Amel Arfaoui

Omar Rafik

Merad Boudia

Ali Kribeche

Sidi-Mohammed Senouci

Mohamed Hamdi

Context-aware access control and anonymous authentication in WBAN

The emergence of the Internet of Things (IoT) as the next generation megatrend has paved the way for pervasive, ubiquitous and proficient healthcare monitoring systems. In the di-verse kinds of networks, Wireless Body Area Network (WBAN) has been perceived as one of the most promising wireless sensor technologies for improving healthcare services thanks to its potential for continuous and real-time monitoring of health conditions. However, the open nature of wireless communication introduces wide security and privacy concerns as personal health information could be exposed to unauthorized parties or even malicious adversaries. Furthermore, in such a dynamic and heterogeneous environment where the context conditions continuously and frequently change, adaptive and context-aware solu-tions become mandatory to satisfy burgeoning security and privacy requirements. There-fore, it is indispensable to adaptively secure the extra-body communication between the smart portable device held by the WBAN client and the healthcare providers while consid-ering the dynamic context changes. In this paper, we propose a context-aware access control and anonymous authentication approach based on a secure and efficient Hybrid Certificate-less Signcryption (H-CLSC) scheme.

. Specifically, the IoT holds great promise

Introduction

In recent years, the rapid technological advancements in wireless communication and the melding of innovations in the fields of ubiquitous sensing and pervasive computing have for the healthcare area, where its features are already being exploited to improve the reliability of remote health monitoring systems [START_REF] Zhibo | Technologies and architectures of the internet-of-things (IoT) for health and well-being M[END_REF]. In remote patient monitoring systems, the personal health information (PHI) is collected by Wireless Body Area Network (WBAN) and aggregated by a data sink, such as Smartphone, tablet, or PDA. Then, the data is transmitted to the medical staff to assess the patient's status and provide the appropriate clinical diagnosis. In this context, it is critical to secure the transmitted data between the WBAN client and the remote application providers (APs) such as the hospital, physician or medical staff.

In fact, the collected data should be handled, transmitted, and analyzed only by authorized parties in order to ensure accurate diagnosis and treatments. Since the patient's information is transmitted through an open channel, it can be eavesdropped, intercepted and modified. Consequently, counterfeited health-related data may mislead the caregivers to make the appropriate decision, which may convolute the patient's situation. Furthermore, the dynamics of cellular networks imposes more challenges to design robust security and access control mechanisms. As to the security facet, one of the main issues is authentication and access control of patients' personal health information while considering the dynamic context changes to make the right decision at the right time by the right party. Therefore, it is necessary to define who can access what and under which contextual information. For this purpose, according to the information sensitivity, the data consumer role, as well as the patient's condition sensitivity, different access rights, and permissions can be assigned. For example, a nurse who has restricted access compared with a doctor in normal situations can gain additional permissions in emergency situations. In such a critical context, privacy may be restricted or relaxed given that safety is more important than security. Currently, security and privacy preservation of extra-body communication have attracted particular attention. However, most of the previous works mainly focus on either anonymous authentication or privacy preserving concerns while ignoring the dynamic context changes [START_REF] Zhang | Light-weight and robust security-aware D2D-assist data transmission protocol for mobile-health systems[END_REF]Rongxing et al., 2013;Chunqiang et al., 2016 ). On the one hand, they don't incorporate the contextual information related to the dynamic nature of cellular networks in the authentication and authorization decision. On the other hand, many proposed access control schemes suffer from the following problems: (i) they need public key certificates, they are exposed to the impersonation attack by the Key Generator Center (KGC) as well as key escrow problem ( Chunqiang et al., 2016;junzuo et al.,2013;Xianping et al., 2016 ). (ii) They don't provide either ciphertext authenticity or public verification. In fact, the receiver should decrypt at first the ciphertext and then verify its validity which may waste the computation resources and increase the response delay if the ciphertext is not valid.

This study is devoted to investigating the cryptographic primitives to address the above issues. We notice that there are other equally serious security concerns in WBAN, such as the key management [START_REF] Huawei | An energy efficient key management scheme for body sensor networks[END_REF]( Huawei et al., , 2015 ) ) and the access policies management for sensor nodes ( Kriangsiri et al.,2009;[START_REF] Tan | IBE-lite: a lightweight identity-based cryptography for body sensor networks[END_REF] in the intra-body communications. However, the study of those issues is out of the scope of this paper.

Contributions

In this paper, we focus on extra-body communication. Specifically, we propose a novel approach for the design of a contextaware authentication and access control scheme to adaptively adjust the security and privacy level according to the contextual information. For this purpose, we use an efficient and secure Hybrid Certificateless Signcryption (H-CLSC) scheme with public verifiability and ciphertext authenticity that can simultaneously authenticate users and protect query messages. The proposed to address the secure communication problem and provide adaptive context-aware privacy. A WBAN client in a normal situation can control access to his own data. For example, by constructing the access structure ({status = normal} AND {hospital A } AND {Vascular Surgery}), the data requires that on normal situations only doctors from the Vascular Surgery Center in hospital A can have the access right. The novelties of our proposed model are summarized as follows.

• A novel context-aware authentication and access control approach that provides a dynamic authorization to the patient's data while considering the contextual information (patient's condition severity, data consumers' roles, security domain...).

• A Hybrid Certificateless Signcryption (H-CLSC) scheme with public verifiability and ciphertext authenticity in which the validity of the ciphertext can be verified without decryption.

• An anonymous signcryption mechanism to provide efficient and fine-grained encrypted access control by merging the worthiness of CP-ABSC and IBBSC. The WBAN client can control who has access to his personal health information by defining an access structure for data.

• Dealing with the key escrow problem and impersonation attack by the KGC. The data owner/consumer's private keys aren't generated by the KGC alone but by a combination of the contributions of the KGC and the data owner/consumer. Given that the KGC can generate only the user's partial private key, it cannot decrypt messages or impersonate users.

Organization

The remainder of this paper is organized as follows.

Section 2 highlights some previous works related to security and privacy mechanisms in WBAN. A mathematical background is presented in Section 3 . The system model and the design goals in terms of context-aware privacy and security requirements are described in Section 4 . The efficient H-CLSC scheme for authentication and access control as well as its security model are given in Section 5 , followed by the performance analysis in Section 6 . Finally, Section 7 concludes the paper.

Related work

Security and privacy of a patient's health records are two crucial features for the system security of the WBAN. On the one hand, security implies data is protected from unauthorized users when being, collected, transferred and stored. On the other hand, privacy means that the data can only be accessed and used by the authorized parties. It defines who can access what and under which context [START_REF] Javadi | Security and privacy in wireless body area networks for health care applications[END_REF]. Therefore, it is essential to deal with the issues allied with security and privacy preservation in WBAN. Some contributions have proposed authentication and key agreement schemes for intra-WBAN communication [START_REF] Huawei | An energy efficient key management scheme for body sensor networks[END_REF]( Huawei et al., , 2015;;[START_REF] Liu | Efficient authenticated key exchange protocols for wireless body area networks[END_REF]. Particularly, [START_REF] Huawei | An energy efficient key management scheme for body sensor networks[END_REF] discussed the key management problem in WBAN. They used a fuzzy commitment technology with a weak time synchronization mechanism and an energy-based multi-hoproute-choice method to implement efficient key management among sensor nodes. In addition, Huawei et al. (2015 ) exploited the biometric characteristics to implement an authentication scheme for WBAN. Specifically, they proposed two approaches: the first approach presents a new key negotiation scheme between body sensor nodes based on the fuzzy extractor technology. The second approach provides an improved linear interpolation encryption method for biometric data. [START_REF] Liu | Efficient authenticated key exchange protocols for wireless body area networks[END_REF] developed two authenticated key exchange protocols for two-hop star WBAN topology, which grants selective authentication between the sensor nodes according to the application scenario. The first protocol is designed for the communication between the sensor nodes and the controller node in normal situations. The second protocol is applied in an emergency scenario where fast responses and communication between sensor nodes are needed.

Recently, some contributions have addressed particular attention to authentication and access control for extra-body communication. Particularly, the cryptography-based authentication scheme has been widely adopted and implemented using the traditional public key cryptography (TPKC) ( Ming et al., 2010( Ming et al., , 2013 ) ). In this scheme, a Certificate Authority (CA) is required to issue and maintain a pool of certificates for the clients after verifying their validity, which arises inevitably in the awkward certificate management problem. For this purpose, the elliptic curve cryptography (ECC) has been introduced as an alternative to providing the same security level with better performance and much smaller key size for environments with limited battery capacity and computing capabilities. Nevertheless, public key infrastructure (PKI) is needed in the practical implementation of the ECC. It employs a digital certificate to bind the user's identity to the public key. To mitigate the problem of certificates management, several identity-based (ID-based) authentication schemes [START_REF] Zhang | Light-weight and robust security-aware D2D-assist data transmission protocol for mobile-health systems[END_REF][START_REF] Liu | Certificateless remote anonymous authentication schemes for wireless body area networks[END_REF][START_REF] He | Anonymous authentication for wireless body area networks with provable security[END_REF][START_REF] Li | Privacy-preserving multi-receiver signcryption scheme for heterogeneous systems[END_REF][START_REF] Liu | 1-RAAP: an efficient 1-round anonymous authentication protocol for wireless body area networks[END_REF][START_REF] Hu | Revocable and scalable certificateless remote authentication protocol with anonymity for wireless body area networks[END_REF] were proposed. In such a proposal, a user's public key is determined from its identity information, such as identity numbers and e-mail. For the private key, it is computed by a trusted third party named the Private Key Generator (PKG). Even if the lightweight identity-based cryptography is considered as a very suitable mechanism for resource-constrained WBANs, it suffers from the key escrow problem since the PKG generates all users' private keys.

To address the above problems and ensure secure extrabody communication in WBAN, [START_REF] Liu | Certificateless remote anonymous authentication schemes for wireless body area networks[END_REF] used the bilinear pairing defined on the elliptic curve to design a new anonymous authentication scheme based on the certificate-less signature. A user should be authenticated before access the patient's health information stored in the network server. The proposed model can avoid both public key certificates and key escrow problem because the key generation incorporates both the user and the KGC. However, the adoption of this scheme is restricted to users who access a network server, not the WBAN. In addition, [START_REF] He | Anonymous authentication for wireless body area networks with provable security[END_REF] found that the above scheme suffers from the impersonation attack. Therefore, they provided an improved anonymous authentication scheme to address the aforementioned security problem. In [START_REF] Li | Privacy-preserving multi-receiver signcryption scheme for heterogeneous systems[END_REF], the authors proposed an efficient certificateless signcryption model for access control in WBAN. In the registration phase, every user first generates a public key pair and sends it to the KGC in order to get a partial private key. Upon receiving his partial private key, the user could compute his full public key pair. As only registered users could generate this public key pair, this generation can be considered as a measure to verify the user legitimacy. Given that only the public key is transferred, the user's identity is hidden and anonymity is ensured. However, in their scheme, they don't consider the data consumer's role. Thus, all data consumers have the same access privileges. In [START_REF] Liu | 1-RAAP: an efficient 1-round anonymous authentication protocol for wireless body area networks[END_REF] , a cost-effective anonymous authentication scheme that could protect the identity and privacy of the user was designed. In [START_REF] Zhang | Light-weight and robust security-aware D2D-assist data transmission protocol for mobile-health systems[END_REF] an efficient and certificateless scheme based on the generalized signcryption (CLGSC) model was proposed. The security analysis illustrated the capacity of the adopted scheme in terms of data confidentiality and integrity, mutual authentication, unlinkability, anonymity, etc. From the performance perspective, it has been demonstrated that it can outperform the existing schemes in terms of computational and communication overhead. In [START_REF] Hu | Revocable and scalable certificateless remote authentication protocol with anonymity for wireless body area networks[END_REF], a remote anonymous authentication protocol with revocability for extra-body communication in WBANs has been proposed. However, it involved large amounts of computation and energy consumption. In Jiankun et al. (2010 ), the authors presented a Hybrid Public Key Infrastructure (HPKI) that uses smart cards to provide a contract-oriented e-health security architecture. In the proposed scheme, trust and security management are delegated to the medical service provider during the contract period of the medical treatment. However, the HPKI model suffers from several attacks such as man-in-themiddle attack and replay attack. In addition, if a contract key is compromised, the trusted entity can still access the corresponding PHI data encrypted with the compromised key.

Attribute-Based Cryptography (ABC) is considered as a promising tool that can provide fine-grained and adaptive access control. Specifically, in Ciphertext-Policy Attribute-Based Encryption (CP-ABE), each user is associated with a set of attributes and the data is encrypted according to an access structure. Only receivers whose attributes satisfy the access policy can decrypt the ciphertext. In [START_REF] Lu | SPOC: a secure and privacy-preserving opportunistic computing framework for mobile-healthcare emergency[END_REF], the authors proposed an opportunistic privacy preserving model in WBAN. They considered data processing techniques in emergency situations for M-Health systems with minimal privacy disclosure. A CP-ABE scheme was proposed in [START_REF] Hu | Secure and efficient data communication protocol for wireless body area networks[END_REF] to secure data communications between the sensor nodes, data sink, and data consumers. In the proposed approach, role-based access control is adopted by employing an access control tree constructed from the data attributes. However, such schemes suffer from the key escrow problem in which a curious KGC has the power to decrypt every ciphertext. Furthermore, most of the existing Attribute-Based Encryption (ABE) constructions depend on a single key authority which may open the door for potential privacy exposure. To remedy this weakness, several research works adopt multi-authority ABE as an attractive solution that can successfully avoid delegating trust to a single authority by making the system distributed. This model allows the sender to specify for each authority its monitored set of attributes. Nonetheless, it is burdensome for a user to prove his attributes to several key authorities and get his private key over a secure channel and it needs high computation cost.

Most of the aforementioned works don't involve the contextual information in their access control and authentication schemes. On the one side, they don't consider the severity of the patient's condition in the medical environment given that in some situations the safety should be prioritized and the privacy could be relaxed or restricted. On the other side, they don't differentiate between the personal and public domains, which have different attribute definitions, key management requirements, and scalability issues. In this context, the following critical technical challenges should be considered when designing a WBAN security mechanism: (i) How to properly regulate and adjust the access rights and authentication policy of the different data consumers while considering the dynamic context changes? (ii) How to guarantee that any third party can judge whether data is altered by attackers without access to the message? (iii) How to resolve the key escrow problem and mitigate the impersonation attack by the KGC? (iv) How to be lightweight for resourceconstrained devices, i.e., low computational, storage and communication overhead? The context-aware access control and anonymous authentication approach proposed in this paper and detailed in the next sections deals with all these technical challenges.

Preliminaries

In this section, we briefly review the mathematical background of Bilinear Pairings and the cryptographic primitives used in this paper.

Bilinear pairings

Let G 1 be a cyclic additive group of prime order q and G 2 be a cyclic multiplicative group of the same order q . A bilinear pairing is a map e : 1 × G 1 → G 2 and satisfies the following properties:

• Bilinear : A map e: G 1 × G 1 → G 2 is bilinear if and only if ∀ P, Q ∈ G 1 and a, b ∈ Z q , we have e ( aP, bQ ) = e ( P, Q ) ab • Non-degeneracy : ∃ P, Q ∈ G 1 where e ( P, Q ) = 1 G 2 • Computability : ∀ P, Q ∈ G 1 ,
there is an efficient algorithm to compute e ( P, Q ) in polynomial time.

The security of the proposed scheme depends on the following intractable problems:

• Computational Diffie-Hellman(CDH) problem : given P, aP, bP ∈ G 1 , ∀ a, b ∈ Z *
q , it is infeasible to compute abP in polynomial time. The advantage of any probabilistic polynomial time algorithm B in solving the CDH problem is defined as

Adv CDH B = Pr [ B (P, aP, bP) = abP| a, b ∈ Z * q ]
. The CDH Assumption requires that for any probabilistic polynomial time algorithm B, the advantage Adv CDH B is negligible.

• DBDH (Decision Bilinear Diffie-Hellman) problem : Given two groups G 1 and G 2 with the same prime order q , a bilinear map e : G 1 × G 1 → G 2 , T ∈ G 2 and a generator P of G 1 , the DBDH objective is to decide whether T = e ( P, P ) abc holds or not in ( G 1 , G 2 , e ) from the given ( P, aP, bP, cP ) , ∀ a, b, c ∈ Z * q . We say that an algorithm B that generates b ∈ {0, 1} has advantage ε in solving DBDH problem in G 1 if: Pr B P, aP, bP, cP, e ( P, P )

abc = 0 -Pr [ B ( P, aP, bP, cP, r ) = 0 ] ≥ ε
Where the probability is over the random choice of a, b, c ∈ Z * q , the random choice of r ∈ G 2 and the random bits of B.

CP-ABSC protocol description

The CP-ABSC scheme includes the following four algorithms, namely, Setup, KeyGen, Signcryption and Designcryption.

• Setup (1 λ ): Given a security parameter λ, the KGC generates a master secret key MK that is kept private and a public key PK shared by users.

• KeyGen ( PK , MK , U ): The KGC takes the master secret key MK , the attribute set of the user U , and the public key of the system PK as inputs. It generates the private key SK U .

• Signcryption ( PK, M, S K Us , A ): The signer takes the public parameters PK , a plaintext M , a signing private key SK Us and an access structure A as inputs. The algorithm will signcrypt M and generate a ciphertext CT such that only a user who possesses a set of attributes that satisfy the access policy will be able to designcrypt.

• Designcryption ( CT , PK , SK Ud ): The receiver takes as input the ciphertext CT , the public parameters PK and his decryption key SK Ud . The algorithm outputs a message M or a reject symbol ⊥ .

IBBSC protocol description

The IBBSC scheme consists of four algorithms, namely, Setup, KeyGen, Signcryption and Designcryption.

• Setup (1 λ ): The KGC takes a security parameter λ as an input. Then, it outputs a master secret key MK and a public key PK .

• KeyGen ( PK , MK , ID ): The KGC takes the master secret key MK , the identity ID ∈ {0, 1} * , and the public key of the system PK as inputs. It outputs the private key SK ID .

• Signcryption ( PK , M , S, SK IDs ): The signcryption algorithm is executed by the sender which takes the public parameters PK , the signing key SK IDs, a plaintext M , and a set of identities S = { ID 1 , …ID n } of receivers as inputs. It encrypts the plaintext M to generate the ciphertext CT.

• Designcryption ( CT , PK , SK IDd ): The receiver takes as input the ciphertext CT , the public parameters PK and the decryption key SK IDd . The algorithm outputs a message M or a reject symbol ⊥ .

Conversion between access structures DNF and a set of identities

Attribute-Based Encryption (ABE) was introduced as an extension of the notion of Identity-Based Encryption (IBE) in which user identity is viewed as a set of expressive attributes instead of a single string defining the user identity [START_REF] Herranz | Attribute-based encryption implies identity-based encryption[END_REF][START_REF] Sahai | Fuzzy identity-based encryption[END_REF]. Compared with identity-based encryption, ABE is considered as a promising tool that provides oneto-many encryption and ensures a fine-grained access control. Besides fine-grained access control, privacy-preservation is considered as a critical concern to be handled. In fact, in some crucial situations, not only the data but also the access policy could be sensitive information. Specifically, the access policies may reveal sensitive data, such as the patient's identity, treatments or symptoms indicating the patient's status and diseases. In this vein, both patients and healthcare providers should remain hidden from unauthorized parties or adversaries. In addition, the adversary should be hampered from associating the transmitted personal health information to a patient. Although CP-ABSC provides a fine-grained access policy, it suffers from some problems: (i) the access policies attached to the ciphertext are public. Under such an assumption, unauthorized users can learn information about the underlying data itself. (ii) It brings out high communication overhead in data sharing given that the length of private keys increases linearly with the number of the attributes.

To overcome the above problems, we will combine the features of CP-ABSC and IBBSC to provide a constant-size of private keys, hidden access policy, certificateless signcryption, etc. In this context, we will exploit the conversion between an IBBSC and a CP-ABSC that supports Boolean functions in DNF [START_REF] Fan | Attribute-Based Encryption from Identity-Based Encryption[END_REF][START_REF] Herranz | Attribute-based encryption implies identity-based encryption[END_REF]. For such a scheme, an access structure A which admits, at least, AND policies can be uniquely related to an identity I D A , whose length equals to | U | , i.e., the size of the universe U of attributes. Specifically, for an access structure A , for i = 1 to | U | , if an attribute X i is in A , then set the i th bit of I D A , as 1; otherwise, set it as 0. For instance, if U = { A , B , C , D , E } and A = A AND B OR C, then we can construct the identity as I D A = {11,000, 00100}. An access structure can be represented as a disjunction of conjunctive clauses, i.e. disjunctive normal form (DNF). In this context, a DNF structure implies a set of identities S = { ID 1 , …ID n }, which can be considered as the receivers set in an IBBSC scheme.

As mentioned above, an access structure is considered as a set of attributes that corresponds to a set of identities. When the identity associated with the ciphertext satisfies the signing access structures, the data consumer can get the medical data. Fig. 1 shows an example of the access structure. For example, an access structure has the following attributes, i.e., Department: Vascular surgery, Position: Doctor, Location: hospital A, is uniquely assigned to an identity ID1. Hospital A indicates to which hospital the doctor associated. Vascular surgery specifies the doctor's department. If the identity of the data consumer satisfies the signing access structure, the doctor can access the patient's medical data and give treatments

Models and design goals

In this section, we present the system model. Then we describe the threat model and the different security requirements. Finally, the contextual information that influences the access policy is defined.

System model

We consider a WBAN communication system presented in Fig. 2 . It mainly consists of three entities: The Network Manager (NM), the WBAN client and the data consumers (such as a nurse, a doctor, an insurance company a physician, family member, close friend…). The different functions of each entity are presented as follows:

• NM is a powerful entity responsible for system initialization and participant's management. In addition, it is considered as a Key Generator Center (KGC) for the generation of public parameters and users' secret keys assignment. As the NM may be carried out by the healthcare provider's center or a commercial organization, it cannot be fully trusted. Consequently, the NM only generates a partial private key for the user and it is prohibited to access the patient's health information. Therefore, we can mitigate the key escrow problem and the impersonation attack by the NM.

• WBAN Client consists of a set of sensor nodes and a controller which is used to store the patient's data in an encrypted form. When a data consumer wants to access to a data item from the WBAN client under given contextual information, he can verify the validity of the ciphertext and decrypt the data as long as he possesses the decryption attributes set specified by the signing access structure.

• Data consumers refer to users coming from two different domains, namely public domain (PUD) and personal domain (PSD) ( Li et al., 2013 ). Data consumers in PUD include healthcare providers, e.g., doctors, physicians, nurses, and researchers. However, users who come from the PSD are personally related to the WBAN client (such as family members or close friends). To decrypt a message, data consumers need not only to have the attributes that satisfy the access structure specified by the data owner but also to determine the contextual information related to their domain, the patient's situation, and the data type in order to define their permissions.

Threat model

We consider the NM to be semi-trusted, i.e., curious but honest. That means it will try to disclose as much as possible the secret patient's health information, but it will honestly follow the exchanges between communicating parties. The NM may also impersonate the patient and data consumers. Furthermore, some data consumers will try to access to the WBAN client's data beyond their privileges. In addition, we are concerned with various types of adversaries that can launch different attacks on the system. On the one hand, an adversary may eavesdrop the communication channel, modify or inject counterfeit data during the transmission and reply previously delivered messages. For instance, the eavesdroppers may deduce the source's disease once they find the intended doctor of the WBAN client. Therefore, the privacy of the WBAN client and data consumers is required. On the other hand, it is possible for unauthorized or malicious data consumers to trace back the WBAN client's actions. In this context, it is also needed to guarantee the untraceability for the patient during the exchanges.

Security requirements

The dynamics of the cellular network and the wireless communication between the data owner and the data consumer make the authentication and the patient's privacy vulnerable to many attacks. To guarantee secure extra-body communication, a dynamic and context-aware authentication and authorization scheme should be conceived to ensure the following security and contextual privacy requirements. Based on the previous works ( Li et al., 2016;[START_REF] Xiong | Cost-effective scalable and anonymous certificateless remote authentication protocol[END_REF][START_REF] Samaneh | Wireless body area networks: a survey[END_REF] and the above analysis, the authentication and authorization scheme should satisfy the following functionality features and security requirements.

• Ciphertext Authenticity and public verifiability : To guarantee that only authorized data consumers could access the patient's health information and query messages be protected. It is essential to provide a ciphertext authenticity and public verifiability where the validity and the origin of the ciphertext can be verified without revealing the content of the message or the receiver's private key.

• Context-aware privacy : Based on the contextual information (the patient's condition severity, the data consumer's role, the data type, etc.), the authentication policy and the access structure are defined.

• Anonymity : To protect the patient's privacy, it is essential to ensure that no one including unauthorized data consumers and the NM could obtain the patient's identity from the intercepted message.

• Non-traceability : Only anonymity is insufficient for privacy preservation. Therefore, it is necessary that the authentication scheme could guarantee non-traceability, i.e., adversaries, unauthorized data consumers, and NM cannot trace the WBAN client's action.

• Resilience against attacks : Due to the dynamic and open structure of WBAN, the access control and authentication for WBAN are susceptible to many attacks such as unauthorized access, the impersonation attack, the replay attack, and the modification attack. Therefore, the authentication and authorization scheme should avoid those attacks.

Patient's contextual information

In a healthcare system, medical data should be collected only by the well authenticated and authorized parties when it's needed and depending on the dynamic context changes. In this context, the authentication and authorization policy is defined on the basis of the current situation of both the data owner and the data consumer. It considers not only the data consumer's credentials but also the contextual information which may include the patient's condition, the data sensitivity as well as the data consumers' domain.

Patient's condition

It is necessary to provide dynamic access control while considering the severity of the patient's condition. In fact, it may be classified as normal, serious or emergency reflecting the context that influences the decision-making and the access policy. For instance, in emergency situations, access to the requested data should be granted immediately. In such cases, access is admitted to the requested data regardless of the risk. In this context, each access right to the WBAN client's health information is also delegated to the emergency room.

To prevent the abuse of access without privileges, the emergency staff should contact the NM that manages the emergency room to verify his identity and the emergency situation to obtain temporary access. After the emergency is over, the patient can revoke access via the emergency room. Concretely, a patient with vascular disease can encrypt his data and create the access structure to his own data in an emergency situation labeled as {"vascular disease; emergency"}. Therefore, he permits access to his medical history given that in such cases safety is more important than privacy. In addition, he sends the emergency secret key to the NM through a secure channel. In the proposed model, privacy is relaxed in emergency situations by the fact that clinicians who don't have access to patient health information in normal situations can gain temporary access in critical situations. In fact, in such cases, data availability is more important than confidentiality and the patient may be unconscious, so, unable to change his access policies beforehand. Therefore, the NM will be alerted by the controller which informs the caregivers that a critical situation occurred. Then, the NM finds the medical staff and assigns their access privileges (emergency key) of the patient's medical data according to the emergency case in order to decrypt the stored data in an encrypted form.

Data type

The patient's health records consist of sensitive information such as disease details, family history, treatments, medications, and dosing. But other information such as healthy diet and physical exercise is considered as not sensitive. Therefore, the data should be classified into different categories on the basis of their sensitivity.

Data consumer's domain

In general, data consumers come from two different domains, namely public domain (PUD) and personal domain (PSD) ( Li et al., 2013 ). The PUD includes users who make access based on their professional roles (doctors, nurses, physicians, medical researchers…). They should have access to the patient's sensitive data for diagnosis, treatments, and analysis. On the other side, in PSD, data users are personally associated with a data owner (family members, close friends…) and their access privileges are assigned on the basis of their relationship with the data owner. In order to make the right decision at the right time, they need to have the right information on time about the patient's condition (emergency situation, a disease, treat-ments…).

Efficient Hybrid Certificateless Signcryption (H-CLSC) scheme

In this section, we present the proposed H-CLSC scheme. Then, we give its security model. We exploit the transformation between CP-ABSC and IBBSC [START_REF] Fan | Attribute-Based Encryption from Identity-Based Encryption[END_REF]Javier, 2017 ) which considers an access structure as a set of identities. As mentioned above, a set of attributes are uniquely related to identity. The signer who possesses his own signing key can sign a message if his signing attribute set (corresponding to an identity ID s ) satisfies the signing policy.

Based on the contextual information (patient's condition, the data sensitivity, data consumers' domain) and the set of decryption attributes (corresponding to an identity ID d ), only the data consumer whose attribute set verifies the access structure can decrypt the ciphertext [START_REF] Pang | Anonymous multi-receiver ID-based signcryption scheme[END_REF][START_REF] Li | Privacy-preserving multi-receiver signcryption scheme for heterogeneous systems[END_REF].

H-CLSC algorithm

In order to provide hidden access policy for privacy preservation, a constant size of private keys and mitigate the key es-crow problem in CP-ABSC scheme, we introduce the construction concept of a CP-ABSC scheme from an IBBSC scheme.

Based on this transformation, an access structure is viewed as a set of identities. In addition, a user can generate his own secret key that the NM cannot obtain because it generates only the partial private key. Assume that IBBSC is an identity-based broadcast signcryption scheme with the four phases: System Initialization, Key Generation, Signcryption, and Designcryption. We define the proposed Hybrid Certificateless Signcryption (H-CLSC) scheme as the construction of a CP-ABSC on the basis of IBBSC as follows.

• System Initialization (1 λ ): This algorithm runs ( IBBSC.MK , IBBSC.PK ) ← IBBSC.Setup (1 λ ) and generates the master key MK and the public key PK as ( MK , PK ) = ( IBBSC.MK , IBBSC.PK ).

• Key Generation ( PK , MK , U ): This algorithm takes the public key PK , the master key MK and the set of attributes U as inputs and converts the set of attributes U to an identity ID U ∈ {0, 1} • sExtract (PK, MK, U s ): Given a set of signing attribute set U s , a public key PK and master key MK as inputs, the algorithm generates the signing private key SK Us .

• dExtract (PK, MK, U d , c): Given a public key PK , a master key MK , a set of decryption attributes U d and a contextual information c provided by the receiver, the algorithm outputs the decryption private key SK Ud .

• Signcryption ( PK , M , SK Us , A , c ): The signcryption algorithm takes as inputs the public parameters PK , a plaintext M , the signer private key SK Us , an access structure A which is converted to set of identities S = { ID 1 , …ID n } of receivers and a contextual information c . It outputs the ciphertext CT as follows: IBBSC.CT ← IBBSC.signcryption ( M , PK , S, SK IDs , c ).

• Designcryption ( CT , PK , SK Ud ): The decryptor takes as input the ciphertext CT , the public parameters PK and the receiver's private key SK Ud . The algorithm gets the plaintext M by executing IBBSC.M ← IBBSC.Designcrypt ( CT , PK , SK Ud ).

Security model of the proposed H-CLSC scheme

In this subsection, we formally define the security of the proposed scheme against chosen plaintext attacks. We will use the following games in Section 6 to prove the security of the proposed scheme.

Confidentiality:

The proposed H-CLSC scheme is said to be indistinguishable against chosen ciphertext attacks (IND-(H-CLSC)-CCA) if no PPT adversary A has a non-negligible advantage in winning the following game with a challenger B .

Setup: The challenger B performs the Setup(1 λ ) algorithm of the H-CLSC scheme, sends the public key PK to the adversary A and keeps the master secret key MK to itself. After receiving the public parameters, the adversary declares the set of identities (corresponding to a DNF challenge access structure A * ) S * = { ID 1 * , …ID n * }.

Query Phase 1: The adversary A can ask a polynomial bounded number of queries in an adaptive manner as follows:

• sExtract query: In this query, the adversary can adaptively ask for the signing secret key of the attribute set U s . For the set of the signer attributes, the challenger B executes sExtract (PK, MK, U s ) → SK Us and sends SK Us to the adversary.

• dExtract query: In this phase, the adversary can adaptively ask for decryption secret keys for the sets of attributes U d1 …, U dn which are converted to a set of receivers' identities S = { ID 1 , …ID n } under a contextual information c . For each U di , the challenger runs dExtract ( PK , MK , U di , c ) → SK Udi and sends SK Udi to the adversary. The restriction is that none of the queried set should satisfy the challenge access structure, i.e., ∀ i ∈ [n]:

ID i = ID i * .
•

Adv IND -( H -CLSC ) -CCA GSC (A) = Pr ( b ′ = b ) - 1 2
Unforgeability: The H-CLSC is signature-unforgeable against chosen policy and message attacks if the advantage of any probabilistic polynomial time (PPT) forger F is negligible in the game defined as follows:

Setup: The challenger B runs the Setup(1 λ ) algorithm to generate master key MK that is kept secret and public parameters PK that are given to the forger F . Upon receiving the public parameters, F outputs multiple identities (corresponding to a DNF challenge access structure A * ) S * = { ID 1 * , …ID n * }.

Attack:

The forger F can ask some queries to challenger B as follows:

• sExtract query: In this phase, F can adaptively ask for the signing private key. For the signer attribute set U s , the chal- rectly by every data consumer ID i (having the set of attributes U di ) where i ∈ {1, 2…, n } in the set S , then the source of the sender is verified, CT is valid and F wins the game. The restriction here is that F cannot ask for the decryption private key of ID i * , and CT * cannot be computed by the signcryption algorithm. The advantage of F is defined as the probability that he outputs a valid forgery.

Proposed H-CLSC scheme

The proposed H-CLSC scheme (presented in Fig. 3 ) consists of the following four phases.

System initialization

To initialize the system, this algorithm takes as input a secure parameter λ and performs the following steps:

• Let G 1 be an additive group and G 2 be a multiplicative group with the same prime order q . Then, the NM chooses randomly a generator P of G 1 and constructs a bilinear pairings e :

G 1 × G 1 → G 2 • Let H 1 : { 0 , 1 } * → G 1 H 2 : G 2 → Z q * , H 3 : { 0 , 1 } | M | × Z q * ו •• ×Z q * × G 1 → G 1 , H 4 : Z q * → {0,1}
w and H 5 : {0,1} w → {0,1} |M| be five secure hash functions, where | M | is the length of the plaintext message and w is a random integer

• The NM randomly selects a master key MK ∈ Z q * and com- putes the corresponding public key P pub = MK. P

• It keeps the master key MK secret and publishes the system parameters PK given by:

PK = { G 1 , G 2 , q, e, P, P pub , H 1 , H 2 , H 3 , H 4 , H 5 }

Key generation

This algorithm presents the interaction between the WBAN client/data consumer and the NM. Based on the contextual information c and the set of attributes owned by the user, he proves his authorization and permissions to the NM. After verifying the authorization, the NM uses the master key MK , the public parameters PK, and the given attributes set U to generate a private key SK U . In the proposed scheme, we employ two kinds of key generation algorithms as follows (to distinguish the role of signers and receivers, we define the signing key as SK Us and the decryption key as SK Ud ):

(a) sExtract ( PK, MK, U s ): Given the public parameters PK , the master key MK , and the set of signing attributes U s , this algorithm runs the following steps:

• A signer with a set of signing attribute set U s that is converted on an identity ID Us by exploiting the conversion between access structures and identities, generates a random number α s and calculates the public key PK Us = α s P . Then, he sends ID Us to the NM • The NM computes Q s = H 1 ( ID Us ) and K s = MK . Q s • The NM sends back { K s } through a secure channel to the signer who calculates h = H 1 ( PK Us || ID Us ) and his own signing key SK Us = K s + α s h (b) dExtract ( PK, MK, U d , c ): On receiving the key generation request from a data consumer with decryption attribute set U d under a contextual information c that includes the domain label, the data type as well as the patient's condition, this algorithm performs the following steps:

• The receiver attribute set is converted to an identity ID Ud , then the data consumer selects a random number α d , calculates PK Ud = α d P and sends ( ID Ud , c ) to the NM

• The NM calculates Q d = H 1 ( ID Ud ) and K d = MK . Q d • The NM sends through a secure channel { K d } back to the data consumer who computes h 2 = H 1 ( PK Ud || ID Ud || c
) and defines his own decryption key SK Ud = K d + α d h 2

Signcryption phase

The Signcryption phase is performed by the signer who defines an access structure A for a given contextual information c as follows:

• The access structure A is converted to a set of n receivers with identities S = { ID 1 , …ID n }

• Choose a random number r and a bit string ϐ ∈ {0,1} w and calculates

Y i = rQ di , U = rP , R i = rh 2 i where Q di = H 1 ( ID i ), h 2i = H 1 ( PK Udi || ID i || c ) • For i = 1,2 …n, the signer computes z i = H 2 ( e ( PK Udi , R i ) e ( P pub , Y i ))
• Choose a random s ∈ Z q * and define a polynomial f(x) with degree n as follows:

f ( x ) = n i =1 ( x -z i ) + s ( modq ) = a 0 + a 1 x + . . . + a n -1 x n -1 + x n • Compute ϑ = ϐ H 4 (s) , Z = E H 5 ( ϐ) ( M ), X = e ( Q s , U ) and L = H 3 ( X , U , Z , ϑ, c , t s , a 0 , a 1 ,…a n -1
) and then calculate V = rQs + L . SK Us , where SK Us is the signing key and t s denotes the current timestamp

• Generate the ciphertext: CT = U , Z , ϑ, V , t s , a 0 , a 1 ,…a n -1

Designcryption phase

Given the ciphertext CT , a receiver with an identity ID i ∈ S who possesses a set of authorized attributes executes the following steps to verify the signature and decrypt the ciphertext CT :

• Upon receiving CT = U , Z, ϑ, V , t s , a 0 , a 1 ,…a n -1
, check the validity of t s while verifying | t s -t | ≤ t where t is the preset maximum transmission delay and t is the current time. Reject the message if it is not valid; otherwise,

• Compute h = H 1 ( PK Us || ID Us ) and Q s = H 1 ( ID Us ). • Compute L = H 3 ( X , U , Z , ϑ, c , t s , a 0 , a 1 , …a n -1 )
• Verification: If the equation X = (e ( h , PK Us ) e ( Q s , P pub )) -L e ( V , P ) holds, the ciphertext is valid. Otherwise, the ciphertext is rejected and the receiver drops the decryption process.

• Compute z i ' = H 2 ( e ( SK Udi , U )) and s = f ( z i ' ) • Compute ϐ = ϑ H 4 ( s ) • Recover the message: M' = D H 5 ( ϐ) ( Z )
Correctness of the verification X = e ( V, P ) e ( h, P K Us ) e Q s , P pub

-L = e ( r Q s + L.S K Us , P ) e ( h, P K Us ) e Q s , P pub -L = e ( r Q s , P ) e ( L.S K Us , P ) ( e ( -L.h, α s P ) e ( -L. Q s , MK.P ) ) = e ( Q s , U ) e ( L.S K Us , P ) ( e ( -α s L.h, P ) e ( -L.MK. Q s , P ) ) = e ( Q s , U ) e ( L.S K Us , P ) (e ( -L ( α s .h + MK. Q s ) , P ) = e ( Q s , U ) Correctness of the decryption z ' i = H 2 ( e ( S K Udi , U ) ) = H 2 ( e ( K di + α di h 2 i , rP ) ) = H 2 ( e ( MK. Q di , rP ) e ( α di h 2 i , rP ) ) = H 2 ( e ( MK. Q di , rP ) e ( α di h 2 i , rP ) ) = H 2 e P pub , r Q di e ( P K Udi , r h 2 i ) = H 2 e P pub , Y i e ( P K Udi , R i ) = z i

H-CLSC 's security and performance analysis

In this section, we evaluate the effectiveness and efficiency of the proposed scheme. At first, we conduct a security analysis to present the security functionalities ensured by the proposed scheme. Then, we assess the compliance of the proposed scheme with the Health Insurance Portability and Accountability Act (HIPAA) privacy and security requirements. Finally, a comparative study of benchmarking approaches is performed to assess its security properties, communication overhead, storage overhead as well as computation cost.

Security analysis

• Ciphertext authenticity and Public verification : In the proposed scheme, any third party can verify the validity of the ciphertext CT = U , Z , ϑ, V , t s , a 0 , a 1 ,…a • Context-aware privacy : In order to provide contextual privacy, the proposed scheme implies the contextual information to determine who can access what and under which context. In fact, each access structure is defined on the basis of the dynamic context changes which includes the patient's condition severity, the data type, the data consumer roles and their domains (PUD/PSD). Under such construction, the right access is permitted to the right party.

• Anonymity and untractability : During the authentication and authorization process, the WBAN client can sign a message using a set of signing attributes satisfying a given signing policy. In such an assumption, a signature reveals nothing about the identity of the signer beyond what is explicitly revealed by the attribute-based authentication policy. Under this notion, different signatures cannot be identified as sent by the same WBAN and we can assume that the signer is an authorized user. Therefore, unauthorized data consumers and adversaries cannot disclose who is the WBAN client or assign the multiple authentication sessions to the same patient (trace the patient's action).

• Impersonation attack by KGC and escrow problem : The key escrow problem can be solved in the proposed scheme such that the NM cannot impersonate the WBAN client or the data consumer without being detected. In fact, either the WBAN client or the data consumer can generate his private key by himself and these keys cannot be accessed by the NM. Thus, the NM cannot decrypt messages or impersonate the WBAN client/the data consumer.

• Replay attack : To avoid the replay attack defined as the reception of previously delivered messages, the ciphertext involves the timestamp. Upon receiving the signcrypted message, the data consumer will check the freshness of the timestamp t s before executing the other steps of the designcryption process. In this case, the data consumer could detect the replay attack easily.

• Modification attack : In order to disclose any unauthorized modification of the patient's health information, the WBAN client should use his private key to sign the message on the basis of a predefined access structure. Upon receiving the data, a data consumer could detect any mod-ification by checking the validity of the signature without disclosing the real identity of the signer.

• Security against chosen plaintext attacks : In the following, we present the security proof of the proposed H-CLSC scheme in the random oracle model on the basis of a selective-ID game in [START_REF] Pang | Anonymous multi-receiver ID-based signcryption scheme[END_REF] and [START_REF] Li | Privacy-preserving multi-receiver signcryption scheme for heterogeneous systems[END_REF]. In fact, we will only prove that the IBBSC can satisfy confidentiality and unforgeability given that it has been demonstrated in [START_REF] Fan | Attribute-Based Encryption from Identity-Based Encryption[END_REF] and [START_REF] Herranz | Attribute-based encryption implies identity-based encryption[END_REF] that if an IBBSC scheme is secure, then the conversion from a CP-ABSC to an IBBSC is secure.

Theorem Setup: The challenger B executes the setup algorithm. It sets P pub = aP and sends the public parameters PK = { G 1 , G 2 , q , e , P , P pub , H 1 , H 2 , H 3 , H 4 , H 5 } to the adversary A . Upon receiving the parameters, A outputs the target multiple identities S * = { ID 1 * , …ID n * } that correspond to the challenge access structure A * .

Phase 1: A can request a number of queries. For the adversary A 's hash queries q Hi , the challenger uses H i -list to record the results of hash functions H i , i = 1…5.

H 1 -Queries: A asks a polynomial bounded number of H 1queries on identities of his choice. At the j th-H 1 -query, if ID j = ID i * , B chooses l j ǫ Z q randomly, calculates Q j = H 1 ( ID j ) = l j P and puts ( ID j , l j , Q j ) in H 1 -list . Then, B returns Q j .

• Extract partial private key: When A asks a partial private key extract query on identity ID j , If ID j = ID i * , then B fails and aborts If ID j = ID i * , then the list H 1 -list may contain ( ID j , l j , Q j ). B returns the partial private key K j = l j aP

• Request public key : When A asks a public key extract query on identity ID j , B checks the public key-list which is initially empty. If there is a tuple ( ID j , PK Uj , α j ), then B returns PK Uj .

Otherwise, B generates a new key pair, updates the public key-list and returns the public key.

• Replace public key: When B receives a replace public key query ( ID j , PK Uj ) , B first finds ( ID j , PK Uj , α j ) on public key-list , then, it updates public key-list with tuple ( ID j , PK Uj , ⊥ ).

• sExtract private key: When A asks a signing private key extract query on identity ID j , if B replaces the public key of ID j , then return ⊥ ; otherwise, B finds in public key-list ( ID j , PK Uj , α j ) and returns α j .

• dExtract private key : When A asks a decryption private key extract query on identity ID j and under a contextual information c , if B replaces the public key of ID j , then return ⊥ ; otherwise, B finds in public key-list ( ID j , PK Uj , c , α j ) and returns α j .

H 2 -Query: The challenger B determines if ( P , Q i , P pub , U , W j ) uses DBDH oracle for i ǫ [1, q H 2 ] when he is queried with W j ǫ G 2 for some j ǫ [1, q H2 ] and D ǫ G 2 . If it exists, B should terminate the game for e ( P , P ) abc . D = W l -1 i j . Otherwise, B chooses a random number x j ǫ Z q * and puts a tuple ( W j , x j ) into the H 2 - Attack: F adaptively performs polynomial bounded number of queries similar to those in Phase 1 of Theorem 1 .

Forgery

h = H 1 ( PK Us || ID Us ) = βP Q s = H 1 ( ID Us * ) = bP. B can com- pute: abP = ( V * -V' * ) (L * -L' * ) -1 -βPK
Us as the solution of the CDH problem. Therefore, B solves the CDH problem successfully. Hence, we estimate the advantage of forger's success in solving CDH problem. For q s queries to the signcryption query, the probability that B fails is less than q s /2 k and the probability that B aborts when F makes a partial private key extraction is at most 1/ q ppk , where q ppk is the partial private key extract query. Consequently, if the forger F wins the game, the challenger B 's advantage is:

ε ′ ≥ ε - q s 2 k 1 - 1 q ppk q ppk

Compliance with HIPAA regulations

In this subsection, we discuss the compliance of the proposed H-CLSC scheme with the HIPAA privacy and security regulations. HIPAA aims to standardize security and privacy mechanisms for patient health information. According to HIPAA, a secure remote patient monitoring system should satisfy the following requirements: Patient's understanding, confidentiality, patient's control, data integrity, and consent exception ( Wei-Bin and Chien-Ding, 2008 ).

Patient's understanding

The HIPAA requires that the patient has the right to understand and agree on how his data is used and kept. The digital signature mechanism can protect this right. In the proposed scheme, the WBAN client uses his private key to sign the message. Thus, the signed ciphertext ensures that the WBAN client cannot deny his responsibility for the sent message.

Confidentiality

To guarantee confidentiality, the patient health information is encrypted using H-CLSC and only data consumers who satisfy the access structure can access data. Specifically, the confidentiality of the proposed H-CLSC scheme is proved through formal security analysis ( Theorem 1 ).

Patient's control

In the proposed H-CLSC scheme, the WBAN client has the right to restrict access of any designated data consumer to his data. In fact, he defines who can access what and under which context. Hence, by controlling his access structure, the patient can control access to his data.

Data integrity

In the proposed H-CLSC scheme, the ciphertext is signed, thus, any change in the message will invalidate the signature. Furthermore, there is no efficient way to modify an encrypted message and its signature to produce a new message with a valid signature. Upon receiving the ciphertext, a data consumer could detect any modification by checking the validity of the signature.

Consent exception

The use and disclosure of the patient data without the patient's permission is authorized in an emergency situation for life-saving purposes. In fact, in such situations, a data consumer can gain temporary access while contacting the NM that manages his identity and the emergency key. After the emergency is over, the patient can revoke the emergent access.

Performance analysis

In this section, we conduct a quantitative analysis to assess the security properties of the proposed scheme and evaluate its performance characteristics. In fact, H-CLSC scheme is compared with the LRSA [START_REF] Zhang | Light-weight and robust security-aware D2D-assist data transmission protocol for mobile-health systems[END_REF], R-CLE/S [START_REF] Hu | Revocable and scalable certificateless remote authentication protocol with anonymity for wireless body area networks[END_REF], and CP-ABE [START_REF] Hu | Secure and efficient data communication protocol for wireless body area networks[END_REF] schemes in terms of security properties, storage overhead, communication overhead as well as computation cost. In addition, the security properties of the proposed scheme are assessed according to the HPKI scheme ( Jiankun et al., 2010 ) that verifies the HIPAA requirements. We shall notice that the benchmarking schemes apply different methods to design the authentication and authorization model. As a first step, we will only consider the communication between one data owner and one data consumer to perform the comparison between the different schemes. As a second step, we will study the impact of the number of data consumers on the communication overhead. Only the resource-constrained devices (controller/sensor nodes) are considered. In the following evaluation, the bilinear e employs the Tate pairing. The elliptic curve is defined over F p . The order q of G 1 and G 2 is a 20-byte prime. In order to guarantee 80-bit security level, p should be a 64-byte prime if G 2 is a q -order subgroup of the multiplicative group of the finite field F p2 * . Based on the assumption used in [START_REF] Hu | Secure and efficient data communication protocol for wireless body area networks[END_REF], we can set p to be 42.5 bytes in length for the finite field F p3 * . The length of an element in group G 1 is 1024 bits using an elliptic curve with q = 160 bits. According to the standard compression method [START_REF] Li | An efficient signcryption for data access control in cloud computing[END_REF]Ferrara et al., 2015 ), the size of an element in group G 1 can be compressed to 65 bytes ( Table 1 ).

Security properties

In this subsection, we evaluate the functional security of the proposed scheme while comparing the security properties of the H-CLSC model with the different benchmark schemes in Table 2 . The capacity of the security and privacy preserving scheme is expressed in terms of confidentiality, integrity, anonymity, ciphertext authenticity, public verification, context-aware privacy, certificateless, untraceability, key escrow resilience and resistance against attacks. scheme has significantly lower communication overhead than the LRSA scheme and an acceptable communication cost compared to the R-CLE/s scheme.

Computation cost

In this subsection, we compare the proposed H-CLSC scheme with the benchmarking models in terms of computational cost. As the operations on pairing, exponentiation, and multiplication heavily affect the computational overhead, we only consider these three operations. We denote T E the time consumed for one exponentiation operation, T M the time consumed for one scalar multiplication in G 1 , and T P the time for one pairing operation.

In the H-CLCS scheme, the signcryption process in WBAN client takes six multiplication operations in G 1 and three pairing operations in G 2 . The computational cost for the H-CLCS scheme and the other authentication and authorization models are presented in Table 5 . According to [START_REF] Zhang | Light-weight and robust security-aware D2D-assist data transmission protocol for mobile-health systems[END_REF], to quantify the running time of the operations, the algorithms are implemented on an Intel PXA270 processor at 624 MHz installed on the Linux personal digital assistant. The running time of the different operation are T E = 53.85 ms, T M = 30.67 ms, and T P = 96.20 ms, respectively.

As shown in Fig. 7 , the proposed H-CLSC scheme has the more computational cost compared to the LRSA scheme but achieves better performance compared to CP-ABE and R-CLE/S schemes.

Finally, we can notice that the proposed H-CLSC scheme achieves better performances when we employ the MNT curve of embedding degree k = 6, q = 160 bits and a field size of G 1 = 160 bits [START_REF] Lu | EPPA: an efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF][START_REF] Ruj | A decentralized security framework for data aggregation and access control in smart grids[END_REF].

Conclusion

In this paper, we have proposed a novel efficient Hybrid Certificateless Signcryption (H-CLSC) scheme that combines the features of CP-ABSC and IBBSC to provide context-aware access control and anonymous authentication. Security analysis proved the effectiveness of the proposed scheme that can satisfy confidentiality, integrity, anonymity, context-aware privacy, untraceability, ciphertext authenticity, and public verifiability. Furthermore, the key escrow problem is solved through our model while using certificateless signcryption. Performance analysis demonstrated the efficiency of the H-CLSC scheme that has lower storage and communication overhead than the benchmarking schemes. In addition, the proposed scheme ensures a desired computational cost compared to the other schemes.

Fig. 1 -

 1 Fig. 1 -An example of access structure.

Fig. 2 -

 2 Fig. 2 -System model.

  Signcryption query: The Adversary A executes the Signcryption algorithm to get the ciphertext CT = Signcryption ( PK , M , SK Us , A , c ), it takes as input the public key PK , the plaintext M , the signer private key SK Us , the access structure A which is converted to a set of receiver's identities S = { ID 1 , …ID n } and a contextual information c . • Designcryption query: The adversary issues decryption queries and sends to B ( CT * , ID i ) where CT * is the ciphertext generated by A and ID i is the identity chosen by B and ID i ∈ S * . S * = { ID 1 * , …ID n * } is the set of identities (corresponding to the access structure A * ) chosen by the adversary. Then, upon receiving the decryption query, the challenger B runs the algorithm Designcryption ( CT * , PK , SK Udi ) → M and returns M to A if it is a valid plaintext; otherwise, it outputs a "failure" message ⊥ . Challenge: The adversary A chooses two target plaintexts M 0 and M 1 and a signing set of attributes U s which corresponds to an identity ID Us and sends them to the challenger B . When receiving the target plaintexts and the private key SK Us , B randomly chooses b from {0,1} and executes Signcryption ( PK , M b , SK Us , A * , c ). Then, the challenger sends CT * to the adversary. Query Phase 2: After receiving CT * the adversary can perform a number of queries like Phase 1. Note that A cannot query the identity information S * = { ID 1 * , …ID n * } in the dExtract query and cannot query the ciphertext CT * in the Designcryption query. Guess: The adversary outputs his guess b ' ∈ {0,1} and wins the IND-(H-CLSC)-CCA game if b = b' . The advantage of the adversary A in the above game is defined as:

Fig. 3 -

 3 Fig. 3 -H-CLSC Authentication and Authorization scheme.

Fig. 6 -

 6 Fig. 6 -Communication overhead vs . number of data consumers.

Fig. 7 -

 7 Fig. 7 -Computational cost comparison.

  n -1 without any information about the message M or the private key of the receiver. In fact, for a given public parameters PK , a sender identity ID Us (corresponding to the signer set of attributes U s ), a signer public key PK Us , anyone can verify the signer's signature and compute h = H 1 ( PK Us || ID Us ), Q s = H 1 ( ID Us ) and e ( V , P ) = ( e ( h , PK Us ) * e ( Q s , P pub )) L * e ( Q s , U) . If the ciphertext isn't valid, the receiver can reject the ciphertext without decrypting it.

  We construct a challenger B that interacts with an adversary A to solve the instance of DBDH while computing e ( P , P ) abc from an instance ( P , aP , bP , cP ) of the DBDH problem. We consider five oracles H 1 , H 2 , H 3 , H 4 and H 5 to simulate the system for B . The adversary A can queries PPT times to the oracles. B runs each phase of the IND-HCLSC-CCA game as follows:

	1. A Hybrid Certificateless Signcryption (H-CLSC) scheme
	is said to be indistinguishable against chosen ciphertext attacks
	(IND-(H-CLSC)-CCA) if no probabilistic polynomial time (PPT) ad-
	versary A has a non-negligible advantage in winning the IND-(H-
	CLSC)-CCA game under the DBDH assumption.
	Proof 1.

:

  The forger F generates a tuple ( CT * , ID Us * , L * , PK Us * ). If ID Us = ID i * , i = 1 …n , B aborts. Otherwise, B chooses different hash function L' * and interacts with F through the same random tape, then the attacker can output a different forger CT' * , L' * . According to the above analysis, both CT * and CT' * should satisfy the public verifiability condition.

	X = e ( h, P K Us	* ) e Q s , P pub	-L *	e ( V * , P )
	X = e ( h, P K Us	* ) e Q s , P pub	-L ' *

e ( V ' * , P ) Where

Table 1 -

 1 Notation used in the proposed H-CLSC scheme. An additive group with order q G 2 A multiplicative group with order q e A bilinear pairing P A generator of the group G1 H 1 H 2 H 3One-way hash functionsH 4 H 5 PK, MKSystem public key and master key PK UiThe public key of user i SK UiThe secret key of user i UThe universe of attributes U iThe attributes set of user i A An access structure cPatient's contextual information {user's domain, data type, patient's status} t sThe current timestamp of the WBAN clientE k (), D k ()The symmetric encryption and decryption where k is the key.

	Notation	Description
	q	A prime number
	G 1

Table 2 -

 2 Overall comparison of security properties.

Scheme

LRSA R-CLE/S CP-ABE H-CLSC HPKI

list . Then, B returns x j to the adversary A .

H 3 -Query: Upon receiving the tuple ( X j , U j , Z j , ϑ j , c , t s , a j 0 …, a jn-1 ) where j ǫ [1, q H 3 ], B picks randomly a value L j ǫ Z q * and puts the tuple ( X j , U j , Z j , ϑ j , c , t s , a j 0 …, a jn-1 , L j ) into the H 3 -list .

Then, B returns L j . H 4 -Query: As an integer s j is sent to the H 4 oracle where j ǫ [1, q H4 ], B chooses a random string w j ǫ {0,1} w and puts ( s j , w j ) into the H 4 -list . Then, the string w j is sent to the adversary A .

H 5 -Query: When A asks for the string ϐ j ǫ {0,1} w for j ǫ [1, q H 5 ], B picks a random string p j ǫ {0,1} |M| and puts the tuple ( ϐ j , p j ) into the H 5 -list . Then, B returns p j to the adversary A . (1) Randomly choose r' ǫ Z q * and compute

Key Generation query

* and define a polynomial f(x) with degree n as follows:

Designcryption query: When the adversary asks for a designcryption query, he sends ( CT j , ID i * ) to B where i ǫ {1, 2…n }, CT j = U j , Z j , ϑ j , V j , t s , a j 0 , a j 1 , …a jn -1 . Then, the challenger B runs the following steps:

(1) Check the list H 3 -list to find the tuple ( X j , U j , Z j , ϑ j , c , t s , a j 0 …, a jn-1 ). If it was found, B gets ( Z j , ϑ j ). Otherwise, the challenger B aborts and returns failure. (2) Construct the polynomial f(x) = a j0 + a j1 x + . . . + a jn -1 x n -1 + x n (3) Search the tuple ( ID j , l j , Q j ) in the list H 1 -list . (4) For l = 1…q H2 , execute the following steps:

(a) Search the tuple ( W l , x l ) from the list H 2 -list . (b) Judge whether ( P , Q i , P pub , U j , W l ) uses the DBDH oracle by verifying the equation e ( P, P )

holds, where L j = ( X j , U j , Z j , ϑ j , c , t s , a j 0 …, a jn-1 ). If it holds, then get the plaintext M j . (6) Otherwise, B sends "failure" to A , which indicates that the ciphertext generated by the proposed scheme is invalid.

Challenge:

The adversary A outputs a target plaintext pair ( M 0 , M 1 ) and an arbitrary signing private key SK Us to the challenger B . B randomly chooses βǫ{0,1}and signcrypts the message M β . Then, the target ciphertext CT * = U , Z , ϑ, V , t s , a 0 , a 1 , …a n -1 is generated and sent to the adversary A , where

Phase 2: A performs new queries as Phase 1. Note that the adversary cannot query the information of ( ID 1 * , …ID n * ) in the key generation query and CT * in the designcryption query . Guess: The adversary A outputs its guess β' ǫ {0,1}. If β' = β, A needs to issue H 2 query on = e ( P pub , Y i ).D = e ( aP , r'l i P ).D = e ( P, P ) ar ′ l i .D = e ( P ,P ) abc .D . Hence, e ( P , P ) abc can be extracted from H 2 -list . According to the above analysis, we can get the advantage of B as the following equation. For q d times Designcryption query, the probability that B rejects the valid ciphertext is less than nq d /2 k . So, if A wins the game, B 's advantage is given by:

Theorem 2. A Hybrid Certificateless Signcryption (H-CLSC) is signature-unforgeable against chosen policy and message attacks if the advantage of any probabilistic polynomial time (PPT) forger F is negligible in the SUF-(H-CLSC)-CMA game under the CDH assumption.

Proof 2. We construct a challenger B that interacts with a forger F to solve the CDH problem while computing abP from an instance ( P , aP , bP ). We consider five oracles H 1 , H

Storage overhead

The storage overhead is an expressive metric of any authentication and access control scheme because both the client and the data consumer should store the secret keys for Signcryption/Designcryption. In the H-CLSC scheme, the WBAN client and the data consumer need to store { SK Ui }, where SK Ui is an element of G 1 . Therefore, the users' storage overhead is 65 bytes. As presented in Table 3 , the WBAN client in the proposed scheme requires less storage overhead than the other schemes [START_REF] Zhang | Light-weight and robust security-aware D2D-assist data transmission protocol for mobile-health systems[END_REF][START_REF] Hu | Secure and efficient data communication protocol for wireless body area networks[END_REF][START_REF] Hu | Revocable and scalable certificateless remote authentication protocol with anonymity for wireless body area networks[END_REF].

As shown in Fig. 4 , for the CP-ABE scheme, the storage overhead increases with the number of attributes. However, in the H-CLSC scheme, the storage overhead is independent of the number of attributes and it has a fixed size.

Communication overhead

The encrypted data should be stored in the controller and transmitted to the data consumers when requested. In this context, the communication overhead is mainly associated with the size of the ciphertext. In the proposed scheme, the ciphertext size dependent on the number of consumers. Firstly, as shown in Table 4 and Fig. 5 , we considered only one data consumer and conducted comparisons in terms of communication overhead between the four schemes. In the proposed H-CLSC scheme, the WBAN client needs to transmit:

where w is the bit length of a string and we assume that w = 10 bytes and n is the number of data consumers.

Fig. 6 illustrates the impact of the number of data consumers on the communication overhead which increases linearly with the number of data consumers. The proposed

Conflict of Interest

All authors have participated in (a) conception and design, or analysis and interpretation of the data; (b) drafting the article or revising it critically for important intellectual content; and (c) approval of the final version. This manuscript has not been submitted to, nor is under review at, another journal or other publishing venue.

The authors have no affiliation with any organization with a direct or indirect financial interest in the subject matter discussed in the manuscript.


Sidi Mohammed Senouci

Mohamed Feham
email: m_feham@mail.univ-tlemcen.dz

Keywords: component, Smart-Grid, electric vehicles, charging stations, genetic optimization, k-means clustring

Green mobility solutions are receiving currently an enormous attention. Indeed, during last years, electric vehicles, being part of the field of the smart-grid, entered the automobile market of the whole world. This technology requires an effective deployment of charging stations of electric refill since the main problem in this system remains over the duration of refill of the batteries. In this work, we propose an optimized algorithm to locate electric charging stations. The main task of the algorithm is to find the best site of charging stations locations so as to minimize loss on the way to the charging station, as well as minimize investment cost, we take into account several constraints to find the optimal number and placement of charging station . Our hybrid algorithm with improved K-means clustering and genetic algorithm can be used to find optimal number and place of charging stations.

I. INTRODUCTION

Economic, security, and environmental pressures are driving countries around the world to electrify transportation, which currently accounts for nearly 72 percent of global oil demand [1]; Electric vehicles (EVs) could play a central role in decarbonizing road transport. But this new type of electricity load will need careful management.

A lot of efforts are done to install the necessary infrastructure such as charging stations, electricity factory and solar panels. It is therefore crucial that the deployment of charging stations be as much as possible in tune with the expected mobility of electric vehicles. It is also important that new variables, specific for electric charging stations, be cast in the problem to be addressed. Although charging at home is the first choice for many EVs owners living in their houses, many other EVs users who don't have private parking places or garages will have to use public charging facilities [START_REF] Hu | Distribution Network Expansion Planning with Optimal Siting and Sizing of ElectricVehicle Charging Stations[END_REF].

In this paper we study the problem of public charging stations deployment through the lenses of optimization. We consider in our study several constraints (installing cost, distance between charging stations and clients, charging stations capacity, etc.). Proposed hybrid algorithm includes improved k-means clustering w h i c h i s e m p l o y e d t o minimize the distance towards charging stations. Then genetic algorithm with a new representation is used to amend result and find optimal place for charging stations with minimal cost.

II. OPTIMIZATION PROBLEM MODELING

Optimization algorithms can be used to find the optimal location of public charging stations with minimizing the sum of users' cost on the way to the charging station and the investments of station's installation.

A. The establishment of the objective function

In order to determine the location of the charging stations, the objective function can be modeled as follows:

(1)

In the equation, is the construction investments cost;

is the loss cost of users on the way to the charging station.

and =1 represent the weight of each function

• The cost of transportation loss:

In the formula (2) , is the set of customers, is the set of possible locations to establish a charging station CS, is the distance toward charging stations , and represents the cost of the closeness of client i to the charging station j.

Let X be the binary matrix, such that: = • Investment cost of charging station, can be expressed as:

Where is the number of the charging stations; is the investment cost to build charging station;

Decision variable to open or not charging station .

A Hybrid Algorithm for Planning Public

Charging Stations

B. Constraints

The solution feasibility depends on different constraints represented by the following equations:

(4): ensures that client j is affected only to one charging station.

(5): guarantees that the sum of energy demand is smaller than the charging station capacity.

B. The initial number of charging stations

It is calculated based on the demand of clients and the minimum capacity of charging station (CS) as : The total charging demand of clients : The number of charging stations : The minimum capacity of charging station And

B. Service area partitioning and selection of initial location of the charging station

Based on the estimated number of charging stations, we partition the studied area such that the number of partitions is equal to the number of initial charging station; we initialize the location of charging stations in the center of each small area. III.

PROPOSED ALGORITHM

A. The central idea

In this work we use a hybrid genetic algorithm and kmeans clustering to solve the problem of public charging station location. In the proposed method we use an improved k-means algorithm, which includes capacity as one of the constraints for clustering the items to split data to k cluster.

The initial centroids of k clusters are the center of zone mentioned above. The iterative procedure is used to assign the clients to the nearest cluster (station) based on the minimum distance between stations and client such that a cluster's total demand does not exceed the delivery capacity of the station [START_REF] Geetha | Improved K-means algorithm for capacitated clustering[END_REF].Then, genetic algorithm improves the quality of obtaining solutions with his deferent operators : selection, crossover and mutation.

B. Genetic k-means algorithm for location of charging stations

Fitness

The objective function evaluates the performance of each genome in the population, this function takes a genome as input and returns a number that measures the genome's performance K-means clustering steps: a) Define k objects (k = number of stations) using [START_REF] Sumo | [END_REF], and their initial location as initial cluster centers (cluster centers = station location), b) Measure the distance ( ) from each vehicles to the nearest cluster center c) Calculates the new centers for the clusters. These new representatives of clusters correspond to the average of the individuals of the cluster d) Compute the fitness value using (8). e) Return to step (b) until two successive iterations lead to the same partition

It is important to note that our k-means clustering algorithm includes the constraint of capacity. For that, we calculate the charging demand of clusters in each step. If or we assign clients to the second nearest station.

We calculate the one-hour demand of each cluster using (9), and table II. This demand depends on the rate of electric vehicles, traffic, charging station capacity and daily driving trip [START_REF] Mehar | An optimization location scheme for electric charging stations[END_REF].

Where

the demand of charging in cluster k, and nb is is the number of clusters.

Genetic code

Every genetic algorithm must have a representation of each member of the population. As depicted in fig 1, the top box represents the genome observed and referenced by the user, this genome is denoted as a vector ,.., where is the chromosome for the k_th charging station . The bottom box represents the bit string manipulated by the system Note that each charging station attribute, namely the center coordinates of the cluster, maps to an N bit binary string. All genetic operations are performed on this bit string [START_REF] Egan | Locating clusters in noisy data: a genetic fuzzy c-means clustering algorithm[END_REF].

IV. EXPERIMENTAL ANALYSIS AND VALIDATION

In order to provide the algorithm, we study in this section the planning of charging stations in "TAPAS Cologne'' city, we use our approach to find optimal place and number of charging stations in this area .

The "TAPAS Cologne" simulation scenario describes the traffic within the city of Cologne (Germany) for a whole day; this system computes mobility wishes for an area population generated based on information about travelling habits [START_REF] Sumo | [END_REF]. In this study we considered the case of a peak hour.

The charging demand and the preliminary positions of charging stations in the initial partitions are shown in the Table below. As the above table show, there are 3437 electrics vehicles in the development zone. The capacity of every vehicle's battery is 30 kWh with average of 100 km; electric price is 3.3 Euro. It is supposed that the maximum capacity of charging station is 30% of her minimum capacity wish is 274 Kva and sufficient charging duration (dur) for daily driving 1/4 hours. The investment cost of one charging station (materiel+ installation) is 800 euro.

We found that the maximum number of charging stations is 12. This number can be obtained by solving equation [START_REF] Sumo | [END_REF].

Matlab is adopted to program our algorithm, equation ( 9) is taken as the objective function, equation ( 4), ( 5) as constraints to initially search the optimal solution, and then the optimal number of charging stations, their locations is shown hereafter. V.

CONCLUSION

This paper presents a hybrid algorithm, which includes genetic and k-means clustering algorithm in order to search the best location of public charging stations in a studied area, first an improved k-means clustering witch considered the capacity of charging stations is used to minimize distance toward charging stations; then genetic algorithm is applied to increase space of research and find optimal places of charging stations. Our algorithm searches the optimal location of charging stations with the objective of minimizing both the investment and transportation cost. The test results shows that our model and the method proposed are feasible to find the minimum cost and optimal place for charging stations.

Optimal deployment of charging station for electric vehicles is a heavily studied combinatorial optimization problem, many other factors can be considered to develop our algorithm such as defending the optimal capacity of charging stations by defining optimal number of chargers in charging stations which affect on investment cost and waiting time to refill.

Fig. 1 .

 1 Fig. 1. Genetic code

TABLE I .

 I NUMBER AND LOCATION OF CHARGING STATIONS

	Num of	Coordinate of initial	Number of vehicles in
	zone	stations (km)	each zone
	1	1.7377 1.0420	308
	2	2.1745 0.8284	477
	3	1.6407 0.6599	06
	4	1.7960 0.8464	05
	5	1.1405 1.2469	724
	6	1.1166 1.7790	792
	7	1.5139 1.3818	160
	8	1.7293 1.5490	223
	9	2.0691 1.6316	236
	10	1.7650 1.7118	02
	11	1.4927 2.2097	14
	12	1.8235 1.6951	490

TABLE II .

 II BEST LOCATION OF EV CHARGING STATIONSAs can be seen from table I, 12 charging stations were basically located in the gravity center of each partition, by applying our method we tend to reduce this number to only 5 charging stations , their best location are shown in tableII.TableIIIsummarized the results of 400 simulations for different scenario where we vary the capacity of charging stations.

	Optimal number of charging stations : 5
	Item	Location (km)
	Charging station 1	(1.0155 1.1471)
	Charging station 2	(0.8566 1.7164)
	Charging station 3	(0.3290 1.7686)
	Charging station 4	(2.0417 0.8406)
	Charging station 5	(1.3139 1.3967)

TABLE III .

 III RESULTS

	Num of initial	CS_CAP	Number of CS	Fitness
	CS	(kvA)	final
	12	274	5	4576
	18	200	7	6283
	33	100	12	10496


domain: phys math

text:
AFSCET Olivier Maurice

Olivier Maurice Christoffel'

Christoffel's coefficients under laplace's formalism

Introduction

In [START_REF] Olivier | From R 4 curvilinear space to the cycle space[END_REF] and [START_REF] Olivier | Inclusion of the tensor analysis of networks into differential geometry[END_REF] we develop various proposals for the tensor analysis of networks under Laplace's formalism. Between many equations we submit replacing time derivative by the simple product with k, Laplace's operator. This may astonish some readers and call for some more details.

Basic working leading to Christoffel's coefficients

We consider a vector ⃗ l defined in the edge space on the base e α , itself defined by the fiber u k [START_REF] Olivier | From R 4 curvilinear space to the cycle space[END_REF]. A little differenciation on ⃗ a can be written: [START_REF] Murray | Transformées de Laplace[END_REF] d ⃗ l = ⃗ e α dl α + l α d⃗ e α

The u k defining a parametrized hypersurface of parameter t, we can write:

(2)

d ⃗ l dt = ⃗ e α dl α dt + d⃗ e α dt l α
But we can write differently the second term. It's a very important step because often we don't know the time derivative of the base vector, to see it can have no meaning, while their derivation depending on the space elements has a strong meaning. So, as usually made we write:

( which leads under Laplace's formalism [START_REF] Murray | Transformées de Laplace[END_REF] to:

(7) k ⃗ l = ⃗ e α (kl α + Γ α νσ kq ν l σ ) This have meanings because l as q are respectively currents and loads in the edge space. As they are linked with electromagnetic fields, they can be written in the Laplace's domain.

Christoffel's symbols in a space transformation

Going from the edge space to the cycle one we obtain expressions of the form:

(8) E α = d dt g αb L ba g aµ a µ
here a µ is a cycle current, L the electromagnetic inertia and g the metric of the edge space or its inverse. We can define a cycle load deducted from the cycle current:

(9) Q µ = k -1 a µ
Let's write:

(10)

d dt g αb L ba g aµ a µ = d dt g αb (L ba g aµ ) a µ + g αb d dt L ba g aµ a µ + . . . . . . + g αb L ba d
dt g aµ a µ + g αb L ba g aµ d dt a µ Knowing that dL/dt = 0 we obtain:

(11) ∂g αb ∂Q ν dQ ν dt (L ba g aµ ) a µ + g αb L ba ∂g aµ ∂Q ν dQ ν dt a µ + L αµ d dt a µ
We see here the great advantage to use the proposal of considering g as a metric [START_REF] Olivier | Inclusion of the tensor analysis of networks into differential geometry[END_REF]. Now using:

(12) Γ αb,ν = ∂g αb ∂Q ν and (L ba g aµ ) a µ = Φ b this leads to:

(13) d dt g αb L ba g aµ a µ = Γ αb,ν a ν Φ b + g αb L ba Γ aµ,ν a ν a µ + L αµ d dt a µ
We can create a new object Ω with:

(14) Ω αµ,ν = g αb L ba Γ aµ,ν
And using Laplace's formalism we obtain finally:

(15)

E α = Γ αb,ν a ν Φ b + Ω αµ,ν a ν a µ + kL αµ a µ 4.
On the legitimacy of distributivity applied to Laplace's operator

The unique variables being expressed as sinusoidal functions are the currents and loads. When the time derivative is applied on the metric or an impedance, it cannot be by the fact replaced by a product with Laplace's operator. Fortunately, this time derivatives can generally be replaced by a space derivative multiplied by the time derivative of the space, using as previously for an object O:

(16) d dt O = ∂O ∂Q σ d dt Q σ → ∂O ∂Q σ kQ σ
That's through this mechanism that we can still use the classical replacement of the time derivative even when at first, the object is not an exponential function.

On the time meaning

The simplest image for thinking of time is probably a clock, turning infinitely. A complete revolution of its clock hand can be assimilated with a time duration or period T . Once this period defined, things become easy. Laplace's fundamental spectrum is developed on all the period multiples k/T . And the particles energy E is linked with this period also: E = -iℏk.

Here we see that Laplace's operator is as legitimate as the classical time for being the fourth axes of space.

The concept of time was drastically reviewed after Einstein's relativity formulation. Lorentz-Poincaré's transformation changed Galilée's one adding principally the term γ = 1 -v 2 /c 2 -1 . First Galilée's law gives x ′ = x + V t. By analogy, the time follows something similar with its equivalent length ct:

(17) ct ′ = ct + V τ
The time length τ translating the information displacement x/c. This gives:

t ′ = t + V x/c 2 .
Adding the relativistic correction we arrive to:

(18)

t ′ = γ t + V x c 2
Dividing both members by the time in the referential in movement, we write the ratio of time duration in both referentials:

(19) t ′ t = γ 1 + ax c 2
a is this time the acceleration in the observed referential. But the acceleration is equal to the gravitation acceleration g, due to the equivalence between the inertia mass and the weighted one. The gravitational field itself derives from the gravitation potential Φ: g = Φ/x, leading to [START_REF] Einstein | Oeuvres choisies[END_REF]:

(20) t ′ t = γ 1 + Φ c 2
This relation can be applied to periods with:

(21) T ′ = T γ 1 + Φ c 2 and so, Laplace's transform becomes:

(22) k T ′ = k T γ 1 + Φ c 2 -1
In presence of a gravitational field, the period increases and the Laplace's fundamental component decreases: the energy spectrum is displaced on the left. Basically this means that one clock turn represents a higher time duration T ′ rather than without gravitation T . Near black holes, this period may increase until a value for which the time disappears, i.e. that the period becoming so long that the time perception cannot discerns the clock turning as if they was no longer any time evolving [START_REF] Hawking | L'univers dans une coquille de noix" or "The Universe in a Nutschell[END_REF]. Seen from Laplace's operator, all work as if there was only one frequency, all the spectrum being jailed in this single spectrum ray of very straight width. And the frequency value of the spectrum ray tends to zero. Perhaps the best representation of the time goes through this duality with Laplace's operator. The clock rotation describes both the time rhythm and the fundamental energy spectrum frequency.

Conclusion

It was not so obvious to accept the use of Laplace's transform applied for differential geometry. In fact it has meaning that this use being possible. It recalls that in tensor analysis of networks, the fundamental base is a harmonic function intrinsically described by Laplace's formalism.

Following quantum mechanics, wave vector is a harmonic function. This context is favorable to the application of the relationship discussed here. But this is also a good argument for justifying its use.

Equation 7 resume our discussion showing the covariant derivative under Laplace's formalism. But it must be kept in mind that the strong condition for being authorized to do it is the harmonic behavior of the variables concerned.

The harmonic representation associated with Laplace's transform gives as many information as the classical time rhythm do. Both variables are dual: it's all the more true when we think of particles description.