Sinicȃ Alboaie

Doina Cosovan

Private Data System Enabling Self-Sovereign Storage Managed by Executable Choreographies

Keywords: Privacy Enhancing Technique, Privacy by Design, Privacy by Default, data self-sovereignty, privacy, private data, distributed storage, executable choreography

With the increased use of Internet, governments and large companies store and share massive amounts of personal data in such a way that leaves no space for transparency. When a user needs to achieve a simple task like applying for college or a driving license, he needs to visit a lot of institutions and organizations, thus leaving a lot of private data in many places. The same happens when using the Internet. These privacy issues raised by the centralized architectures along with the recent developments in the area of serverless applications demand a decentralized private data layer under user control. We introduce the Private Data System (PDS), a distributed approach which enables self-sovereign storage and sharing of private data. The system is composed of nodes spread across the entire Internet managing local key-value databases. The communication between nodes is achieved through executable choreographies, which are capable of preventing information leakage when executing across different organizations with different regulations in place. The user has full control over his private data and is able to share and revoke access to organizations at any time. Even more, the updates are propagated instantly to all the parties which have access to the data thanks to the system design. Specifically, the processing organizations may retrieve and process the shared information, but are not allowed under any circumstances to store it on long term. PDS offers an alternative to systems that aim to ensure self-sovereignty of specific types of data through blockchain inspired techniques but face various problems, such as low performance. Both approaches propose a distributed database, but with different characteristics. While the blockchain-based systems are built to solve consensus problems, PDS's purpose is to solve the self-sovereignty aspects raised by the privacy laws, rules and principles.

Introduction

Every time a user needs to create an account, he needs to provide a lot of private information, like name, birth date, gender, marital status, and so on. Even more, he needs to choose and answer to some security questions for account recovery in case he forgets the password or simply for user validation when performing sensitive actions. These security questions usually consist of private data as well.

This way, each user spreads his private data to a lot of organizations / companies / service providers. This raises two main issues: one is related to data protection and the other -to data duplication. In regards to data protection, each organization has its own ways of storing and protecting the data. Some are better than others. The user's data is as safe as the weakest organization to which the user provided his data. Thus an attacker can target the weakest link to learn private information. The data duplication issue consists mainly of the fact that changing a piece of private information (like changing the last name by getting married) requires updating it in all the places this particular piece of private information was saved, which is burdening and time consuming.

An existing way of solving these problems is by using single sign-on techniques. But this makes the user dependent on the single sign-on provider because losing access to the account used for single sign-on means losing access to all the accounts authenticating the user with this single sign-on account.

We propose a solution that enables users to keep full control over their private data. Private Data System (PDS) is a distributed scalable system composed of three types of nodes, transparently spread across the entire Internet: audit, index and storage nodes. Each node manages a local key-value database and each type of node has its own purpose in the system, as explained further.

Each piece of private information is split into undecipherable chunks. Each chunk is assigned a different partial key in a different key-value database managed by a different storage node. The association between these keys is stored under a master key in a key-value database managed by an index node. Since the data needs to be accessible by different processing nodes, the master key is referenced by different key references. The association between them is stored under a key reference in a key-value database managed by an audit node. The key references are the only points of access to the actual data. Hence it also contains information regarding who owns the referenced data, who was this particular key reference shared with, and metadata describing the referenced data.

The communication between nodes is achieved with the help of executable choreographies, which visit the needed nodes in the needed order, execute on each node the needed operations, and return to the user with the results.

An interesting use case of using PDS are social networks and other systems which, besides private data, manage also trust and reputation data [START_REF] Alboaie | Trust and reputation model for various online communities[END_REF].

We will start by reviewing the related work (Section 2) and introducing the system along with its elements (Section 3). Then, we'll explain how CRUD (create, read, update, delete) and sharing / revoking operations work (Section 4). In the end, we will analyze the proposed system from the privacy perspective (Section 5), conclude (Section 6), and present future directions in regards to the proposed system (Section 7).

Related Work

Smart systems integrate technology, organizations and people in order to accomplish complex processes that are controlled by computer systems. For a large number of integration points, integration is achieved through classical ESB (Enterprise Service Bus) -type systems [START_REF] Chappell | Enterprise service bus -theory in practice[END_REF], MOM (Message-Oriented Middleware) systems [START_REF] Curry | Message-oriented middleware[END_REF], systems based on EIP (Enterprise Integration Patterns) [START_REF] Hohpe | Enterprise integration patterns: Designing, building, and deploying messaging solutions[END_REF] or through the orchestration of services through custom code or languages used to model business processes [START_REF] Ryan | A computer scientist's introductory guide to business process management (BPM)[END_REF].

All these methods tend to be sufficient to integrate the components belonging to one organization. On the other hand, the integration among multiple organizations should be addressed using choreographies as any centralized solution is risky in terms of security and private data protection. Composition of systems using orchestration tends to create centralized systems.

Although many authors perceive choreographies as a mechanism to describe in a more formal way the contracts among several organizations [START_REF]Wscdl specification[END_REF], the academic research proposed the concept of executable choreographies [START_REF] Akkawi | An executable choreography framework for dynamic service-oriented architectures[END_REF] [6] [START_REF] Besana | An executable calculus for service choreography[END_REF]. They suggest transforming the descriptions of the choreographies in code that is executed inside each organization participating in the choreography. As such, a choreography is not only a formal description of a contract among organizations but also a description of a workflow in an executable way. The same description (choreography) gets to run in several organizations in a decentralized manner (without the need for a centralized conductor) and therefore any need to translate the choreography into other programming languages disappears.

While PDS could be implemented outside the world of the executable choreographies, we believe that choreographies are suitable for the complex workflows operating across multiple organizations. The code of the executable choreographies is verifiable at a higher level and can provide confidence that the implementation provides the privacy properties of the theoretical model.

Another advantage of the executable choreographies is that it comes with a solution for the self sovereign identity. The Sovrin Foundation explains in [START_REF] Tobin | The inevitable rise of self-sovereign identity[END_REF] why the rise of the self sovereign identities was inevitable and details the path that had to be traversed for the community to come to this conclusion.

For PDS, the data owner must be identified and authorized. Supplementary benefits in the data leakage preventions could be achieved if the data owner is identified in all the other organizations contributing to a request without leaking its identity (using some anonymous aliases controlled by the data owner). The executable choreographies aim at offering these benefits without any supplementary implementation effort. However, detailing the way in which the self sovereign identities used by the data owners and processors are authenticated and authorized is not the purpose of this paper. It is a complex enough topic to require its own paper, so we will revisit this issue at a later date.

In regards to the advances related to data sovereignty, we would like to mention [START_REF] Esposito | Encryption-based solution for data sovereignty in federated clouds[END_REF], which proposes storing encrypted data in cloud federations and [START_REF] Rakesh Agrawal | Information sharing across private databases[END_REF], which proposes sovereign information sharing in order to integrate the information belonging to autonomous entities. Queries are executed on the databases and reveal only the results. The work is continued in [START_REF] Agrawal | Enabling sovereign information sharing using web services[END_REF] which enables sovereign information sharing using web services. This work applies to service providers which want to allow queries on their databases without sharing the content on which the queries are executed. Our work focuses on the average user which needs to own and store his data in a single place and provide / revoke access to it to various service providers as needed.

Note that [START_REF] Zachary Nj Peterson | A position paper on data sovereignty: The importance of geolocating data in the cloud[END_REF] introduces the data sovereignty notion for establishing the nation-state where the cloud storage service providers are storing the data physically in order to ensure they are meeting their contractual geographic obligations. In this paper, we consider data sovereignty to be the ability of the user to have full control over his data and the entities to which it is shared or revoked.

States and international organizations start to gradually introduce principles and standards, the most notable being Privacy By Design [START_REF] Mckean | Eu data protection reform -privacy-by-design[END_REF]. Collecting information in parallel with the absence of technical constraints on how companies can use the data intentionally or unintentionally begins to be perceived as a risk. On the one hand, there are risks for companies because users could refuse to adopt privacy challenged technologies. On the other hand, we have risks regarding the whole society, the most obvious being represented by the potential that some companies can influence society in illegal and immoral manners.

Commercial exploitation of private data has come to create the impression that people are exploited commercially in ways that do not adequately compensate for the risks they take. A more transparent model that allows fair and equitable use of personal data is needed. Considering all these aspects, the article proposes a software architecture in which private data's storage places are under the strict control of the user or his delegates.

System Elements

In this section, we define the terminology used for the Private Data System throughout this paper. First, we define the following roles: Data Owner (DO) represents the identity which owns the data. Data Processor (DP) represents the identity which processes the data; the identity to which the data was shared.

Second, we define the following types of data: Private Data (PD) represents the private data which is to be stored in the system; if a piece of private data PD is split into n undecipherable chunks, then PDi, i = 0,n is an undecipherable chunk of data. Metadata (MD) specifies the relationship between the Private Data and Data Processors by labeling the data according to the Data Owner and ontologies.

Third, since the system is based on key-value databases, we define the following keys for data storage, associations, and references: Master Key (MK) represents and anonymizes a piece of private information. Partial Key (PK) represents and anonymizes one undecipherable chunk from the set of undecipherable chunks in which a piece of private information was split. Thus, the MK is associated to the set of PKs which represent the set of undecipherable chunks needed to recombine the piece of private information. Key Reference (KR) represents a reference to / an alias of a piece of private information (a reference to a Master Key). Key Reference Hash (KRH) is obtained by applying a hash function on the Key Reference value and adding the address of the processing node which is to receive the results.

In the end, we define the following types of nodes: Processing Node (PN) stores Key References and needs to retrieve and process the private data referenced by them. Processing nodes are forbidden by law to store the retrieved data on long term. Audit Node (AN) manages a key-value database which stores the association between Key References and the Master Keys they reference along with the information describing the data referenced by the Master Key (Data Owner, Data Processor, and Metadata). In the database, the key is a Key Reference and the value is a tuple consisting of the Master Key, the Metadata, the Data Owner, and the Data Processor. Index Node (IN) manages a key-value database which stores the association between Master Keys and its corresponding Partial Keys. In the database, the key is the Master Key and the value is the list of Partial Keys needed to reconstruct the piece of private information represented by the Master Key. Storage Node (SN) manages a key-value database which stores the association between Partial Keys and Partial Messages. In the database, the key is the Partial Key and the value is the undecipherable chunk of data represented by this particular Partial Key.

System Operations

In this section we detail the way in which CRUD (Create, Read, Update, Delete) operations as well as copying, sharing, and revoking access to data are performed in the proposed system. For simplicity, we are going to use the following notations throughout this paper:

-[E 1 , E 2 , ..., E n ] is a list containing the elements E 1 , E 2 , ..., E n . -(E 1 , E 2 , ..., E n ) is a tuple containing the elements E 1 , E 2 , ..., E n . -{K 1 : V 1 , K 2 : V 2 , ..., K n : V n } is a dictionary in which the value V 1 is stored under the key K 1 ,

Creating / Storing Private Data

The storage of private data is achieved in three phases, illustrated at a higher level in Figure 1 and detailed in the following schema: When a processing node needs to store private data, it starts the first phase by sending to an audit node the metadata describing the information it wants to store along with its identity (considered both data owner because it stores its information and data processor because it is the identity which is going to use the associated reference key for data retrieval). The audit node first generates a master key and a key reference, then stores the generated master key, the received metadata, and the received data owner (as both data owner and data processor) under the generated key reference in its key-value database. The audit node completes this phase by sending the generated master key and the key reference to the processing node.

In the second phase, the processing node splits the private information into n undecipherable chunks P D 1 , P D 2 , ..., P D n and chooses randomly n storage nodes so that each storage node is responsible for storing a single undecipherable chunk of private data. Each storage node, upon receiving its undecipherable piece of private data, generates a partial key, stores its chunk of information under that key, and sends to the processing node the generated partial key.

In the third phase, the user sends to an index node the master key and its corresponding partial keys. The processing node stores the key reference under an alias because it is needed for subsequent private information retrieval.

Reading / Retrieving Private Data

If a processing node needs to access a private information, it must have a key reference. The way the processing node uses the key reference to retrieve the associated private information can be followed in Figure 2 and is described in detail in the following schema: The key reference might reference either a piece of private information of the processing node or a piece of private information shared to the processing node by another processing node. By sending his key reference to the audit node along with his (processing node's) identity, the processing node completes the first phase.

Phase 1 1. P N → AN : DP, KR Phase 2 1. M K := AN [KR] 2. HKR := (location(P N ), hash(KR)) 3. AN → IN : DP, M K, HKR Phase 3 1. P K 1 , P K 2 , , P K n := IN [M K] 2. IN → SN i : DP, HKR, P K i , i = 1, n 3. P D i := SN i [P K i ], i = 1,
In phase two, the audit node retrieves the master key corresponding to the received key reference. Next, it computes HKR, which is a hash on the retrieved key reference prefixed with the location of the processing node. Then, the audit node sends the processing node's identity, the retrieved master key, and the computed HKR to the index node. This way, the index node doesn't learn the association between key references and master keys, but at the same time propagates HKR, which is information required by the processing node to identify the request being answered. Note that the processing node might issue multiple data retrieval operations at the same time and, without HKR, the processing node wouldn't know which undecipherable chunks correspond to which pieces of private data he requested at the same time.

In the third phase, the index node retrieves from its database the partial keys corresponding to the master key and sends each partial key along with the processing node's identity and HKR to the corresponding storage nodes. Each storage node retrieves the undecipherable value (P D i ) corresponding to the received partial key (P K i ) and sends to the processing node the retrieved undecipherable chunk and the HKR. The processing node, upon receiving the undecipherable chunks, groups them by HKR and recombines the grouped components in order to obtain the private piece of information. This information can be processed, but the law prevents the processing node to store it. Thus HKR's purpose is to serve as an identifier so that a processing node which retrieves multiple private information pieces at the same time can associate the received undecipherable pieces of information to the requested key references.

Updating Private Data

The first two phases are identical for data retrieving and data updating, but starting with the third step of the third phase, things are performed differently as can be observed in the following schema: The storage nodes, upon receiving the partial keys from the index node, instead of retrieving the undecipherable chunks of private data corresponding to the partial keys and sending them along with HKR to the processing node for recombination as performed by the storing operation, for the updating operation they send the HKR alone to the processing node. Upon receiving the HKR from the storage nodes, the processing node splits the new information in undecipherable chunks and sends one chunk to each storage node which sent the HKR corresponding to this piece of private information. Then, the storage nodes update the values stored under the partial keys in their key-value database in accordance to the newly received undecipherable chunks.

The reason we decided to go with this approach rather than use an invalidation and a store operation is because we want all the existing key references to remain valid and, even more, to point to the updated private data.

The data flow between the nodes which are part of the system during an update operation can be observed in Figure 3.

Deleting Private Data

Figure 4 illustrates the data flow and the following schema illustrates the actions performed during a delete operation:

1. P N → AN : KR, DO 2. M K := AN [KR] 3. AN → IN : M K 4. IN : invalidate IN [M K]
In order to perform a delete operation, a processing node sends to the audit node its identity (which must be the identity of the data owner) and its key reference of the data to be deleted. If the audit node would invalidate the received key reference, this would mean only revoking access to the private data for the data owner, while all the data processors which received access to this private data at some point in time would still be able to access the data. Thus, instead of doing this, the audit node sends the received key reference to the index node for it to invalidate the associated master key. In this way, neither the data owner, nor the data processors will be able to access this piece of private data anymore because all the key references they have for this piece of private data point to the same master key. In order to share a piece of information, a processing node (P N 1 ) must send to an audit node its key reference (KR 1 ) of the private information it wants to share along with the identity of the processing node that is to receive access to the private information (DP 2 ). When this happens, the audit node retrieves the master key (M K) corresponding to the received key reference (KR 1 ), generates a new key reference (KR 2 ), and saves the retrieved master key (M K), the retrieved metadata (M D), the retrieved data owner (DO) and the received data processor (DP 2 ) under the newly generated key reference (KR 2 ). Of course, the initial association (between KR 1 and M K) remains in the database, as well.

Note that every association between a key reference and a master key also has information regarding the identity of the organization owning the data (Data Owner) and the identity of the organization with which data is shared (Data Processor). If data owner is the same with data processor, then this association is the initial key reference created when the private information was first stored. Next, the audit node sends the newly generated key reference (KR 2 ) along with the received metadata (M D) to the processing node which is to receive access (P N 2 ) to the private data. In this way, neither data owner knows the data processor's key reference, nor the data processor knows the data owner's key reference.

Revoking Access to Private Data

The revocation operation is described in Figure 6 and follows the following steps: The data owner can revoke access to a private information by issuing a revocation request to the audit node. The revocation request contains the identity of the data owner and of the data processor to which access is being revoked as well as the data owner's key reference (KR 1 ). Note that we receive the data owner's key reference, while the revocation needs to be done on data processor's key reference (KR 2 ). This happens because each processing node knows its key reference, but it doesn't know the key references of the data processors which have access to its data. So, the audit node needs to retrieve the master key corresponding to the received key reference (KR 1 ) and search the key reference to be revoked (KR 2 ) knowing that it has associated the retrieved master key and the received data owner and data processor. After learning the value of the reference key to be revoked, the audit node simply invalidates it. Nothing is deleted. 4.7 Copying Private Data By design, any copy operation on the private data should be done only through the sharing operation. Data derived from the private data should be stored in the PDS and assigned to the original data owner.

1. P N → AN : KR 1 , DO, DP 2 2. M K := AN [KR 1 ] 3. search KR 2 which contains M K, DO, DP 2 as values 4. invalidate AN [KR 2 ]

System Analysis from the Privacy Perspective

In this section we are going to analyze how powerful each type of node defined in the system is and how much information they can gather by themselves or by colluding with other types of nodes.

Each storage node has access to only one undecipherable chunk of each private piece of information it stores. Each chunk is saved under a partial key which has no meaning to the storage node. The storage node doesn't know which other storage nodes the other chunks of the same pieces of private information store, nor under which partial keys. Even more, the storage node doesn't know what type of information it stores. It may be a social security number, a password, a name, a birth date, and so on. A single storage node can't attack the system and neither can a collection of colluding storage nodes.

Index nodes store only the associations between master keys and partial keys. So, they know the partial keys whose corresponding undecipherable chunks can be recombined to form a private piece of information, but they don't know the values of the actual chunks, nor the type of information that will be obtained after recombining the chunks. A single index node can't attack the system and neither a collection of colluding index nodes.

Audit nodes have information regarding the meaning of the data, the owner of the data, and the identities with which the data was shared, but they don't have information regarding the way the data was split in chunks (the correspondence between master key and partial keys) and the locations where the data chunks are stored. So, a single audit node or a group of colluding audit nodes can't recombine the private data. However, audit nodes are able to create reference keys at their discretion and share them with legal or illegal organizations.

Processing nodes have access to the private data as they need it for normal operations. Privacy by Design principles are intended to regulate the usage of private data without reducing functionality. The main goal of the PDS is to make it obvious when a company is misusing the private data outside the purpose accepted by the user, but without reducing access to the private data. For example, if an organization collects private data by using PDS, it becomes visible if it is copying or using private data for other purposes than intended.

Only processing nodes and audit nodes know what the pieces of information referenced by key references mean. Encryption is not needed because the attackers see a huge pool of partial undecipherable messages. Traffic can't be used to obtain information because the traffic data is encrypted using TLS and can't be used to deduce information regarding which nodes communicate because of the huge amount of concurrent swarms flying from node to node.

If an index node colludes with all the storage nodes storing chunks of the same piece of private information, then together they can recombine the message, but without knowing its meaning, who owns it and with whom it was shared with, it is of no value to them. In order for the data to be of value, they need to collude also with the audit node, which stores the metadata, the data owner and the data processor of this particular piece of information.

Conclusions

In normal conditions only processing nodes should be able to read plaintext data. All the other node types involved in the PDS should not be capable of accessing private data. In special conditions, audit nodes should be able to read the data as well in order to enable legal access to the private data owned by other data owners for crime prevention or other legal usages. We imagine audit organizations offering public services that are controlled by the law and industry regulations. The level of access to the systems storing this metadata should be similar to the one for financial services. Special legal procedures should be followed when accessing private data outside of the normal flow.

Systems and approaches that are trying to obfuscate and encrypt too much are fighting an impossible fight with the common social interest and are blocking the normal evolution of the technologies in the privacy area. The interests of any citizen are to be protected from unfair usage of his data by the large Internet companies, to have control on who he shares his private data with, to be able to revoke access to his data to anyone at any time.

An Internet based on fully homomorphic encryption would not be what we need because it would create a world in which data can be too easily lost. It would provide a perfect method for criminals and terrorists to hide their data from the public interest. Fighting with dangerous, corrupted governments is important, but PDS is not supposed to have a role in this fight. PDS is a balanced solution which enforces Privacy by Design in code and maintains an equilibrium between public and private interests.

Future Work

As future work, we intend to pursue three different paths. First, we will develop a new self-sovereignty authentication technique which uses the advantages provided by the architecture of the system proposed in this paper. Secondly, as Privacy by Design and Privacy by Default (PbD) are being enforced by laws (eg in the General Data Protection Regulation), we intend to propose a Privacy Enhancing Technique (PET) that can ensure these principles directly in code. It is supposed to be a privacy estimation method for systems using the technique proposed in this paper for achieving self-sovereign storage of private data.

Thirdly, we will propose and describe a mechanism for the audit nodes to store the metadata so that it enables the implementation of personal assistants. The metadata will describe the schema of the stored objects (in the form of JSON schema or OWL) and the representation types that could enable type checking when data is shared. It will enable the use of specific Privacy Policies (which will control what entities are allowed to read the information and will contain revocation policies) and Security Policies (which will control what entities are allowed to modify the content of a Master Key). Both privacy and security policies will be enforced by the audit nodes, but the input (rules and policies) will be provided by the Data Owner himself. Giving up to the standard communication promoted by web technologies and moving towards a model of communication verifiable as the one proposed by executable choreographies, we have the opportunity to develop formal verifications methods on how the private data is used.

  the value V 2 is stored under the key K 2 , ..., and the value V n is stored under the key K n .-N 1 → N 2 : M means the node N 1 sends to the node N 2 the message M , which corresponds to performing a step in the executable choreography. -DB[K] := V means the value V is stored under the key K in the key-value database DB by the node managing DB. -V := DB[K] means the value V associated to the key K is retrieved from the key-value database DB by the node managing DB. -N 1 : A means the node N 1 performs the action A. -M := gen() means the message M is generated (either randomly or according to an algorithm); this is an action. -P D 1 , P D 2 , ..., P D n := split(P D) means the private data P D is split into n undecipherable chunks of data P D 1 , P D 2 , ..., P D n ; this is an action. -P D := recombine(P D 1 , P D 2 , ..., P D n ) means the n undecipherable chunks of data P D 1 , P D 2 , ..., P D n are recombined in order to obtain the initial piece of private data P D which was split to obtain them; this is an action.

Phase 1 1 .Fig. 1 .

 11 Fig. 1. Storing Private Data

n 4 .

 4 SN i → P N : HKR, P D i , i = 1, n 5. P N : P D := recombine(P D 1 , P D 2 , ..., P D n ), where P D i , i = 1, n must have the same HKR as P D

Fig. 2 .

 2 Fig. 2. Retrieving Private Data

Phase 1 1 .Fig. 3 .

 13 Fig. 3. Updating Private Data

Fig. 4 .Fig. 5 .

 45 Fig. 4. Deleting Private Data

Fig. 6 .

 6 Fig. 6. Revoking Access to Private Data

Acknowledgments

This work is partly funded by the European Union's Horizon 2020 Research and Innovation Programme under grant agreement No 692178.

It is also partially supported by the Private Sky Project, under the POC-A1-A1.2.3-G-2015 Programme (Grant Agreement no. P 40 371).


Olivier Pourret
email: olivier.pourret@univ-rennes1.fr

Aline Dia

Mélanie Davranche

Gérard Gruau

Odile Hénin

Maxime Angée

H\zrugv Rujdqlf

Pdwwhu Froorlgv

Pdmru Dqg

Ultrafiltration experiments using new small ultracentifugal filter devices were performed at different pore size cut-offs to allow the study of organo-colloidal control on metal partitioning in water samples. Two shallow, circumneutral pH waters from the Mercy site wetland (western France) were sampled: one dissolved organic carbon (DOC)-and Ferich and a second DOC-rich and Fe-poor. Major-and trace-element cations and dissolved organic carbon concentrations were analysed and data treated using an ascendant hierarchical classification method. This reveals the presence of three groups: (i) a "truly" dissolved group (Na, K, Rb, Ca, Mg, Ba, Sr, Si and Ni), (ii) an inorganic colloidal group carrying Fe, Al and Th and (iii) an organic colloidal group enriched in Cr, Mn, Co, Cu and U. However, REE and V have an ambivalent behaviour, being alternatively in the organic pool and in the inorganic pool depending on sample. Moreover, organic speciation calculation using Model VI were performed on both samples for elements for which binding constants were available (Ca, Mg, Ni, Fe, Al, Th, Cr, Cu, Dy, Eu). Calculation shows relatively the same partitioning of these elements as ultrafiltration does. However, some limitations appear such as (i) a direct use of ultrafiltration results which tends to overestimate the fraction of elements bound to humic material in the inorganic pool as regards to model calculations as well as, (ii) a direct use of speciation calculation results which tends to overestimate the fraction of elements bound to humic material in the organic pool regards to ultrafiltration results. Beside these limitations, one can consider that both techniques, ultrafiltration and speciation calculation, give complementary information, especially for more complex samples where inorganic and organic colloids compete.

.

,QWURGXFWLRQ Dissolved Organic Matter (DOM) is ubiquitous in aquatic and terrestrial environments and plays a key role in the geochemistry of major and trace elements [START_REF] Stumm | Aquatic chemistry[END_REF]. While DOM represents only a small proportion of the global carbon reservoir, it is instrumental in many reactions and influences environmental chemistry far beyond its mass contribution [START_REF] Macalady | Perspectives in environmental chemistry[END_REF]. DOM acts as a major carrier for many elements through complexation, sorption and dissolution reactions [START_REF] Buffle | Complexation reactions in aquatic systems: an analytical approach[END_REF][START_REF] Cabaniss | Copper binding by dissolved organic matter. I ; Suwannee river fulvic acid equilibria[END_REF][START_REF] Benedetti | Metal ion binding to natural organic matter: from the model to the field[END_REF][START_REF] Buerge-Weirich | Adsorption of copper, nickel, and cadmium on goethite in the presence of organic ligands[END_REF].

Since DOM may compete with rock surfaces because of their high sorption capacities [START_REF] Iler | The geochemistry of colloid systems for earth scientists[END_REF], sorption and/or complexation of cations onto DOM are major controlling processes for element migration and removal in weathering and aquifer systems [START_REF] Mccarty | Lanthanide field tracers demonstrate enhanced transport of transuranic radionuclides by natural organic matter[END_REF][START_REF] Tosiani | Major and trace elements in river-borne materials from the Cuyuni 29 basin (southern Venezuela): evidence for organo-colloidal control on the dissolved load and element redistribution between the suspended and dissolved load[END_REF][START_REF] Braun | Present weathering rates in a humid tropical watershed: Nsimi, South Cameroon[END_REF]. Moreover, speciation, bioavailability and mobility of major and trace elements can be strongly influenced by DOM [START_REF] Wells | Occurrence of small colloids in sea water[END_REF][START_REF] Tipping | A unifying model of cation binding by humic substances[END_REF][START_REF] Dahlquist | Association of calcium with colloidal particles and speciation of calcium in the Kalix and amazon rivers[END_REF]. Since in natural aquatic systems, metal ions are rarely present as free hydrated ions, DOM provides binding sites influencing both their bioavailability and general transport behaviour. It also interacts with mineral phases modifying the exchange rates with solutions and constrains part of elemental mobility [START_REF] Bennett | Increased solubility of quartz in water due to complexing by organic compounds[END_REF][START_REF] Christensen | Effect of dissolved organic carbon on the mobility of cadmium, nickel, and zinc in leachate polluted groundwater[END_REF][START_REF] Schmitt | NOM-facilitated transport of metal ions in aquifers: importance of complex-dissociation kinetics and colloid formation[END_REF].

Colloids, ubiquitous in natural waters, either organic or inorganic, are microscopic particles with size in the range 1 µm to 1 nm [START_REF] Stumm | Aquatic chemistry[END_REF]. Because of their small size, they tend not to settle out of suspensions, being influenced by Brownian motion and minor currents in the bulk solutions. The solid-water interface established by these microparticles plays a key role in regulating the concentrations of most reactive elements and of many pollutants in soils and natural waters [START_REF] Stumm | Aquatic chemistry[END_REF]. They adsorb heavy metal ions and waterborne pollutants governing, via their movements in aqueous systems, the fates of reactive elements and/or pollutants.

Recent studies coupled or not with speciation calculations suggested that a large fraction of trace elements are closely associated with DOM including colloidal organic matter in many natural waters [START_REF] Tanizaki | Physicochemical speciation of trace elements in river waters by size fractionation[END_REF][START_REF] Viers | Chemical weathering in the drainage basin of a tropical watershed (Nsimi-Zoetele site, Cameroon): comparison between organic-poor and organic-rich waters[END_REF][START_REF] Dupré | Major and trace elements associated with colloids in organic-rich river waters : ultrafiltration of natural and spiked solutions[END_REF][START_REF] Dia | The distribution of rare earth elements in groundwaters: assessing the role of source-rock composition, redox changes and colloidal particles[END_REF][START_REF] Ingri | Temporal variations in the fractionation of the rare earth elements in a boreal river: the role of colloidal particles[END_REF][START_REF] Gruau | Controls on the distribution of rare earth elements in shallow groundwaters[END_REF][START_REF] Johannesson | Rare earth element concentrations and speciation in organic-rich blackwaters of the Great Dismal Swamp, Virginia, USA[END_REF]. Moreover, redox conditions do control the dynamics and fate of some toxic and/or redox sensitive elements at the soil/water interface. The true respective roles of DOM and Fe-Mn oxyhydroxides as elemental carriers are still poorly understood. As Fe-Mn oxyhydroxides are redox sensitive [START_REF] Stumm | Aquatic chemistry[END_REF], it is not clear whether trace metals are directly bound to the oxyhydroxides and complexed by DOM when the oxyhydroxides are dissolved during reduction, or whether they are directly bound to DOM and controlled by the organic matter dynamics throughout the entire redox cycle.

Considering that the respective contribution of organic and inorganic element carriers still remains a matter of debate, this work is dedicated to (i) investigate trends in trace element partitioning in size fractionated samples of well water using small ultracentrifugal devices and (ii) compare this field data to geochemical modelling calculations.

6DPSOHV

6DPSOH ORFDWLRQ

The Kervidy/Coët-Dan catchment (5 km 2 ) is located in the Coët-Dan drainage basin, about 100 km southwest of Rennes in Central Brittany, France (Fig. 1). The bedrock is made of fissured and fractured upper Proterozoic schists [START_REF] Dabard | Zircon typology combined with Sm-Nd whole rock isotope analysis to study Brioverian sediments from the Armorican Massif[END_REF]. The soils, developed into a loamy material derived from bedrock weathering and eolian Quaternary deposits, exhibit facies variations, which are locally, dominated by silt, clay or sandstone materials [START_REF] Pellerin | Cadre géomorphologique du bassin du Coët-Dan et du Haut Evel (Morbihan) : Rapport sur les travaux de cartographie et de stratigraphie[END_REF]. The mineralogical composition of schist was determined from drill cutting analysis and includes (in decreasing relative proportion): quartz, muscovite, chlorite, K-feldspar and plagioclase [START_REF] Pauwels | Field tracer test for denitrification in a pyrite-bearing schist aquifer[END_REF]. The soil horizons comprise a large number of secondary mineral phases including illite, smectite, kaolinite, various Fe-oxides and Fe-oxyhydroxides (hematite, goethite...) and Mn oxides [START_REF] Pauwels | Field tracer test for denitrification in a pyrite-bearing schist aquifer[END_REF][START_REF] Curmi | Le programme CORMORAN-INRA: de l'importance du milieu physique dans la régulation biogéochimique de la teneur en nitrate des eaux superficielles[END_REF].

Previous hydrochemical studies [START_REF] Durand | Solute transfer in agricultural catchments: the interest and limits of the models[END_REF][START_REF] Jaffrézic | Géochimie des éléments métalliques, des nitrates et du carbone organique dissous dans les eaux et les sols hydromorphes[END_REF][START_REF] Dia | The distribution of rare earth elements in groundwaters: assessing the role of source-rock composition, redox changes and colloidal particles[END_REF][START_REF] Molénat | Mechanisms of nitrate transfer from soil to stream in an agricultural watershed of French Brittany[END_REF] showed that the Kervidy/Coët-Dan groundwater can be summarized by the contrast of two spatially-distributed chemical domains. These include: (i) the uppermost part of the groundwater, sampled below the hillslope, and which is colourless, slightly acidic, always oxidized and nitrate-contaminated (up to 200 mg L -1 NO 3 -) [START_REF] Molénat | Mechanisms of nitrate transfer from soil to stream in an agricultural watershed of French Brittany[END_REF], (ii) the shallow groundwater domain located in the wetlands where the water table reaches the organic-rich upper soil horizons. This second groundwater component is coloured, DOC-rich and exhibits variable nitrate concentrations [START_REF] Durand | Solute transfer in agricultural catchments: the interest and limits of the models[END_REF][START_REF] Jaffrézic | Géochimie des éléments métalliques, des nitrates et du carbone organique dissous dans les eaux et les sols hydromorphes[END_REF]). In addition, these waters are characterized by the development of periodic reducing conditions mostly in late winter and spring, which is a direct consequence of the waterlogging of the uppermost soil horizon [START_REF] Jaffrézic | Géochimie des éléments métalliques, des nitrates et du carbone organique dissous dans les eaux et les sols hydromorphes[END_REF].

6DPSOLQJ SURFHGXUH

Two organic-rich groundwater samples were collected from shallow wells (PF1, 0.5m-and PF3, 0.8-m-deep) located in the Mercy wetland (Fig. 1) in November 2004. Physicochemical parameters (pH and temperature) were measured directly in the field. The pH was measured with a combined Sentix 50 electrode after a calibration performed with WTW standard solutions (pH = 4.01 and 7.00 at 25 °C). The accuracy of the pH measurement is ± 0.05 pH unit. Samples used for determination of dissolved (< 0.2 µm) major-, trace-element and DOC concentrations were pumped using Teflon tubing connected to a polyethylene syringe. The collected waters (about 1 L) were immediately filtered on site using 0.2 µm cellulose acetate filter capsule (polyether sulfone membrane Sartorius Minisart), and stored in pre-cleaned, acid-washed polyethylene bottles. About 30 mL were used to measure alkalinity, major anions and DOC concentrations. The remaining solution was used to measure major and trace cation concentrations and was then successively filtered through ultracentrifugal devices with decreasing pore size cut-offs in order to allow separation of colloids from "truly" dissolved forms.

([SHULPHQWDO

8OWUDILOWUDWLRQ VHWXS GHVFULSWLRQ DQG FKHPLFDO DQDO\VLV

To separate the colloidal bound elements from the non colloid-borne elements ultrafiltration experiments were performed on these samples using 15 mL centrifugal tubes (Millipore Amicon Ultra-15) equipped with permeable membranes of decreasing pore sizes (30 kDa, 10 kDa, and 5 kDa with 1 Da = 1 g mol -1 ). Metal-colloid complexes are retained by the ultrfiltration membrane while free ions and smaller complexes pass into ultrafiltrate. The degree of metal-colloid complexation is usually determined from the metal concentration in the ultrafiltrate relative to the original solution. Each centrifugal filter device was washed and rinsed with HCl 0.1 N and MilliQ water two times before use. The starting filtrate had been passed through 0.2 µm filter, and then aliquots of these filtrates were passed through membranes of smaller sizes. All ultrafiltrations of the 0.2 µm filtrates were done in parallel.

The centrifugations were performed using a Jouan G4.12 centrifuge equipped with swinging bucket at about 3000 g for 20 minutes and 30 minutes, for 30 kDa and 10 kDa, and 5 kDa devices, respectively (centrifugation times determined from preliminary experiments not shown). All experiments were carried out at room temperature: 20 ± 2 °C.

Major cations and trace elements concentrations were determined at Rennes 1 University using an Agilent Technologies TM HP4500 ICP-MS instrument. Quantitative analyses were performed using a conventional external calibration procedure. Three external standard solutions with major and trace elements concentrations similar to the analyzed samples were prepared from mono-and multi-elements standard solutions (Accu Trace TM Reference, USA). Indium was added to all samples as an internal standard at a concentration of 0.87 µmol L -1 (100 ppb) to correct for instrumental drift and possible matrix effects.

Indium was also added to the external standard solutions. Calibration curves were calculated from measured major cations and trace elements /indium intensity ratios. The instrumental error on major cations and trace elements analysis in our laboratory as established from repeated analyses of the SLRS-4 water standard is < ± 2 %. DOC concentrations were determined at Rennes 1 University using a Shimadzu 5000 TOC analyzer. The accuracy of DOC concentration measurements is estimated at ± 5 % as determined by repeated analyses of freshly prepared standard solutions (potassium biphtalate). Total alkalinity was determined by potentiometric titration with an automatic titrating device (794 Basic Titrino Methrom).

Major anions (Cl -, SO 4 2-and NO 3 -) concentrations were measured by ionic chromatography (Dionex DX-120): the uncertainty is below ± 4 %.

The same material was used for all filtrations, molecular size exclusion rather than adsorption onto membranes should control the colloid distributions between ultrafiltrates. The selectivity of the 10 and 5 kDa membranes regards to Aldrich Humic Acid, with a mean molecular weight of 23 kDa, was verified by monitoring the Dissolved Organic Carbon (DOC) contents of the ultrafiltrates (preliminary experiments not shown). Results show that the latter were systematically lower or equal to blank values ( SSP 3RVVLEOH DGVRUSWLRQ RI inorganic major and trace elements species onto the membrane or onto cell walls was also monitored. Inorganic multi-elements solutions of known concentration were ultrafiltrated several times. Results showed that 100 % of the major and trace elements present in solution was recovered in the ultrafiltrates, demonstrating that no major and trace elements was adsorbed neither on the membranes nor on the walls of the cell devices used. All ultrafiltration were performed in duplicate. A good reproducibility is observed for DOC and major and trace elements concentrations. Duplicates are better than 5 % for most elements except for some trace elements in the lower pore size cut-off fraction (i.e. in the < 5 kDa fraction, about 10 %)

All procedures (sampling, filtration, storing and analysis) were carried out in order to minimize contamination. Samples were stored in acid-washed Nalgene polypropylene containers before analyses. Chemical blank concentrations of individual major cations and trace elements were all better than than 2 % for all studied elements except for DOC, Al and Cu (< 8 %, 10 % and 11 %, respectively).

6SHFLDWLRQ FDOFXODWLRQ

The aqueous speciation of some major (Al, Ca, Fe, Mg) and trace elements (Cu, Eu, Dy, Th) was calculated using the computer program WHAM 6 (Version 6.0.13). It includes Model VI which has been described in detail by [START_REF] Tipping | Humic Ion-Binding Model VI: an improved description of the interactions of protons and metal ions with humic substances[END_REF]. The model is a discrete binding site model in which binding is modified by electrostatic interactions. There is an empirical relation between net humic charge and an electrostatic interaction factor. In this study the computation is performed using only the default parameters values and the generic log K MA values (see [START_REF] Tipping | Humic Ion-Binding Model VI: an improved description of the interactions of protons and metal ions with humic substances[END_REF]. Humic substances were the only colloidal phases considered in this calculation, none colloidal oxide phase was considered.

'DWD WUHDWPHQW

The ascending hierarchical classification using Ward criterion was performed through SPAD 4.5 routines (DECISIA, France) so as to implement sample classification [START_REF] Dillon | Multivariate analysis: Methods and applications[END_REF]. This method is based on squared Euclidian distances between individuals in the space formed by the available variables. The initial sample is partitioned into several classes of individuals so as to maximise interclass inertia (i.e. to maximise variability between groups) and minimise intraclass inertia (i.e. to maximise homogeneity in each group). As for factor analysis, the raw data matrix was introduced in principal component analysis, without any rotation. The input data are the whole set of ultrafiltrates after each cut-off for all considered elements.

5HVXOWV

8OWUDILOWUDWLRQV

In the following sections the behaviour of major, trace, and DOC concentrations obtained for successive ultrafiltrations will be discuss. Major, trace element, and DOC concentrations are reported in Table 1. Major anions are not considered in this part of the study. Ultrafiltration data are presented following the hierarchical classification described in the hereabove "data treatment" paragraph. The results of cluster analysis are presented as a dendogram, where the similarity of two elements is conversely proportional to the linkage distance (Fig. 2). This graph reveals three clusters: (i) cluster I includes alkalis (Na, K, Rb), alkaline earth metals (Ca, Mg, Ba, Sr) as well as Si and Ni, (ii) cluster II contains Cr, Mn, Co, Cu and U and (iii) cluster III includes Al, Fe and Th. REE and V are either, in cluster II or, in cluster III for PF1 and PF3 samples, respectively.

As stated previously, colloids span a wide range from about 1 nm to a few µm;

successive ultrafiltrations through decreasing pore size membranes, DOC concentrations decrease in the ultrafiltrates (Fig. 3). These successive ultrafiltrations allow further consideration about various molecular weight humic substances. To determine whether metals are bound or not to humic substances, metal concentrations will be systematically plot as a function of DOC concentrations.

4.1.1. Common elemental distribution in the two samples (i) cluster I : "truly" dissolved behaviour Concentrations of Rb and other alkalis such as Na and K, are not affected by ultrafiltrations since no fractionation occurs when following the decreasing pore sizes or the DOC concentrations (Fig. 4a). Alkaline elements behave as "truly" dissolved in the form of inorganic species as often reported in the literature (Pokrovsky and Schott, 2002 and references therein).

Major and trace alkaline earth (Ca, Mg, Sr and Ba) concentrations do not change significantly during filtration except for the smallest pore size (5 kDa). The small drop between 5 kDa and 10 kDa filtrates (Fig. 4b) can suggest that part of these elements (about 10 %) could be associated with low-molecular weight organic colloids as reported elsewhere where complexes of Ca and Mg with natural fulvic acids have been identified [START_REF] Shapiro | Effect of yellow organic acids on iron and other metals in water[END_REF].

Si concentrations display no significant variations in the successive filtrates. This suggests that aqueous silica is not trapped by organic colloids [START_REF] Pokrovski | Experimental study of the complexation of silicon and germanium with aqueous organic species: implications for germanium and silicon transport and Ge/Si ratio in natural waters[END_REF] and/or by small-size clay minerals or phytolites. Ni concentrations do not exhibit large variations through the different decreasing pore size cut-offs suggesting that this transition metal has to be mostly present as "truly" dissolved species or small size inorganic complexes.

(ii) cluster II: organic colloidal pool-borne elements Both Cu and U concentrations display extremely regular linear relationship as reported versus DOC concentrations for both samples (Figs. 5a,5b ; Table 1). The linear relationships suggests that these two trace elements are strongly bound to organic matter and probably complexed to very low molecular weight organic ligands such as extracellular ligands as well as, larger size colloids such as fulvic and/or humic acids, cell fragments or bacteria as elsewhere reported [START_REF] Xue | Competition of copper and zinc for strong ligands in a eutrophic lake[END_REF][START_REF] Sigg | Size fractionation (dissolved, colloidal and particulate) of trace metals in Thur river, Switzerland[END_REF]. Since Cu and U concentrations tend to zero before DOC ones do, one can suggests that no fraction of Cu and U occurs as free species in solutions and that a fraction of DOM is unable to complex these two elements.

However, organic matter remains the major carrier of Cu and U as often previously stated [START_REF] Stumm | Aquatic chemistry[END_REF].

Cr, Mn and Co concentrations (Table 1) also display linear positive correlations when reported versus DOC concentrations for both samples. Organic matter is thus also a major carrier of these elements.

(iii) cluster III: inorganic colloidal pool-borne elements Al and Fe concentration variations through successive filtrations (Fig. 6a and6b)

suggest that these elements do not occur as free species in solution, and that two types of colloids can carry these metals (i.e. Al-, Fe-rich inorganic colloids or organic-, Al-, Fecomplexing colloids). Al and Fe concentrations vary following the same trend (Table 1) both strongly affected by a large drop of concentrations between 0.2 µm and 30 kDa filtrations. Up to 96 % and 75 % for Fe and Al, respectively, are removed by the first ultrafiltration step.

This indicates a major control of Al by inorganic mixed Fe/Al oxyhydroxides as already reported [START_REF] Pokrovsky | Iron colloids/organic matter associated transport of major and trace elements in small boreal rivers and their estuaries (NW Russia)[END_REF][START_REF] Geckeis | Aquatic colloids relevant to radionuclide migration/characterization by size fractionation and ICP-mass spectrometric detection[END_REF]. This is particularly true for Alrich PF3 sample as compared to PF1 where Fe dominates regards to Al. However, a small part of Al and Fe could be partially bound to low-molecular weight organic-rich colloids. Al concentration tends to zero before DOC does for both samples. This is not the case for Fe, since Fe disappears before DOC does. This suggests that the Fe budget between organic and inorganic carrier phases has to be different from that of Al, depending also which sample is considered. Furthermore, Al could be carried by another low-molecular weight DOC-poor phase which does not trap Fe in PF1 sample, but not in PF3. Al cannot be present as clay colloids since Si occurs at "truly" dissolved state.

Thorium concentrations regularly decrease through the successive decreasing pore size cut-offs with a large drop (up to 40 %) between 0.2 µm and 30 kDa (Fig. 6c). This suggests that this fraction of Th has to be associated to large size organic colloids while about 60 % of Th appears to be carried by colloids smaller than 30 kDa. Th concentrations decrease quicker show a general decreasing tendency going through zero REE that illustrates the removing of REE jointly to DOC. However, there is still DOC left in solution as REE concentrations are close to zero, which allows us to extrapolate that not all the organic pool is able to complex REE. The REE appear to be strongly complexed by high-molecular weight organic matter as previously stated in other ultrafiltration studies [START_REF] Sholkovitz | The aquatic chemistry of rare earth elements in river and estuaries[END_REF][START_REF] Viers | Chemical weathering in the drainage basin of a tropical watershed (Nsimi-Zoetele site, Cameroon): comparison between organic-poor and organic-rich waters[END_REF][START_REF] Dia | The distribution of rare earth elements in groundwaters: assessing the role of source-rock composition, redox changes and colloidal particles[END_REF]. However, a recurrent problem of ultrafiltration studies is that Fe and Mn oxyhydroxides can be present in the waters along with organic colloids, some of them being potentially strong competitors of organic matter for REE complexation [START_REF] Bau | Scavenging of dissolved yttrium and rare earths by precipitating iron hydroxides: experimental evidence for Ce oxidation and lanthanide tetrad effect[END_REF][START_REF] Dupré | Major and trace elements associated with colloids in organic-rich river waters : ultrafiltration of natural and spiked solutions[END_REF]. PF1 sample presents a significant decrease in its Fe content upon ultrafiltration at the 30 kDa ultrafiltration step. This decrease corresponds to a marked change in the slope of the REE-DOC linear relationships otherwise observed in the REE versus DOC variation diagrams (Fig. 7a). About 80 % of the REE and 96 % of the Fe, but only 9 % of the DOC, are removed during the first ultrafiltration step of this sample. Such a relationship strongly suggests that the "colloidal" REE budget of PF1 samples is controlled, in part, by REEbearing Fe colloids as suspected by looking at Fig. 7b. By contrast for PF3 sample, REE concentrations display a strong correlation as reported versus DOC concentrations irrespective of the cut-off. The linear relationship suggests that in this sample REE are strongly bound to organic matter.

Vanadium concentrations reported versus DOC concentrations display a large drop between 0.2 µm and 30 kDa filtrations in the two samples (Fig. 7c). This suggests that a significant fraction (about 40 %) of V has to be carried by large size organic colloids. By contrast, when looking at lower cut-off the V concentrations behave differently in the two samples. On one side for the uppermost sample (PF1) a three step-shape decrease following DOC concentrations lowering suggesting that V remains carried by the organic phase (lowand high-molecular weight). Whereas on the other side, the decrease of V concentrations follows that of Al. This suggests that as do Th concentrations regards to DOC and Al concentrations, V concentrations follow the same trend (Fig. 7d). Both V and Th concentrations in organic-rich upper level seem to be controlled by mixed DOC/Al-rich phases, whatever may be the pore size cut-off. Moreover, the large decrease of V concentrations following that of Fe between 0.2 µm and 30 kDa suggests that Fe-rich phases exert as well an important control on the speciation of V at this cut-off as earlier reported [START_REF] Pokrovsky | Iron colloids/organic matter associated transport of major and trace elements in small boreal rivers and their estuaries (NW Russia)[END_REF]. At lower filtration sizes, V concentrations tends to zero,

suggesting that V has also to be carried by a mixed Al/Fe/DOC-rich phase. The lower sample (PF3) displays a strong decrease in the first filtration step which implies that V is strongly bound to high-molecular weight organic material, and a constant V concentration after the 30 kDa filtration which implies that V behaves independently of DOC. However, the V concentration pattern is different in the DOC-depleted sample with no variation versus Al concentrations after the 30 kDa filtration. This suggests that V is not carried by an Al-rich phase, but mostly occurs as "truly" dissolved species as free hydrated ion.

6SHFLDWLRQ FDOFXODWLRQV

The aqueous speciation of some major (Ca, Mg, Al, Fe) and trace elements (Cr, Ni, Cu, Eu, Dy, Th) in the two samples are calculated using Model VI [START_REF] Tipping | Humic Ion-Binding Model VI: an improved description of the interactions of protons and metal ions with humic substances[END_REF]. The pH values were fixed at 7.08 and 6.93, for PF1 and PF3 samples, respectively. The DOC concentrations as well as major and trace elements concentrations input in the model were those displayed in Table 1. The Humic Acid (HA) and Fulvic Acid (FA) contents necessary to run both models are assumed to be equal to the difference between the DOC content of the < 0.2 µm fraction and that of the < 5 kDa fraction for HA, and to the DOC content of the < 5 kDa fraction for FA. Fractions of elements complexed to humic substances samples are reported in Table 2. As for the ultrafiltrations experiments three distinct groups appear from the calculations: (i) Mg, Ca, Ni appear to be mainly present as "truly" dissolved species in the solution, < 8 % of elements are complexed to humic substances. (ii) Fe and Al are partly complexed to organic matter; between 16 and 81 % of these elements are bound to humic substances. Al is more strongly bound to humic substances than Fe does. (iii) According to calculations Cr, Cu, Eu, Dy and Th exhibit comparable speciation : > 86 % (except Cu for PF1 sample) of elements are complexed by humic substances.

&RQIURQWLQJ VSHFLDWLRQ FDOFXODWLRQV ZLWK XOWUDILOWUDWLRQ GDWD

The need for the knowledge of "truly" dissolved and colloidal concentrations includes several points such as (i) an understanding of element geochemical cycles and partitioning, (ii) a better prediction of element fate in polluted environments, or (iii) the relevance to bioavailability issues. The comparison between results obtained by ultrafiltration and by speciation calculation leads to some comments. Three groups can be considered.

For Mg and Ca the results of speciation calculation are in good agreement with the ultrafiltration data. These elements behave as "free" ions in the dissolved pool in the form of inorganic species. Speciation calculations performed for Cr, Cu, Dy, Eu and Th give a higher proportion of elements bound to humic substances than those recovered from ultrafiltration data. By contrast, for Al, Fe and Ni speciation calculations give a slightly lower proportion of elements bound to humic substances as compared to those obtained from ultrafiltration data.

Even if there are slight differences between ultrafiltration and speciation calculations, trends are relatively similar for Al, Dy, Eu and Th. Major differences evidenced for Cr, Cu, Fe and

Ni could be explain by the fact models need improvement as already stated for Cu and Ni [START_REF] Unsworth | Model predictions of metal specition in freshwaters compared to measurements by in situ techniques[END_REF].

Since the binding constants with humic substances are not available for the whole set of studied elements, the speciation calculations were performed for part of them. However, the calculations were achieved for one or several elements belonging to each of the three groups, allowing these elements to be considered as a "pilot study" for each group. In the following, the discussion will be focused on these "pilot study" elements considering that these latter are representative of the elements within the different groups.

7UXO\ GLVVROYHG HOHPHQWV

Concentrations of alkalis and alkaline earth elements (major and trace ones) appear to be not significantly affected by ultrafiltrations suggesting that they are part of the dissolved pool. Since there is no clear relationship between DOC or Fe and these elemental concentrations, one can consider that these species do not occur as small-size organic or inorganic complexes in the dissolved pool. The speciation calculations performed during this study for alkalis and alkaline earth metals agree with ultrafiltration data. The occurrence of these metals in the dissolved pool was predictable since these elements belong to the class A ion group following the [START_REF] Nieboer | The replacement of the nondescriptive term heavy metals by a biologically and chemically significant classification of metal ions[END_REF] classification of elements. The so-called A group corresponds to metals with spherical symmetry and low polarizability. Aside from the metallic form, they always have a single oxidation state (+1) or (+2) for alkalis and alkaline earth elements, respectively [START_REF] Ahrland | The relative affinities of ligand atoms for acceptor molecules and ions[END_REF][START_REF] Nieboer | The replacement of the nondescriptive term heavy metals by a biologically and chemically significant classification of metal ions[END_REF].

This implies that they are not directly influenced by the redox status of the water and that they display the lowest stability complexes. Si, which also belongs to the type A group following Nieboer and Richardson classification, displays no significant variation of concentrations throughout the ultrafiltration procedure. This suggests that Si has also to be considered as a "truly" dissolved element. Although not part of the A class group, but part of the so-called "borderline" group [START_REF] Nieboer | The replacement of the nondescriptive term heavy metals by a biologically and chemically significant classification of metal ions[END_REF], Ni and Co behave also as "truly" dissolved ions as do alkalis and alkaline earth metals.

&RPSOH[HG PHWDOV

It is now widely accepted that colloidal material plays a significant role in the transport and cycling of trace metals in waters. However, as often debated elsewhere (Lyven et al., 2003 and references therein) the key question is which is the true competition between Fe-and C-based colloidal carriers for trace metals?

The inorganic colloidal pool as a metal carrier

Fe, unlike DOC is strongly affected by the first ultrafiltration step (i.e. 30 kDa). Fe is present as large-size colloids and is almost completely removed from solution after this first step. Fe and DOC behave independently during the ultrafiltration. Al, like Fe, is strongly affected by the first ultrafiltration step. Fe oxyhydroxides are though much more soluble than Al ones do [START_REF] Stumm | Aquatic chemistry[END_REF]. PF1 sample displays a strong dominance of Fe over Al, with a Fe/Al molar ratio as high as 20. In PF3 sample the Fe/Al molar ratio is smaller with Fe and Al concentration being present in equal proportion. Moreover, Al concentration is well correlated with that of Fe and is only weakly dependent on DOC. This indicates a control of Al by inorganic mixed Fe/Al oxyhydroxides colloids. However, the major controlling parameter remains pH which governs solubility of Fe oxyhydroxides and therefore the release and trapping of associated trace metals.

Thorium follows closely aluminum, being mostly controlled by Fe/Al oxyhydroxides.

Its concentration strongly decreases with the decrease of Al and Fe concentrations in the filtrate whereas it does not depend on DOC concentrations. Th is generally known to be immobile during weathering, accumulating in residual phases. However, his migration is possible in organic-and Fe/Al-rich waters [START_REF] Pokrovsky | Iron colloids/organic matter associated transport of major and trace elements in small boreal rivers and their estuaries (NW Russia)[END_REF]. Mixed Fe/Al colloids are essentially responsible for these concentrations as already observed elsewhere [START_REF] Pokrovsky | Iron colloids/organic matter associated transport of major and trace elements in small boreal rivers and their estuaries (NW Russia)[END_REF][START_REF] Geckeis | Aquatic colloids relevant to radionuclide migration/characterization by size fractionation and ICP-mass spectrometric detection[END_REF]. However, this result is different from those already published by [START_REF] Viers | Chemical weathering in the drainage basin of a tropical watershed (Nsimi-Zoetele site, Cameroon): comparison between organic-poor and organic-rich waters[END_REF] where this element appears to be exclusively controlled by DOC. Even if adsorption of organic matter would result in a negative surface charge on the iron colloid surface, the negative surface charge density would be significantly less than that at purely humic colloids so that a significant difference in electrostatic binding would still be expected. Thus, Fe/Al oxyhydroxides remain the major complexing agent of Th and in this case Th is mostly controlled by Fe/Al oxyhydroxides colloids.

Model VI tends to underestimate the proportion of metal bound to humic substances as compared to ultrafiltration data (Fig. 8). It is important to note that the < 5 kDa fraction is considered as free species, which is not true as fulvic acids are characterized by lower molecular weight. Thus, if the fraction > 5 kDa is considered to be the humic bound fraction and as the correlation between DOC and Fe and Al shows no common behaviour, ultrafiltration experiments should be taken into account carefully. Such a direct use of ultrafiltration results led to an overestimation of elements bound to humic substances regards to Model VI calculations.

5.2.2. The organic colloidal pool as a metal carrier REE and (+2) cations (V, Cr, Mn, Co, Cu) of the first transition series show strong correlation with DOC. These cations are all A-Type [START_REF] Nieboer | The replacement of the nondescriptive term heavy metals by a biologically and chemically significant classification of metal ions[END_REF], where electrostatic binding dominates over covalent one. It is therefore more expected for the smaller cations in each series to be associated with strongly negatively charged organic (humic) colloids than with iron colloids with small positive charge for circumneutral pH samples [START_REF] Stumm | Aquatic chemistry[END_REF]. Among the transition metals, the sequence of complex stability is known to be Mn 2+ < Co 2+ < Ni 2+ < Cu 2+ , a sequence known as the Irving-Williams

Series. As expected Cu appears to be the most strongly bound to organic ligands as evidenced elsewhere [START_REF] Buerge-Weirich | Adsorption of copper, nickel, and cadmium on goethite in the presence of organic ligands[END_REF]. [START_REF] Xue | Free cupric ion concentration and Cu(II) speciation in eutrophic lake[END_REF] and [START_REF] Tipping | Al(III) and Fe(III) binding by humic substances in freshwaters, and implication for trace metal speciation[END_REF] suggested that such strong binding has to be related to highly selective organic ligands, released by phytoplankton in order to control metal levels in their immediate environment.

Pronounced differences are observed in this study as compared to what is expected for the other transition metals (Eyrolle et al., 1993) with for example Ni occurring in the "truly" dissolved pool. This may be caused by the fact that organic molecules can often be characterized by more than one functional group and hence can coordinate a metal at several positions [START_REF] Stumm | Aquatic chemistry[END_REF]. Moreover, data are consistent with dominance of organic matter complexation of REE [START_REF] Johannesson | Rare earth element concentrations and speciation in organic-rich blackwaters of the Great Dismal Swamp, Virginia, USA[END_REF], even if REE in the highmolecular weight fraction (i.e. > 30 kDa) of PF1 sample seem to be complexed with Fe oxyhydroxides. These results are also consistent with evaluation made on models calculations onto REE speciation [START_REF] Pourret | Organic complexation of rare earth elements in natural waters: Evaluating model calculations from ultrafiltration data[END_REF].

In contrast, uranium may form oxocation UO 2+ at equilibrium in oxic waters. This cation is known to have a very strong affinity for carbonate ions. While carbonate concentrations are very low in the circumneutral pH groundwaters, binding to carboxylate and/or phenolate groups, which represent major functional group in humic substances [START_REF] Aiken | Humic substances in soil, sediment and water: Geochemistry, isolation and characterization[END_REF], may contribute to the observed association of U with organic colloids.

Model VI tends to overestimate the proportion of metals (Cu, Cr and REE) bound to humic substances (Fig. 8). It is important to note that the < 5 kDa fraction is considered as free species, which is not true as fulvic acids are characterized by lower molecular weight.

Thus, if all these elements (Cu, Cr and REE) are considered to be bound to organic ligands due to the good correlation they formed with DOC, model calculation results are in good agreement for these elements.

/LPLWDWLRQV RI 0RGHO 9, VSHFLDWLRQ FDOFXODWLRQV

Although the 5 kDa cut-off allow very small colloids to stay in solution, the lack of integration of adsorption processes onto inorganic species, as well as coprecipitation of inorganic species appear to be the major causes of disagreement between ultrafiltration data and speciation calculations for V and REE. It is then important to be aware that such model does not take into account any uptake of metals resulting from competitive reactions between Fe-and DOC-rich colloids. Moreover as stated by [START_REF] Unsworth | Model predictions of metal specition in freshwaters compared to measurements by in situ techniques[END_REF] model predictions of free ions activities generally did not agree with measurement (e.g. for Cd, Cu, Ni and Zn), highlighting the need for further work and difficulties in obtaining appropriate data.

The studied samples are organic-rich groundwaters with an organic pool that seems to be in excess regards to the metals available for complexation: in such samples the speciation appears to be constrained only by organic species. But, what does happen when the samples are organic-poor? Oxides, hydroxides, clay minerals, and organic matter present in the natural system become all potential sites for adsorption. Scavenging between oxyhydroxides and organic matter will occur and form ternary surface complex (surface/ligand/metal). However, such a competition is still difficult to interpret from ultrafiltration data. As evidenced by previously experimental data and calculations, it appears that the competitive reactions and the formation of ternary surface complexes on oxyhydroxides represent the major interferences of the organic ligands on metal adsorption [START_REF] Buerge-Weirich | Adsorption of copper, nickel, and cadmium on goethite in the presence of organic ligands[END_REF]. Cation ligand complexes can adsorb onto solid to form ternary surface complexes either, as cation linked to the mineral surface over the ligand or as ligand linked to the surface over the cation.

As an example, recently published experimental REE data [START_REF] Davranche | Impact of humate complexation on the adsorption of REE onto Fe oxyhydroxide[END_REF]2005) show the impact of ternary surface complexes (humates/oxyhydroxides/REE) on metal speciation. Thus, it appears absolutely necessary to take into account in such speciation models, processes such as adsorption onto Mn and Fe oxyhydroxides, considering that the lack of such reaction precludes any true speciation to be assessed, the competition between Fe and C-based colloidal carriers being required for constraining element geochemical cycles or element fate in polluted environments.

&RQFOXVLRQV

An ultracentrifugation method that allows the study of DOM-trace metal distribution at different pore size cut-offs was tested on two shallow, circumneutral pH waters: one dissolved DOC-and Fe-rich and a second DOC-rich and Fe-poor. Data were analyzed using an ascendant hierarchical classification. Three groups of elements were identified regards to their affinity for DOM, which implies several consequences regards to their respective bioavailability or fate in the environment: (i) a "truly" dissolved behaviour group (Na, K, Rb, Ca, Mg, Ba, Sr, Si and Ni), (ii) an inorganic colloidal pool (Fe, Al and Th) and (iii) an organic colloidal pool (Cr, Mn, Co, Cu and U). However, REE and V have an ambivalent behaviour, being alternatively in the organic pool and in the inorganic pool depending on sample.

Moreover, speciation calculation using Model VI were performed on both samples on some elements (Ca, Mg, Ni, Fe, Al, Th, Cr, Cu, Dy, Eu). Calculation shows relatively comparable elemental distribution with regards to ultrafiltration. Although some limitations appear: a direct use of ultrafiltration results tends to overestimate the fraction of elements bound to humic material in the inorganic pool as well as, a direct use of speciation calculation results tends to overestimate the fraction of elements bound to humic material in the organic pool with regards to ultrafiltration data. Both techniques, ultrafiltration and speciation calculation, give complementary information, especially for more complex samples where inorganic and organic colloids compete. The formation of water-soluble complexes between humic materials and metal ions (radioactive, toxic or none) can increase the concentrations of these species in natural water to higher levels than expected from their thermodynamic solubilities.

Since the retention, transport and fate of trace metals mediated by organic matter has still to be better constrained to understand the functional role played by DOM at the soil-water interface regards to trace metal dynamics, further studies dedicated to space-and time-linked variations of the joined colloidal pool and trace element partitioning has to be now undertaken in waters from different DOM-rich environments.

$FNQRZOHGJPHQWV

We thank the technical staff and undergraduates at Geosciences Rennes Laboratory for their 7DEOH FDSWLRQV and DOC in mg L -1 , and alkalinity in µmol L -1 .

Table 2. Speciation calculations results: proportion of elements complexed with humic substances.

  than do DOC concentrations suggesting that Th is probably mostly carried in solution by high-molecular weight organic-rich colloids. Th concentration versus Al concentration diagram (Fig. 6d) suggests that Th might be also partly carried by Al-rich phases as well as DOC-rich ones. Clays and clay-organic complexes could be possible Th carriers in these waters. 4.1.2. Peculiar elemental distribution in the DOC-depleted sample REE and V display an ambivalent behaviour regards to sample considered. Plot of 5(( FRQFHQWUDWLRQV YHUVXV '2& FRQFHQWUDWLRQV IRU WKH VXFFHVVLYH XOWUDILOWUDWLRQV )LJ 7a)

Fig. 4 .

 4 Fig. 1. Sketch showing (a) topography, channel network geometry and geographical location

Fig. 5 .

 5 Fig. 5. Variations of (a) Cu and (b) U concentrations versus DOC concentrations in the

Fig. 6 .

 6 Fig. 6. Variations of (a) Al, (b) Fe, (c) Th concentrations versus DOC concentrations and (d)

Fig

  Fig. 1.

  0.012 0.012 0.010 0.009 0.003 0.004 0.135 0.096 0.095 0.075 0.071 0.046 0.044 Tb 0.005 0.001 0.002 0.001 0.001 0.000 0.001 0.013 0.010 0.009 0.007 0.007 0.004 0.004 Dy 0.026 0.009 0.008 0.007 0.007 0.003 0.003 0.067 0.049 0.047 0.035 0.037 0.022 0.021 Ho 0.005 0.002 0.002 0.002 0.002 0.001 0.001 0.013 0.009 0.010 0.007 0.007 0.004 0

Table 1 .

 1 Ultrafiltration results, all concentrations are expressed in ppb, except Cl -, NO 3

	-, SO 4	2-

Table 1 .

 1 Mg Al Ca Cr Fe Ni Cu Eu Dy Th PF1 3 58 5 86 16 6 61 96 100 89 PF3 2 81 3 94 43 8 95 99 100 96

Table 2 .

 2