestine are important considerations for a CD targeted therapy. The ability of elafin to inhibit deamidation of gliadin peptides by TG-2 has not yet been tested. The small intestinal expression profile of this immunomodulatory protease inhibitor is unknown in CD. Thus, we first investigated the expression of elafin in patients with active CD and one year after a GFD. Patients undergoing gastroduodenal endoscopy in whom CD was excluded, were included as controls. The potential interaction of elafin and human TG-2, an enzyme with an established role in CD pathogenesis, was tested using 33-mer peptide deamidation assays. Finally, the anti-inflammatory and barrier enhancing properties of elafin in the proximal small intestine were investigated in an animal model of glutensensitivity.

METHODS

Elafin expression in human small intestinal mucosa

Human small intestinal biopsies used in this study were randomly selected from a series of subjects participating in previous studies [START_REF] Sugai | Celiac disease serology in patients with different pretest probabilities: Is biopsy avoidable?[END_REF][START_REF] Sugai | Dynamics of celiac disease-specific serology after initiation of a gluten-free diet and use in the assessment of compliance with treatment[END_REF]. The baseline clinical characteristics of subjects are shown in Table 1. The CD diagnosis was based on the concomitant presence of histological damage in the first and second duodenal portions (Marsh IIIa or greater) and a positive CD serology (IgA anti-Transglutaminase 2; Inova Inc. San Diego; CA; USA). Histology was investigated in biopsy specimens of patients at the moment of the diagnosis (n=10), in the same patients after one year of a GFD (n=9) and in patients with dyspepsia, peptic ulcer, gastroesophageal reflux disease or IBS, where the diagnosis of CD was excluded (n=10).

Five-micrometer sections were deparaffinized and treated with a buffer solution for heatinduced epitope retrieval (pH 6.0). Slides were incubated overnight at 4°C with anti-elafin (Santa Cruz Biotechnology, Montrouge, France) and anti-cytokeratin 18 (CK18; Santa Cruz) antibodies. Anti-CK18 was used as a marker for epithelial cells. Slides were mounted and nuclei were stained with 4′,6′-diamidino-2-phenylindole (DAPI) Fluorescent mounting medium (Invitrogen, Burlington, ON, Canada) and analyzed on confocal microscope Zeiss LSM710 (Carl Zeiss, Toronto, ON, Canada). For relative quantification by immunofluorescence staining, four different fields of acquisitions for one patient were taken with the same microscope settings in a blinded fashion. We have converted images from mucosal epithelial marker (CK18) to a binary mask in order to obtain a final image representing only the specific staining of elafin in the mucosa. Elafin fluorescence intensity was then quantified in this image using ImageJ software (NIH, Bethesda, MD, USA) and was reported as arbitrary unit per surface of tissue. Each plots represent the mean fluorescence intensity of four different acquisition fields of the same patient. Data was represented as fold increase of signal intensity quantified in control patients.

Inhibition of deamidation of 33-mer peptide by elafin

The 33-mer peptide (25 μM, alpha2-gliadin, 33mer (aa 56-88) Zedira, Darmstadt, Germany, diluted in 50 mM phosphate buffer, pH 7.5) was incubated with 1 μM TG-2 (0.59 U/mg, purity > 90 %, Zedira, Darmstadt, Germany) at 37 °C in 100 mM Tris/HCl buffer, pH 7.6 with 10 mM CaCl 2 . The TG-2-catalyzed deamidation of 33-mer served as a control reaction in the assay. In the competitive reaction, 25, 50 and 100 μM elafin (human, recombinant, purity >90%, Sigma-Aldrich, Saint Louis, MO, USA) was mixed with the peptide before starting the enzymatic reaction. A negative control with insulin (human, recombinant, purity >98%, Sigma-Aldrich) and a positive control with tridegin (recombinant, purity >95%, Zedira) were prepared each in a 1:1 molar ratio with the 33-mer. The reaction was inactivated at different time points (0, 5, 15, 30, 60 min) by the addition of 25 mM iodoacetamide. All reactions were performed in triplicates. The analysis of the samples was performed using a liquid chromatography (LC) system consisting of Rheos Allegroquaternary pump, C18-column (Hypersil Gold, 100 × 1 mm, 1.9 μm) and XCalibur control software (Thermo Fisher Scientific Inc, San Jose, CA, USA). Samples were injected (10 μL) with a flow rate of 50 μL/min, 95 % water (+0.1 % v/v formic acid) as an initial value for 1 min followed by a linear gradient of ACN (+0.1 % v/v formic acid) over 19 min (95 -5 % v/v). The LC was directly connected to an LTQ XL linear quadrupole Ion Trap (Thermo Fisher Scientific Inc.) equipped with an electrospray ion source. Data were acquired by full MS. Given that deamidation yields in a mass increase of 1 Da only, the untreated and deamidated peptide overlap in the mass spectrum. Therefore the centroid mass determination was used for the quantification of deamidation (Eq. 1).

Eq. 1 where m i and I i are the masses and intensities of individual signals, respectively [START_REF] Zubarev | Approaches and limits for accurate mass characterization of large biomolecules[END_REF]. The total deamidation degree was determined by calculating the difference of centroid masses of TG-2-reacted and untreated peptide.

Animal model of gluten sensitivity

Eight-to 10-week-old male NOD AB° DQ8 (NOD/DQ8) transgenic mice were used for experiments [START_REF] Marietta | A new model for dermatitis herpetiformis that uses HLA-DQ8 transgenic NOD mice[END_REF]. Mice were weaned and maintained on a low-fat (4.4%), gluten-free diet, purchased from Harlan Laboratories and bred in a conventional, specific pathogen-free colony at McMaster University. All experiments were conducted with approval from the McMaster University Animal Care Committee.

Mice were orally sensitized with a peptic-tryptic digest of gliadin (PT-gliadin), prepared as described previously [START_REF] Thomas | Gliadin stimulation of murine macrophage inflammatory gene expression and intestinal permeability are MyD88-dependent: role of the innate immune response in Celiac disease[END_REF]. Mice were gavaged with 500 μg PT-gliadin plus 25 μg cholera toxin (Sigma-Aldrich) once per week for 3 weeks [START_REF] Galipeau | Sensitization to gliadin induces moderate enteropathy and insulitis in nonobese diabetic-DQ8 mice[END_REF]. Non-sensitized controls were gavaged with 25 μg cholera toxin only. Following sensitization, mice were challenged with gliadin (2 mg/mouse) dissolved in 0.02 M acetic acid by intragastric gavage once a week for two weeks.

Mucosal delivery of elafin

We chose a Lactococcus lactis (L. lactis) vector as mucosal delivery system for elafin, as this approach was extensively validated in previous mouse models of colitis [START_REF] Motta | Food-grade bacteria expressing elafin protect against inflammation and restore colon homeostasis[END_REF]. Briefly, an elafin-producing recombinant strain of L. lactis, was used as a bacterial vector to deliver elafin to the intestine. L lactis carrying the empty plasmid vector (Ll-WT) was used as wild type control [START_REF] Motta | Food-grade bacteria expressing elafin protect against inflammation and restore colon homeostasis[END_REF]. All bacteria were suspended in PBS containing 15% glycerol. Twentyfour hours following oral sensitization with PT-gliadin and cholera toxin, NOD/DQ8 mice were treated with Ll-WT, Ll-E (10 9 CFU) or PBS/glycerol by oral gavage, daily for 15 days. Mice received gliadin challenges (2 mg/mouse) on day 7 and 15 of L. lactis treatment.

Measurement of small intestinal permeability

Twenty-four hours following the final gliadin challenge, in vitro intestinal permeability was assessed by Ussing chamber technique as previously described (World Precision Instruments, Sarasota, FL, USA) [START_REF] Galipeau | Sensitization to gliadin induces moderate enteropathy and insulitis in nonobese diabetic-DQ8 mice[END_REF][START_REF] Natividad | Host responses to intestinal microbial antigens in glutensensitive mice[END_REF][START_REF] Verdu | Gliadin-dependent neuromuscular and epithelial secretory responses in gluten-sensitive HLA-DQ8 transgenic mice[END_REF]. Two sections of jejunum from each mouse were assessed. Tissue conductance (the passive permeability to ions) and mucosal-to-serosal flux of the paracellular probe 51 Cr-EDTA were used to assess barrier function and paracellular permeability as previously described [START_REF] Silva | Increased bacterial translocation in gluten-sensitive mice is independent of small intestinal paracellular permeability defect[END_REF]. 51 Cr-EDTA flux was calculated as the average over a 2-h period and expressed as %hot/cm 2 /h.

Evaluation of small intestinal inflammation

Cross-sections of the proximal small intestine were fixed in 10% buffered formalin, embedded in paraffin, and stained with H&E for histologic evaluation by light microscopy (Olympus, Richmond Hill, ON, Canada) as previously described [START_REF] Galipeau | Sensitization to gliadin induces moderate enteropathy and insulitis in nonobese diabetic-DQ8 mice[END_REF]. Paraffin sections were used to preserve tissue morphology and orientation. Immunostaining for CD3 + cells was performed on paraffin sections to detect the presence of intraepithelial lymphocytes (IELs) in sections of the proximal small intestine as described previously [START_REF] Verdu | Gliadin-dependent neuromuscular and epithelial secretory responses in gluten-sensitive HLA-DQ8 transgenic mice[END_REF][START_REF] Biagi | Intraepithelial lymphocytes in the villous tip: do they indicate potential coeliac disease?[END_REF]. Slides were viewed in a blinded fashion by light microscopy under 200X magnification. IELs per 20 enterocytes in five randomly chosen villus tips were counted according to the previously described methods and expressed as IEL/100 enterocytes [START_REF] Verdu | Gliadin-dependent neuromuscular and epithelial secretory responses in gluten-sensitive HLA-DQ8 transgenic mice[END_REF].

ZO-1 expression in small intestine

Staining for the tight junction protein zonula occludens-1 (ZO-1) was performed on jejunal sections. Sections were incubated for 2 h at room temperature with an anti-ZO-1 (primary) antibody (Invitrogen), washed and secondary antibody was applied for 2 h at room temperature. Slides were then mounted and coverslipped with Prolong Gold Anti-fade with 4′6-diamidino-2-phenylindole (DAPI; Invitrogen) and staining assessed in a blinded fashion using a fluorescent microscope (Olympus). A total of 10 images were obtained for each slide and the mean fluorescence intensity (MFI) of five identically sized regions of interest (ROI) was determined for each image using Image J Software (NIH). Each ROI was centered on the epithelial border. The MFI for the negatively stained sections was then subtracted from that of positively stained sections.

Trypsin-like and elastase-like activities in small intestine

A section of the jejunum from non-sensitized NOD/DQ8 mice (n=5) was collected using a 4 mm biopsy punch and transferred into a 48 well plate (BD Bioscience, Mississauga ON, Canada) containing RPMI 1640 enriched with 10% FBS, 100 U/ml penicillin, 100 U/ml streptomysin, and 2 mM L-glutamine. Wells were supplemented with 100 μg/ml of one the following gliadin peptides: 19-mer (p31-49), 20-mer (p120-139), 33-mer (p56-89; ProImmune, Sarasota, FL, USA). Media alone was used for negative controls. Plates were incubated for 3 hours at 37°C with 95% O 2 and 5% CO 2 . Following incubation, the tissue section was removed and frozen at -80°C. Supernatants were collected and stored at -80°C. Trypsin and elastase-like activity was measured in organ culture supernatant, biopsies, as well as intestinal samples from non-sensitized and gliadin-sensitized mice as previously described [START_REF] Motta | Modifying the protease, antiprotease pattern by elafin overexpression protects mice from colitis[END_REF].

Statistical analysis

Statistical analysis was conducted using GraphPad Prism software (Version 4, 2004, CA, USA). Statistical significance was determined by one-way ANOVA followed by Bonferroni's multiple comparison tests. Significance was reported for p-values <0.05 at a 95% confidence level. All data are presented as mean ± standard error of mean (SEM).

RESULTS

Elafin expression is reduced in the small intestine of patients with active celiac disease

We tested whether elafin expression is altered in small intestinal biopsies of patients with CD. Biopsies were collected from the duodenum and jejunum of patients with active CD (on a gluten-containing diet), treated CD patients (on a GFD for at least one year), and control patients (gastrointestinal complaints in which CD has been excluded). Biopsies were then stained for elafin expression by immunofluorescence. Elafin expression in the epithelium, as determined by co-staining with CK18, was lower in patients with active CD compared to control patients (Figure 1A). This reduction was confirmed by determining the MFI of elafin expression in areas of tissue staining with the CK18 marker. Elafin intensity was significantly lower in active CD patients compared to control patients (Figure 1B). Elafin levels in treated CD were intermediate between untreated CD and controls but were not statistically different from either.

Inhibition of deamidation of 33-mer peptide in vitro

Elafin has been identified as a substrate for TG-2 [START_REF] Baranger | Secretory leukocyte protease inhibitor (SLPI) is, like its homologue trappin-2 (pre-elafin), a transglutaminase substrate[END_REF]. Using a competitive enzymatic assay, we therefore tested elafin's inhibiting effect on the deamidation of 33-mer gliadin peptide, which served as a model immunogenic substrate. The addition of elafin significantly slowed the kinetics of the deamidation of the 33-mer peptide to its more immunogenic form (Figure 2). The inhibiting effect of elafin was found to be dose and time-dependent, but relatively modest compared to tridegin, the positive control [START_REF] Finney | Tridegin, a new peptidic inhibitor of factor XIIIa, from the blood-sucking leech Haementeria ghilianii[END_REF]. When used at a concentration which was 4-fold higher than tridegin, the deamidation of 33-mer was approximately 50% less effective after 30 min incubation. As expected, the negative protein control, insulin, did not show any inhibition of TG-2 activity (Figure 2).

Ll-elafin reduces gliadin-induced IEL infiltration in gliadin-sensitized NOD/DQ8 mice

We then tested the therapeutic potential of elafin in gliadin-sensitized NOD/DQ8 mice, a mouse model of gluten sensitivity, using L. lactis to deliver elafin (Ll-E) to the small intestine. In agreement with previous findings, [START_REF] Pinier | The copolymer P(HEMA-co-SS) binds gluten and reduces immune response in gluten-sensitized mice and human tissues[END_REF][START_REF] Galipeau | Sensitization to gliadin induces moderate enteropathy and insulitis in nonobese diabetic-DQ8 mice[END_REF] sensitization and acute gliadin challenge increased IELs in the jejunum (Figure 3). Ll-E treatment normalized IEL counts, whereas Ll-WT had no effect (Figure 3).

Ll-elafin reduces intestinal barrier dysfunction and preserves zonula occludens-1 distribution following gliadin challenge in sensitized NOD/DQ8 mice

Gliadin-sensitization and acute gliadin challenge increased small intestinal paracellular permeability as indicated by in vitro 51 Cr-EDTA flux in NOD/DQ8 mice (Figure 4A). Gliadin challenge in sensitized mice also increased tissue conductance (Figure 4B). Sensitized mice treated with Ll-E had lower 51 Cr-EDTA flux and tissue conductance compared to sensitized animals receiving either PBS-glycerol or Ll-WT (Figure 4A,B).

We investigated a previously unexplored effect of elafin on ZO-1 distribution in the small intestine of gluten-sensitive mice. Staining for ZO-1 was decreased in gliadin sensitized mice compared to controls. The expression of ZO-1 was patchy with most of the expression being limited to the villus base and crypts. The distribution of ZO-1 normalized in sensitized mice treated with Ll-E (Figure 4C). We confirmed this reduction in ZO-1 staining by determining the MFI (Figure 4D). Sensitized animals treated with PBS-glycerol had significantly lower ZO-1 MFI than non-sensitized controls. Treatment of sensitized animals with Ll-E normalized ZO-1 MFI (Figure 4D).

Gliadin challenge does not affect small intestinal trypsin-like or elastase-like proteolytic activity

To investigate potential mechanisms of action of elafin, we measured trypsin-and elastaselike activity in small intestinal tissues from sensitized and non-sensitized NOD/DQ8 mice treated. The levels of trypsin-like proteases were similar in sensitized and non-sensitized mice, and were not affected by elafin treatment (Figure 5A). Elastase-like activity was undetectable (data not shown). Proteolytic activity was also tested small intestinal tissue from non-sensitized and sensitized mice stimulated in vitro with the gliadin peptides 33-mer, 20-mer and 19-mer. Elastase-like activity was undetectable (data not shown) and trypsinlike activity was not significantly affected in either the small intestinal biopsies or culture supernatant following in vitro stimulation with the gliadin fragments (Figure 5B,C).

DISCUSSION

CD is one of the most common gastrointestinal diseases, affecting about 1% of the Caucasian population, and its incidence has substantially risen in the last two decades [START_REF] Rubio-Tapia | The prevalence of celiac disease in the United States[END_REF][START_REF] Ludvigsson | Increasing incidence of celiac disease in a North American population[END_REF]. The only treatment is a life-long adherence to a GFD, which is costly and difficult to follow, leading to high non-adherence rates [START_REF] Hall | Systematic review: adherence to a gluten-free diet in adult patients with coeliac disease[END_REF]. In CD, gluten-derived peptides are recognized by HLA-DQ2 or HLA-DQ8 heterodimers on antigen-presenting cells, which trigger a pro-inflammatory gluten-specific T cell response [START_REF] Jabri | Tissue-mediated control of immunopathology in coeliac disease[END_REF]. Through the process of deamidation, TG-2 activity plays an important role by introducing negatively charged residues on gluten-peptides. This enhances recognition of these gluten-peptides by the HLA-DQ2 or -DQ8 molecules, which are efficiently recognized by T cells [START_REF] Jabri | Tissue-mediated control of immunopathology in coeliac disease[END_REF][START_REF] Klöck | Role of transglutaminase 2 in celiac disease pathogenesis[END_REF]. However, the factors that drive TG-2 activation in patients with CD are not completely understood [START_REF] Klöck | Role of transglutaminase 2 in celiac disease pathogenesis[END_REF][START_REF] Dafik | Activation and inhibition of transglutaminase 2 in mice[END_REF].

Elafin is a potent endogenous human serine protease inhibitor, and its levels have been found to be reduced in the colon of patients with IBD [START_REF] Schmid | Attenuated induction of epithelial and leukocyte serine antiproteases elafin and secretory leukocyte protease inhibitor in Crohn's disease[END_REF][START_REF] Motta | Food-grade bacteria expressing elafin protect against inflammation and restore colon homeostasis[END_REF]. In this study we show that patients with active CD also have reduced elafin expression within the small intestinal epithelium compared to patients in whom CD was excluded. After 1 year of GFD, elafin expression was somewhat higher than in active CD patients, but was not statistically different from non-celiac controls. The reduced elafin expression in patients with active CD may reflect the presence of enteropathy and its loss may contribute to enhanced inflammation in CD. In fact, expression of other enzymes in the small intestine, such as cytochrome P450, CYP3A, was found to correlate with the degree of enteropathy, raising the possibility of using these markers as an indication of villous health [START_REF] Johnson | Enterocytic CYP3A4 in a paediatric population: developmental changes and the effect of coeliac disease and cystic fibrosis[END_REF][START_REF] Lang | Decreased intestinal CYP3A in celiac disease: reversal after successful gluten-free diet: a potential source of interindividual variability in first-pass drug metabolism[END_REF]. Reduced expression of elafin in patients with active CD may reflect activity of inflammation or mucosal damage in the small intestine, similar to what has been described in the colon of patients with IBD [START_REF] Schmid | Attenuated induction of epithelial and leukocyte serine antiproteases elafin and secretory leukocyte protease inhibitor in Crohn's disease[END_REF][START_REF] Eriksson | Real-time PCR quantification analysis of five mucosal transcripts in patients with Crohn's disease[END_REF][START_REF] Motta | Food-grade bacteria expressing elafin protect against inflammation and restore colon homeostasis[END_REF].

We then hypothesized that elafin may play a role in gluten-related disorders and tested the interaction of elafin with human TG-2, the enzyme that catalyzes the deamidation of gluten peptides enhancing T-cell recognition [START_REF] Jabri | Tissue-mediated control of immunopathology in coeliac disease[END_REF]. Indeed, elafin has recently been identified as a substrate for the cross-linking activity of tissue transglutaminase [START_REF] Baranger | Secretory leukocyte protease inhibitor (SLPI) is, like its homologue trappin-2 (pre-elafin), a transglutaminase substrate[END_REF][START_REF] Zani | SLPI and trappin-2 as therapeutic agents to target airway serine proteases in inflammatory lung diseases: current and future directions[END_REF][START_REF] Guyot | Elafin and its precursor trappin-2 still inhibit neutrophil serine proteinases when they are covalently bound to extracellular matrix proteins by tissue transglutaminase[END_REF]. Our in vitro results demonstrate that the addition of elafin inhibited the deamidation of the digestionresistant 33-mer gliadin peptide, which is one of the potential triggers of the adaptive immune response in CD [START_REF] Shan | Structural basis for gluten intolerance in celiac sprue[END_REF]. The comparison of elafin to tridegin, a known transglutaminase inhibitor, revealed that elafin moderately inhibits TG-2. These data support that elafin interacts with TG-2, raising the possibility that in addition to correlating with mucosal damage, a reduction of elafin in active CD could play a pathogenic role. TG-2 plays important roles in tissue homeostasis and wound healing [START_REF] Park | Transglutaminase 2: a multi-functional protein in multiple subcellular compartments[END_REF][START_REF] Wang | TG2, a novel extracellular protein with multiple functions[END_REF]. Thus, the moderate inhibition and small intestinal delivery of elafin could constitute an advantage over systemic, complete and irreversible inhibition, particularly when combined with other potential beneficial effects of elafin. Our in vitro results point at an exciting novel role and specific mechanism of action of elafin in CD that should be further explored.

Elafin has been shown to have anti-inflammatory and barrier modulating properties in models of respiratory, cardiovascular, and colonic inflammation [START_REF] Motta | Food-grade bacteria expressing elafin protect against inflammation and restore colon homeostasis[END_REF][START_REF] Motta | Modifying the protease, antiprotease pattern by elafin overexpression protects mice from colitis[END_REF][START_REF] Zani | SLPI and trappin-2 as therapeutic agents to target airway serine proteases in inflammatory lung diseases: current and future directions[END_REF][START_REF] Alam | Role of the endogenous elastase inhibitor, elafin, in cardiovascular injury: from epithelium to endothelium[END_REF]. We explored whether elafin administration affected these parameters in the small intestine using a model of gluten sensitivity. We employed a validated delivery method that exploits a food grade strain of L. lactis, to ensure administration of elafin to the gastrointestinal tract in mice [START_REF] Motta | Food-grade bacteria expressing elafin protect against inflammation and restore colon homeostasis[END_REF][START_REF] Motta | Modifying the protease, antiprotease pattern by elafin overexpression protects mice from colitis[END_REF]. Although the quantification of elafin delivered to the intestine was not determined, using GFP-tagged Ll-WT and Ll-E, we have previously demonstrated effective delivery of L. lactis and elafin to the gastrointestinal tract. Elafin was found to cluster around L. lactis, but was also detected at sites remotes from the GFP-tagged L. lactis, suggesting that elafin is secreted in the mucosa in situ [START_REF] Motta | Food-grade bacteria expressing elafin protect against inflammation and restore colon homeostasis[END_REF]. We found that Ll-E reduced intraepithelial lymphocytosis and restored barrier function in gliadin sensitized mice. We showed that treatment with Ll-E normalized 51 Cr-EDTA flux and conductance in the small intestine suggesting that Ll-E protects the paracellular pathway in the small intestine. Furthermore, increased permeability after gliadin challenge was accompanied by a reduction in ZO-1 protein expression and Ll-E therapy preserved ZO-1 protein distribution in sensitized mice. Overall, our results suggest that there are beneficial effects of Ll-E in this model of gluten-induced small intestinal dysfunction that involve immunomodulatory effects and regulation of barrier and tight junction function. This is consistent with previous reports on the effect of elafin in the colon using animal models of colitis [START_REF] Williams | SLPI and elafin: one glove, many fingers[END_REF][START_REF] Motta | Food-grade bacteria expressing elafin protect against inflammation and restore colon homeostasis[END_REF][START_REF] Motta | Modifying the protease, antiprotease pattern by elafin overexpression protects mice from colitis[END_REF]. Proteolytic imbalances have been described in patients with IBS, IBD, and in animal models of experimental colitis [START_REF] Motta | Food-grade bacteria expressing elafin protect against inflammation and restore colon homeostasis[END_REF][START_REF] Motta | Modifying the protease, antiprotease pattern by elafin overexpression protects mice from colitis[END_REF]. However, we found no differences in trypsin or elastase-like activity between gliadin sensitized and control mice. In addition, treatment with Ll-E had no effect on small intestinal protease levels. Our findings highlight a difference in the mechanisms of action of elafin in gluten intolerance compared to colitis, which does not involve correction of elastolytic or trypsin activity imbalance in the small intestine.

While the NOD/DQ8 mouse model does not develop severe atrophy that is characteristic of classical CD, sensitization and challenge induces moderate inflammation [START_REF] Galipeau | Sensitization to gliadin induces moderate enteropathy and insulitis in nonobese diabetic-DQ8 mice[END_REF]. It will be important to test the effect of elafin, as well as other potential therapies for CD in a variety of models of gluten sensitivity that express different pathological characteristics and underlying mechanisms, such as IL-15 driven models of CD [START_REF] Depaolo | Co-adjuvant effects of retinoic acid and IL-15 induce inflammatory immunity to dietary antigens[END_REF].

In conclusion, the reduced small intestinal elafin expression in patients with active CD coupled to the finding that elafin may compete with gliadin peptides and reduce their deamidation, raise the possibility that loss of this protease inhibitor contributes to CD pathogenesis. The results in the animal model of gluten sensitivity suggest mucosal delivery of elafin restores small intestinal barrier function and inflammation, likely through preservation of tight junction function and anti-inflammatory effects in the small intestine. Due to the combination of specific and non-specific beneficial effects of elafin in our study, we propose its replacement could have potential as adjuvant therapy in gluten-related disorders.

What is current knowledge?

• The only treatment for celiac disease (CD) is a life-long adherence to a glutenfree diet (GFD)

• A strict GFD is costly and difficult to follow, leading to high non-adherence rates and increased co-morbidities, highlighting the need for alternative treatments.

• Elafin is an anti-inflammatory human serine protease inhibitor that has potent inhibitory activity against murine neutrophil elastase and proteinase-3

• Elafin is decreased in IBD patients and prevents inflammation in murine models of experimental colitis

• The role of elafin in gluten-related disorders is unknown.

What is new here?

• Elafin expression is significantly decreased in patients with active CD, compared to patients without CD.

• In vitro elafin reduces the deamidation of an immunogenic gliadin peptide, an important step in the autoimmune process of CD.

• In an animal model of gluten sensitivity, elafin delivery at the mucosal level by a food grade L. lactis vector prevented gluten-induced barrier dysfunction and inflammation.

• The identification of a molecule (elafin) that is altered in the small intestine of active CD patients and that reduces deamidation of gliadin peptide, and that has barrier-enhancing effects in the small intestine, will help increase understanding of the pathophysiology of CD and promote development of new supportive treatments for gluten-related disorders.

Figure 1 .

 1 Figure 1. Decreased elafin expression in patients with active celiac disease (CD). Biopsies were obtained from patients in whom CD was excluded (controls), patients with treated CD (1 year gluten-free diet (GFD); remission) and patients with active CD and were stained for elafin (red) expression. (A) Representative immunofluorescence figures are shown. Nuclei labelled with 4′6-diamidino-2-phenylindole (DAPI; blue). (B) Quantification of fluorescence intensity, expressed as a fold increase to control patients. Each dot represents the mean fluorescent value of 4 different areas of one patient and the line represents the mean of each group. *p<0.05.

Figure 2 .

 2 Figure 2.Deamidation of 33-mer in the competitive reactions. 33-mer peptide (25 μM) was incubated with tissue transglutaminase-2 (TG-2) (1 μM) that served as a control reaction. For the competitive reactions, 25 (x1) or, 50 (x2), or 100 μM (x4) elafin was added. Tridegin and insulin were used as positive and negative controls, respectively. The degree of deamidation was analyzed by liquid chromatography-mass spectrometry (LC-MS). Data are represented as mean ± SEM (n=3). *p<0.05 vs control reaction (no elafin), all data points of the enzymatic reaction with 100 μM (x 4) elafin and tridegin are statistically significant (p<0.02) vs. control reaction (no elafin).

Figure 3 .

 3 Figure 3. L. lactis expressing elafin(Ll-E) treatment attenuates gliadin-induced intraepithelial lymphocytosis in sensitized NOD/DQ8 mice. (A) CD3 + -stained sections of the proximal small intestine. Original magnification x20. Black arrows indicate intraepithelial lymphocytes (IELs). (B) Quantification of CD3 + cells in villi tips, expressed as IEL per 100 enterocytes (n=8-12 per group). White bars represent non-sensitized animals, grey bars represent sensitized animals. Data are represented as mean ± SEM. **p<0.01, ***p<0.001. Non-sensitized (NS); Lactococcus lactis wild type (Ll-WT); L. lactis expressing elafin (Ll-E).

Figure 4 .

 4 Figure 4. L. lactis expressing elafin(Ll-E) therapy protects NOD/DQ8 mice from gliadin-induced increases in paracellular permeability and preserves zonula occludens-1 (ZO-1) distribution. Sections of small intestine were mounted in Ussing chambers and (A) 51 Cr-EDTA flux (% Hot Sample/h/cm 2 ; n=8-11 per group) and (B) tissue conductance (mS/cm 2 ; n=4-7 per group) was measured 24 h after the final gliadin challenge. (C) Sections of the proximal small intestine were stained for ZO-1 (green) expression. Nuclei labelled with 4′6diamidino-2-phenylindole (DAPI; blue). Original magnification x20. White arrows indicate strong immunofluorescence at the apical junctional complex; arrowheads indicate patchy expression. (D) Mean fluorescence intensity (MFI) of ZO-1 staining in proximal small intestinal sections was determined (n=3-4 per group). MFI was corrected for background fluorescence. White bars represent non-sensitized animals, grey bars represent sensitized animals. Data are represented as mean ± SEM. *p<0.05, **p<0.01, ***p<0.001. Lactococcus lactis wild type (Ll-WT); L. lactis expressing elafin (Ll-E).

Figure 5 .

 5 Figure 5. Gliadin sensitization and challenge do not alter trypsin-like activity in NOD/DQ8 mice in vivo or in vitro. (A) Sections of proximal small intestine were collected 24 h after final gliadin challenge. Levels of trypsin-like proteases were quantified in tissue homogenates and expressed as U/mg protein (n=8-11 per group). (B, C) Proximal small intestinal biopsies were collected from sensitized and non-sensitized NOD-DQ8 mice and stimulated for 3 h in vitro with gliadin peptides. Trypsin-like activity was quantified in the (B) culture supernatant and (C) biopsies and expressed as U/mL and U/mg protein respectively. White bars represent non-sensitized animals, grey bars represent sensitized animals. Data are represented as mean ± SEM. Lactococcus lactis wild type (Ll-WT); L. lactis expressing elafin (Ll-E).

Am J Gastroenterol. Author manuscript; available in PMC 2015 May 01.

Acknowledgments

Heather J Galipeau and Michelle Wiepjes contributed equally to the manuscript. We would like to acknowledge the technical help of Xianxi Huang and Yikang Deng with molecular analysis and of Jean-Jacques Gratadoux for the preparation of bacterial cultures.

FUNDING

This work was funded by a CIHR grant to E.F. Verdu (MOP-123282) and by JA Campbell Young Investigator Awards from the Canadian Celiac Association to M Wiepjes and H Galipeau. E.F. Verdu holds a Canada Research Chair. J.C. Leroux acknowledges financial support from the Swiss National Science Foundation (310030_135732). The elafin project of N. Vergnolle is funded by the Agence Nationale de la Recherche (Elaprob-IBD, Blanc SVSE1-2012), and N. Vergnolle is funded by the European Research Council (ERC-2012-StG_20111109). JP Motta was funded by the Inserm and the Region Midi-Pyrenees. P. Langella and L. Bermudez-Humaran are also involved in the elafin project of N. Vergnolle funded by the Agence Nationale de la Recherche (Elaprob-IBD, Blanc SVSE1-2012). R. Martin is funded by the French FUI (Fond Unique Interministériel; FUI: n°F1010012D), the FEDER (Fonds Européen de Développement Régional; Bourgogne: 34606), the Burgundy Region, the Conseil Général 21 and the Grand Dijon. JA Murray was supported in part by DK71003 and the Mayo Foundation.


domain: spi info

text:
O R Merad Boudia
email: om_meradboudia@mail.univ-tlemcen.dz

M Feham
email: m_feham@mail.univ-tlemcen.dz

S M Senouci

Smart Meter HE Homomorphic Encryption ECC Elliptic Curve Cryptography ECEG Elliptic Curve El Gamal ECDSA Elliptic Curve Digital Signature Algorithm MRES Multi-Recipient Encryption Scheme HAN Home Area Network NAN Neighborhood Area Network

Keywords: Smart grid, privacy-preserving, elliptic curve cryptography, data aggregation, homomorphic encryption

In Smart Grid, data aggregation is considered as an essential paradigm in assessing information about current energy usage. To achieve the privacy-preserving goal, several homomorphic-based solutions have been proposed. However, these solutions either consider one-dimensional information or use costly pairing computation in order to ensure source authentication. In fact, smart grid data is likely to be multidimensional (e.g. time, purpose, etc.) for more accurate control. In addition, the aggregation node in smart grid needs to verify data that come from several smart meters in a residential area; hence, the verification must be cost-efficient. In this paper, we propose a scheme that considers multidimensional aggregation with privacy preserving and an efficient verification of smart grid data. The proposal is based on elliptic curve cryptography along with homomorphic encryption and without pairings. The performance analysis shows the efficiency of the scheme for smart grid communications in comparison to existing schemes. For instance, we show that, when an aggregator node is responsible of 600 smart meters, it spends approximately 14s to verify the data in pairing-based schemes, while only 0.3s is needed for verification within the proposed scheme.

V

A large integer used in Enc.

E

A standard elliptic curve p

The prime that defines the field F p of E G

The base point of E n

The order of E H A secure hash function x(G)

The x coordinate of curve point G I. INTRODUCTION ECENTLY, the Smart Grid (SG) has been proposed as the next-generation approach to making more efficient and more reliable energy service. In fact, the smart grid makes possible to learn about (and respond to) changing electricity demand in real time, which is extensively desirable with the super-increasing numbers of electronic devices and technological capabilities in homes and businesses (electric vehicles, data centers, etc.). Consequently, the inherent problems occurred in traditional grids such as the lack of load balancing, smart consumption, and dynamic pricing can be solved [START_REF] Heydt | The next generation of power distribution systems[END_REF]. A conceptual smart grid model from NIST is presented in Fig. 1. The SG consists of seven domains: Transmission, Distribution, Operations, Generation, Markets, Customer, and Service Provider. One of the most important components in SG is the Smart Meter (SM) in the customer domain, which is responsible for recording the electricity use and sending the information to the utility company [START_REF]NIST Framework and Roadmap for Smart Grid Interoperability Standards[END_REF]. In order to improve the efficiency and reliability, the SG considers two-way com-

Elliptic Curve Based Secure Multidimensional Aggregation for Smart Grid Communications

Omar Rafik Merad Boudia, Sidi Mohammed Senouci, Member, IEEE, and Mohammed Feham R munication between the utility company and its customers, which improves sustainability and security as well [START_REF] Tan | Survey of Security Advances in Smart Grid: A Data Driven Approach[END_REF]. For instance, customers can see, using SM, their electricity use on a real-time basis. As a result, they can reduce their use during peak periods when it is more expensive, which in one hand saves money and in other hand decreases the pressure on the central power grid. In smart grid, data aggregation is an essential paradigm to efficiently manage the energy supply. In fact, for billing, the Control Center (CC) at the operations domain needs individual data that are collected over long intervals (e.g. a week or a month). However, the CC requires data that are collected much more frequently (e.g. every 10 min) for monitoring and control. So, the huge amount of realtime data, in this case, can be aggregated in the network before being processed and used [START_REF] Ma | Smart grid communication: Its challenges and opportunities[END_REF]. Consequently, by reducing the traffic, data aggregation can improve the network's efficiency.

The frequent real-time data collection from SM makes data aggregation risky. Indeed, on one hand, the individual data that are aggregated contains sensitive information about customers (e.g. habits and lifestyles), and on the other hand, the data are transmitted through public accessible communication channels. Consequently, the privacy preserving is crucial in order to prevent the disclosure of sensitive information to adversaries, thus avoiding the profiling of customer's personal behavior. Also, the attacks against data integrity can severely impact consistency of the smart grid. In fact, false data injection or alteration could directly decrease the reliability and the quality of the power grid and cause financial impacts as well as annoyance on customers [START_REF] Ruilong | False Data Injection on State Estimation in Power Systems -Attacks Impacts and Defense: A Survey[END_REF]. Therefore, ensuring data integrity and source authentication is essential for smart grid networks.

In order to guarantee the user privacy, the untrustworthy entities, including CC and relay nodes, should not be able to access the sensitive information. For that purpose, Homomorphic Encryption (HE) techniques are considered [START_REF] Fontaine | A survey of homomorphic encryption for nonspecialists[END_REF]. HE enables direct calculations on encrypted data. In other words, relay nodes perform the aggregation function directly on received ciphertexts. This enables the CC to compute the total consumption value without compromising the privacy of individual households. Existing solutions either consider onedimensional information or conduct to a considerable charge in terms of communication and computation. In fact, the CC can utilize other information in addition to the amount of electricity use (e.g. time, purpose, etc.) for more accurate control, so the data in this case should be multidimensional. The challenge here is to aggregate the values in such way that each data type remains private while at the same time the CC only processes the corresponding aggregates.

Furthermore, pairing-based schemes have to work in a running environment with parameters of 1024 bits so as to offer 80 bits security level [START_REF] Cao | On the Disadvantages of Pairing-based Cryptography[END_REF]. Indeed, before performing aggregation, the relay node needs to verify all received data, and given the traffic that traverses that node, the costly pairing operation can severely impact on the reliability of the network, even if batch verification is considered. Elliptic Curve Cryptography (ECC) provides the same level of security with smaller working parameters, namely 160 bits [START_REF] Cao | On the Disadvantages of Pairing-based Cryptography[END_REF]. In this paper, we propose a scheme that considers multidimensional data aggregation with efficient security algorithms for smart grid. Summary of our contributions in this research are:  First, we employ MRES, a Multi-Recipient Encryption Scheme to secure multidimensional data. Recall that the multidimensional data allow CC to use other information than electricity use for more accurate control. The encryption scheme considered is ECEG (Elliptic Curve El-Gamal) [START_REF] Mykletun | Public Key Based Cryptoschemes for Data Concealment in Wireless Sensor Networks[END_REF] for its efficiency in terms of computation and communication. In addition, a reference technique is introduced to overcome the ECEG issues,  Second, we adopt ECDSA (Elliptic Curve Digital Signature Algorithm) [START_REF] Johnson | The elliptic curve digital signature algorithm (ECDSA)[END_REF] with batch verification to allow intermediate nodes to efficiently verify data integrity and authenticate the senders,  Finally, the analysis and performance evaluation show that compared with existing secure aggregation schemes for SG communications, the scheme significantly reduces the computation cost and communication overhead.

The rest of this paper is organized as follows. In Section II, we review related work in the area. Section III presents the overview and recalls the foundation works of the proposed scheme. We describe the details of this latter in Section IV. The security analysis and performance evaluation are given in Sections V and VI, respectively. Finally, we draw the conclusions in Section VII.

II. RELATED WORK

A number of works have been developed to secure aggregation in SG. In [START_REF] Li | Secure information aggregation for smart grids using homomorphic encryption[END_REF], a spanning tree rooting at the collector device is built to cover all of the SMs. Aggregation is then performed in a distributed manner in accordance to the aggregation tree. The one-dimensional data are encrypted and aggregated using the Paillier cryptosystem [START_REF] Paillier | Public-key cryptosystems based on composite degree residuosity classes[END_REF], so that inputs and intermediate results are not revealed to SMs on the aggregation path. The same cryptosystem is used [START_REF] Li | EPPDR: An efficient privacy-preserving demand response scheme with adaptive key evolution in smart grid[END_REF], an Efficient Privacy-Preserving Demand Response (EPPDR) in which an adaptive key evolution technique is used to ensure the users' session keys to be forwarded securely. In [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF], Lu et al. propose EPPA, an Efficient and Privacy-Preserving Aggregation. EPPA uses the homomorphic Paillier cryptosystem to achieve privacy-preserving data aggregation. The authors employ a super-increasing sequence to allow multidimensional aggregation. The authors also use a bilinear maps based signature and consider batch verification at aggregator level for efficiency purpose. In [START_REF] Fan | Privacy-enhanced data aggregation scheme against internal attackers in smart grid[END_REF], the authors propose a privacy enhanced data aggregation. They consider blinding factors to create blinded one-dimensional data in order to prevent internal attackers from learning the electricity consumption of users. Like EPPA, the authors consider batch verification from bilinear maps. Fu et al. [START_REF] Fu | A robust and privacy-preserving aggregation scheme for secure smart grid communications in digital communities[END_REF] propose a fault-tolerance SG communication model, in which the contributed members can be accurately determined to avoid random errors. The authors utilize El-Gamal encryption to achieve privacy-preserving data aggregation and employ a submission information list in order to verify and recover the data. The authors also use a pairing-based signature with corresponding batch verification.

In the aforesaid schemes, the authors either consider onedimensional information or use costly pairing computation in order to verify the data. In addition, most of them mainly depend on Paillier's HE, which is of high computational complexity. In fact, two exponentiation operations in group Z n² are needed to be performed for each smart meter and the size of ciphertext is 2|N| bits, where N = pq, p and q should be at least 1024 bits. To overcome these drawbacks, we introduce in this paper an ECC-based secure multidimensional aggregation.

III. PRELIMINARIES

In this section, we first briefly introduce some concepts employed in our proposal, and then we formalize the network model, security model, and identify the design goals.

A. Elliptic Curve Cryptography

First introduced in [START_REF] Miller | Use of Elliptic Curves in Cryptography[END_REF], ECC becomes an attractive area of research in the last twenty years. The major benefits of using ECC are the highest strength-per-bit provided and the smallest key size. The security of ECC is based directly on the intractability of ECDLP (the Elliptic Curve Discrete Logarithm Problem). ECC is very useful for wireless communications and low power devices [START_REF] Rafik | The impact of ECC's scalar multiplication on wireless sensor networks[END_REF]. In fact, compared with traditional cryptosystem like RSA or mod p systems, ECC provides the same level of security with reduced key size. For an elliptic curve over a 160-bit field currently provides the same level of security as a 1024-bit RSA modulus or Diffie-Hellman prime. The difference becomes even more dramatic as the desired security level increases. In this paper, we use ECEG. More specifically, we use the elliptic curve analog of the Multi-Recipient El-Gamal Encryption Scheme (MRES) [START_REF] Bellare | Multirecipient encryption schemes: How to save on bandwidth and computation without sacrificing security[END_REF] in which the sender re-uses the random coin to encrypt different plaintexts under different public keys. MRES approximately halves the computational cost (number of exponentiations) for encryption as compared to the naive method.

MRES is described as follow: Suppose receiver i has secret key X i ∈ Z q and public key g Xi , the naive El-Gamal encryption is the following: Pick R 1 ,..., R n independently at random from q and let C i = (g Ri , g XiRi . M i ) for 1 ≤ i ≤ n. Instead, the authors suggest that one pick just one R random from q and set C i = (g R , g XiR . M i ) for 1 ≤ i ≤ n. In our proposal, we use the Elliptic Curve analog of MRES.

In addition, we use the ECDSA [START_REF] Johnson | The elliptic curve digital signature algorithm (ECDSA)[END_REF]. The corresponding algorithm is described as follow:

The ECDSA public parameters include an elliptic curve E over F q , a base point G of large prime order n in E(F q ) and a one way hash function H.

 Key-pair generation: Generate randomly the private key d from [1, n-1] and compute the public key Q = dG.

 Signature generation: Compute s = k -1 (H(M)+ dr) mod n, produce the signature S = (r, s), where M is the message, and r = x(kG) mod n, x(kG) is the x-coordinate of kG.

 Signature verification: Compute R = uG + vQ, where u = H(M)w mod n, v = rw mod n, and w = s -1 mod n. The signature is accepted if and only if x(R)= r mod n.

B. Homomorphic Encryption

This property is a feature that can be applied to certain cryptosystems and allows calculations on ciphertexts, which have the same effect as performing these calculations on the underlying plaintext data [START_REF] Fontaine | A survey of homomorphic encryption for nonspecialists[END_REF]. An encryption algorithm is accepted to be homomorphic if and only if the following equation holds:

D (E(x) ∆ E(y)) = D (E(x ∆ y))
The operation ∆ can support either addition or multiplication or both; it depends on the features of the encryption scheme. The HE that supports any function on ciphertexts is known as Fully Homomorphic Encryption (FHE). In [START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF], the Gentry's work is the first theoretical representation of FHE based on ideal lattices. It is promising, but the time complexity of its algorithms is still too high for practical use (huge key size and heavy computations). The other class of HE is Partially Homomorphic Encryption (PHE), which includes encryption schemes that have homomorphic property with respect to one operation. The authors of [START_REF] Mykletun | Public Key Based Cryptoschemes for Data Concealment in Wireless Sensor Networks[END_REF] presented several PHE. Their results showed that ECEG is the most promising scheme in terms of efficiency.

Castellucia et al's symmetric encryption

For the CC's response, we employ a secure symmetric encryption [START_REF] Castelluccia | Efficient and provably secure aggregation of encrypted data in wireless sensor networks[END_REF]. In order to generate the keys required for encrypting message responses, we use a Key Derivation Function (KDF). More specifically, we consider the secure KDF that uses Pseudo Random Function (HMAC) recommended by NIST, namely NIST SP800-108 HKDF (HMACbased KDF) [START_REF] Chen | Recommendation for Key Derivation Using Pseudorandom Functions[END_REF]. This is crucial for the security of the encryption as stated in [START_REF] Castelluccia | Efficient and provably secure aggregation of encrypted data in wireless sensor networks[END_REF] and used in [START_REF] Boudia | A novel secure aggregation scheme for wireless sensor networks using stateful public key cryptography[END_REF]. The encryption of a message m from A to B with the key K A-B , namely Enc KA-B (m, ID A || Nonce) is as follow:

 K = HKDF (K A-B , ID A || Nonce)  C A = K + m mod V, where is a large enough integer, m ∈ [0,V-1],K ∈ [0,V-1]
B decrypts C A as follow:

 Dec KA-B (C A , ID A || Nonce) = C A -K mod V D. Network model
According to the SG architecture proposed in the previous proposals, the system generally consists of three levels. As shown in Fig. 2, the user level known as Home Area Network (HAN) in which there is a smart meter allowing two-way communication between the CC and HAN. The aggregator level known as Neighborhood Area Network (NAN) which consists in a gateway AGG serving as a relay between HAN and CC. The CC level which is responsible for collecting dynamic power usage to efficiently manages electricity generation, distribution, and allocation. We consider that the CC covers F NANs and each NAN consists of N HANs. Each HAN user U ij (i = 1,2,…,N, j = 1,2,…,F) which belongs to a NAN aggregator AGG j uses the smart meter to collect, encrypt and send the data to the corresponding aggregator. AGG j aggregates the received data and sends them to the CC. With the received data, the CC makes the decisions and sends the control messages to AGG j and the corresponding SMs.

E. Security Model

We consider an attacker A that can eavesdrop the users' data and try to identify the content of ciphertexts. A can also execute some active attacks, for example, intruding in the database of CC and AGG j to steal the individual data or injecting fake electricity demand arbitrarily into the aggregation to bias the correct aggregation result, or even replay valid packets already -used‖ in the SG. Furthermore, the attacker A can capture the response messages from CC and try to identify the encrypted messages.

F. Design goal

Under the aforementioned system models, our design goal is to develop an efficient privacy-preserving demand response scheme for SG communications. More specifically, the following objectives should be achieved.

1) Security

The scheme must be secure under the attacker model mentioned above. More specifically, the following security requirement should be satisfied.

-Confidentiality: refers to preventing unauthorized persons or systems (including AGG and CC) from obtaining the relevant information to users from the transmitted data and thus achieve the privacy-preserving requirement. In fact, consumption data contain detailed information that can be used to gain insights on a customer's behavior. The CC response messages also must be confidential, i.e., only the authorized entities are allowed to read them.

-Integrity and authentication: the former refers to preventing undetected malicious operations by unauthorized persons or systems, whereas the latter means that an encrypted data is issued from a legal user. AGG j and HAN users should be authenticated by CC and AGG j , respectively.

2) Efficiency

The scheme must be efficient in terms of communication and computation overhead, so that the real-time high frequency data can be fast collected by CC.

IV. PROPOSED

In this section, we propose a scheme, which consists of four phases, as shown in Fig. 3: system setup, data generation, data aggregation and response.

3. The proposed scheme's phases.

A. Setup phase

We suppose that the CC bootstraps the whole system. Given the security parameter K, CC first generates the elliptic curve parameters (E, p, G, n) by running Gen(K) and then calculates its public keys. Assume that there are l types of data (t 1 , t 2 ,…, t l ) to be transmitted in the smart grid. Then, CC choose l+1

random numbers (x 1 , x 2 ,…, x l , x cc ), where x 1 ,…,x l ∈ [0, n-1]
and computes the corresponding public keys (Y 1 , Y 2 ,…, Y l , Y cc ), where Y i = x i G, i=1..l and Y cc = x cc G. CC also generates l reference values (f 1 ,…, f l ) for each type of data. CC also chooses a secure hash function H (e.g. SHA-1) and a secure symmetric encryption Enc() [START_REF] Castelluccia | Efficient and provably secure aggregation of encrypted data in wireless sensor networks[END_REF]. Then, CC publishes all the public information { E, p, G, n, H, Enc(), Y 1 ,…, Y l , f 1 ,…, f l } and keeps { x 1 , x 2 ,…, x l , x cc } as secret.

When a user ij joins the system, it first chooses a random number a ij ∈ [0, n-1] as the private key and computes the corresponding public key ij = a ij G. Also, when AGG j (the local gateway) of the residential area registers itself in the system, it generates a random number a j ∈ [0, n-1] as the private key and computes the corresponding public key P j = a j G. In addition, symmetric keys are computed between CC and AGG and also AGG j and U ij as follow:

The CC and AGG j compute K cc-AGGj = x cc P j = a j Y cc = x cc a j G The AGG j and U ij compute K AGGj-Uij = a j P ij = a ij P j = a j a ij G

B. Data generation

The user U ij that is in the residential area of AGG j , first obtains its l types of data ij1 , d ij2 ,…, d ijl ) from the smart meters. Then, it performs the following:

 Compute the points (M ij1 , M ij2 ,…, M ijl ), where M ijk =(d ijk -f k ) G, where k = 1..l  Choose two random numbers r ij1 , r ij2 ∈ [0, n-1]  Compute C ij = (r ij1 G, r ij1 Y 1 + M ij1 , r ij1 Y 2 + M ij2 , …, r ij1 Y l + M ijl )  Compute z ij = r ij2 -1 (H(D)+ a ij r
u ij G + v ij P ij = H(D) z ij -1 G + r z ij -1 a ij G = (H(D) + r a ij ) z ij -1 G = (H(D) + r a ij ) (H(D) + r a ij ) -1 (r ij2 -1 ) -1 G = r ij2 G
In order to speed up the verification, the aggregator AGG j can perform the batch verification [START_REF] Antipa | Accelerated verification of ECDSA signatures[END_REF] by checking:

ij N i ij N i ij N i ij P v G u G r         1 1 1 2 ) (
The number of scalar multiplications is then reduced from 2N to N+1. verification, AGG j performs the following:

 Compute the encrypted aggregate C j on C 1j , C 2j ,…, C Nj as                      N i N i ijl l N i ij ij N i ij N i ij N i ij N i ij N i ij j M Y r M Y r M Y r G r C C 1 1 1 1 2 2 1 1 1 1 1 1 1 1 1 ) ,...,

, , (

 Choose a random number r j and compute z j = r j -1 (H(D)+ a j r) mod n, and produce S j = (r j G, z j ), where D = C j || ID j || TS, TS is the current time stamp, and r = x(r j G) mod n.

 Send C j || ID j || TS || S j to CC

D. Analysis and response

After receiving C j || ID j || TS || S j , CC first verifies the signature S j i.e. verifies if r j G = u j G + v j P j , and then retrieves the aggregated data as follow:

G r x M Y r G r x M Y r G r x M Y r M M M N i ij l N i ijl l N i ij N i ij N i ij N i ij N i ij N i ij N i ij N i ijl N i ij N i ij                                1 1 1 1 1 1 1 2 1 2 2 1 1 1 1 1 1 1 1 1 1 1 1 2 1 1 , ,... , ,..., , , ) ( ,..., ) ( , ) ( ,..., , 1 2 1 2 1 1 1 1 1 2 1 1 l N i ijl N i ij N i ij N i ijl N i ij N i ij f M RM f M RM f M RM d d d                
where RM is the reverse mapping function which transforms a curve point to an integer using Pollard's lambda method [START_REF] Pollard | Monte Carlo methods for index computation[END_REF].

After analyzing the data, the CC responds by a message m to the users U ij .

V. SECURITY

In this section, we analyze the security properties of the proposed scheme.

 The proposed scheme provides the Privacy-Preserving of

User's data.

The encryption in this scheme is an ECEG encryption. The security of ECEG is based on ECDLP, which makes the encryption secure if ECDLP is intractable. In this work, we consider a security level of 160 bits, the same provided by RSA with 1024 bits key, see Section VI. Also, the ECEG is IND-CPA secure, so the encryption is secure against any form of ciphertext analysis. The reference technique used in the proposal is only considered in order to speed-up encryption and decryption operations. Roughly speaking, this technique does not negate the security of ECEG. In fact, recall that the encrypted data is the difference d i -f i , so even if the attacker has f i , he cannot deduce the difference d i -f i nor d i . The privacy-preserving is guaranteed for all types of data because for El-Gamal, it is safe (w.r.t IND-CPA) to encrypt data under different public keys with the same randomness [START_REF] Bellare | Multirecipient encryption schemes: How to save on bandwidth and computation without sacrificing security[END_REF]. Furthermore, AGG j performs aggregation directly on ciphertexts, so even if an adversary intrudes the AGG j 's database, it cannot deduce the individual user's data. Also, CC performs decryption on aggregated ciphertexts, and retrieves aggregated plaintexts, so even if an adversary intrudes the CC's database, it still cannot deduce the individual user's data.

Therefore, the Privacy-Preserving is ensured in our scheme.

The proposed scheme ensures data integrity and source authentication of User's data, and data confidentiality for CC's response

The ciphertext in the proposed scheme is signed using ECDSA, which is provably secure. In fact, an adversary who wants to forge a signature should either crack the hash function; or solve the ECDLP. In scheme, we use a secure hash function (SHA-1) and a recommended elliptic curve, thus the above adversary tasks are infeasible. Therefore, data integrity and source authentication of user's data are provided. Also, when CC responds the users, CC uses Enc() to encrypt the response message m. Since m is encrypted using [START_REF] Castelluccia | Efficient and provably secure aggregation of encrypted data in wireless sensor networks[END_REF], which is provably secure, the confidentiality of response messages is provided.

VI. PERFORMANCE

In this section, we evaluate the computation and communication overheads in the proposed scheme.

A. Computation overhead

Before presenting the scheme's overhead in terms of computation, we calculate using MIRACL library [START_REF] Certivox | Multiprecision integer and rational arithmetic c/c++ library (MIRACL)[END_REF] the costs of various operations involved in the proposal. We use the standard curve SECP160R1 and SHA1 for ECC and hash operations, respectively. The experiments are conducted on a computer with Intel Core i5-2430 2.4-GHz CPU, and 2-GB RAM. The results are presented in Table I. From Table I, we can see that the operation cost of PA, MI, HF, and SE can be neglected with respect to elliptic curve scalar point multiplication. Consequently, in what follow we only consider PM in the analysis.

For our scheme, to generate the data C ij ||ID ij ||TS ||S ij , a residential user U i needs to perform 2(l+1) Point Multiplication, (2l+1) PM for encryption and one PM for S ij 's generation. After receiving the ciphertext from N users, the local AGG j first verifies the data integrity by performing batch verification which includes (N+1) PM. After that, the AGG aggregates these authenticated data, a calculation that involves only PA operation. Next, the AGG needs to perform one PM for signature generation. After receiving the data from AGG j , the CC first checks the integrity by performing 2 PM. Then, the involves PM and l RM to retrieve the data. Finally, CC uses symmetric encryption for response. Then, the total cost of our proposal is (2N+l+7) PM + l RM. Recall that RM is the reverse mapping function and can be efficiently computed using Pollard's lambda method [START_REF] Pollard | Monte Carlo methods for index computation[END_REF].

In the proposed scheme, the user can send a multidimensional data to the CC for more precise control. It could be possible for example to embed all data types l into one piece of data and encrypt it using ECEG. However, in this case, the reverse mapping function at CC becomes very difficult to perform. In our proposal, we use different public keys with a reference value to enhance the execution time. Also, the same random number is used to encrypt each type of data, indeed, this avoids one PM for each encryption at users and CC. In ECC, the points of an elliptic curve, with x and y coordinates each represented by N bits, can be compressed to only the x coordinate and a compression bit, requiring only half the space. The Point Compression (PC) helps to increase the efficiency in terms of storage and bandwidth. However, the decompression operation requires the computation of one square root in prime fields. The PD operation takes 0.09 ms according to Table I.

For benchmarking, we compare our approach to EPPA [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF]. In fact, among related work, EPPA is the most efficient approach to secure multidimensional data, in terms of computation and communication. In Table II, we compare the scheme with EPPA in terms of computation complexity. C e , C m and C p refer to computation cost of exponentiation in Z n² , multiplication in the group of pairing system and a pairing operation, respectively. To give a sense to this and to make the comparison results more accurate and valuable, we consider the pairing-based cryptography library [START_REF] Lynn | PBC Library[END_REF] in order to measure the EPPA's operation costs. We conduct the experiment with the same computer with a base field size of 160 bits for pairing and 1024 bits n for exponentiation, the results for C e , C m and C p are 9.78 ms, 1.18 ms and 22,84 ms, respectively.

In Fig. 4, we depict the variation of computation costs (encryption and signature) in terms of data type number ( l ) for users (HAN). The figure shows that our scheme hugely reduces the computation overhead for the user. This is due to, in one hand EPPA uses a costly operation for encryption, namely, an exponentiation in Z n² , and on the other hand, it uses another costly operation in order to decrypt the message response from CC. In our proposal, the user operations involve ECC scalar multiplication, which is very efficient compared to exponenttiation in Z n² . Also, a lightweight decryption is considered to decrypt the CC's message. Furthermore, the execution time in our scheme can be reduced even more. In fact, the point used in our system, namely (G, Y 1 ,…,Y l ), are fixed and known a priori. A PM with precomputation (window = 4) takes about 0.17 according to Table I. In Fig. 5, we depict the variation of computation costs in terms of users number (N) for the AGG. It is shown that there is a great difference between our proposal and EPPA's work. In fact, the pairing operation is much slower than PM. Furthermore, the two graphs (our scheme with and without PC) are almost identical. So, even if we use the PC technique and the additional overhead generated by the corresponding PD, our scheme is still efficient.

In [START_REF] Saputro | Performance evaluation of smart grid data aggregation via homomorphic encryption[END_REF], the authors investigate the overhead due to using homomorphic encryption in SG in terms of bandwidth and end-to-end data delay when providing data privacy. They do not consider the time spent for source authentication in the latency calculation. The authors also state that the computation overhead impacts severely the end-to-end delay and must be considered. In this paper, we show that using pairing algorithms for verification leads to a non-negligible amount of time.

For instance, in a NAN with 600 HANs, the corresponding AGG spends approximately 14s to verify the data received from HAN's smart meters, while only 0.3s is needed for verification in our proposal.

B. Computation overhead

In what follow, we analyze the communication overhead of our scheme according to the data report transmitted at each level of the hierarchy i.e. the user data reports for AGG and the AGG data report for CC. The data report generated by the user The impact on communication overhead during each aggregation is shown in Table III, where we compare our scheme with our scheme with PC and EPPA. Let the size of an entity identifier and the timestamp be all 4 bytes. In Fig. 6, we plot the communication cost during each aggregation in terms of data type l. The figure shows that in our scheme, larger is the number l, and larger is the overhead at each aggregation. This is obvious because, for each new data type, a new elliptic curve point is added to the ciphertext. Besides, it is shown that the PC technique reduces significantly the communication overhead. In comparison with EPPA, our scheme with PC is more efficient in terms of communication. In fact, for a reduced number of data types our scheme preserves the network's resources e.g. for l=5 only 1319 bits is transmitted. Note that in the EPPA's work, the authors considered only l=10 in their experiments. For a larger number l, another larger modulus should be considered for the Paillier's encryption in order to support the corresponding super-increasing sequence. In Fig. 7, we also plot the communication overhead in terms of user number. It can be seen that the communication overhead is reduced in our proposal for large scale networks.

The aforementioned analysis concerns the user to AGG communication. Note that the same analysis can be carried out for AGG to CC communication since we have the same amount of data to be transmitted. Consequently, the proposed scheme effectively reduces the communication overhead compared to EPPA.

VII. CONCLUSION AND FUTURE WORK

In this paper, we proposed an efficient and secure aggregation scheme for smart grid communications based on elliptic curve cryptography. Compared with previous solutions, the scheme can achieve a comparable security level with a significant efficiency in terms of computation and communication overheads. The multidimensional data are very important for more accurate control; the analysis shows that our proposal can achieve privacy-preservation of each data type. The paper also shows the scheme's efficiency. In fact, the results show that smaller inputting parameters in pairing cryptography systems cannot bring them a good speed, and for real-time high frequency data collection, the speed efficiency is crucial. In future work, we aim to extend our work to consider new attacks such as selective forwarding.

Fig. 1 .

 1 Fig. 1. NIST's SG conceptual model [2].

Fig. 2 .

 2 Fig. 2. Our system model.



  CC sends C cc || ID cc || TS, where C cc = Enc Kcc-AGGj (m, ID cc || TS)  AGG j retrieves m = Dec Kcc-AGGj (C cc , ID cc || TS) and forwards C m || ID j || TS to the user U ij , where C m = Enc KAGGj-Uij (m, ID j || TS) U ij retrieves m = Dec KAGGj-Uij (C m , ID j || TS) and uses m to manage the cost efficiency.

Fig. 4 .

 4 Fig. 4. Computation cost for users.

Fig. 5 .

 5 Fig. 5. Computation cost for AGG.

  U i and submitted to the AGG j is in the form of C ij ||ID ij | TS|| S ij . The length of the ciphertext C ij is (320+320*l) bits without PC and (161+161*l) bits with PC. The length of the signature is 480 bits without PC and 321 with PC. Thus, its size can be represented as Sz = 800 + 320*l + | ID ij | + | TS | without PC and Sz c = 482 + 161*l + | ID ij | + | TS | considering PC. So, if we have N users, the overall communication overhead will be N*Sz without PC and N*Sz c considering PC. Next, we analyze the AGG to CC communication. In that level of the hierarchy, the same amount of data i.e. Sz and Sz c is transmitted. So, if we have K AGG, the overall communication overhead will be K*Sz without PC and K*Sz c considering PC.

Fig. 6 .

 6 Fig. 6. Communication overhead in terms of l.

Fig. 7 .

 7 Fig. 7. Communicatin overhead in terms of user number N.

  ) mod n, and produce ij = (r ij2 G, z ij ), where D = C ij || ID ij || TS, TS is the current time stamp, and r = x(r ij2 G) mod n Send C ij || ID ij || TS || S ij to AGG jC. Data aggregationAfter receiving encrypted data C ij || ID ij || TS || S ij , AGG j first verifies the signature S ij i.e. verifies if r ij2 G = u ij G + v ij P ij , where u ij = H(D)w mod n, v ij = rw mod n, and w = z -1 mod n. The correctness is shown as follow: