Anne-Hélène Olivier

Antoine Marin

Joris Boulo

Aurélie Dommes

Gaetan Merlhiot

Nguyen-Thong Dang

Fabrice Vienne

Régis Lobjois

Viola Cavallo

Armel Crétual

Body movement strategies to initiate the crossing of a street in front of traditional and self-driving cars in young and older adults

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

PRELIMINARY RESULTS & DISCUSSION

To investigate body movement strategies performed before crossing the street in OA wrt. YA in complex mixed traffic

❖

  48% of pedestrians fatalities involve people aged 65 or more [1] Deficits in street crossing behaviors in Older Adults (OA) [2, in a simulator]:  walking speed,  of risky decisions Young adults'(YA) strategies : the head initiates the crossing movement, followed by the shoulders, elbows, wrists, hips, knees and ankles [3, in front of a TV screen] Head rotation is not a key factor to predict street crossing [4, using real street condition] Self-driving vehicles = new challenges on the road[5] Identifying pedestrians' motion invariants could be a key to safety Between-group design 30 YA, 21-39yo 30 OA, 68-81yo Task: cross (or not) a virtual two-way street by walking in a simulator Conditions: 120 street crossings trials in the following conditions METHODS Anne-Hélène Olivier 1 *, Antoine Marin 1 , Joris Boulo 1 , Aurélie Dommès 2 , Gaëtan Merlhiot 2 , Nguyen-Thong Dang 2 , Fabrice Vienne 2 , Régis Lobjois 2 , Viola Cavallo 2 , Armel Crétual 1 1 Université Rennes 2, Inria, M2S, Rennes, France 2 University Gustave Eiffel, Versailles, France *anne-helene.olivier@inria.fr BODY MOVEMENT STRATEGIES TO INITIATE THE CROSSING OF A STREET IN FRONT OF TRADITIONAL AND SELF-DRIVING CARS IN YOUNG AND OLDER ADULTS. of the delays to initiate the crossing movement for head, shoulders and hips with respect to the feet •Hierarchical clustering on body segments angles profile 2s before the initiation of crossing by the toe to identify specific groups of behavior. Delays in body movement initiation (12 YA-16 OA) • YA & OA: Top-down sequence to initiate the street crossing in accordance with [3] Head ➔ Shoulders ➔ Hips ➔ Toe • Very small effect of aging and traffic conditions (resp. p<.001, ƞ²=.04, p<.005, ƞ²=.01) ❖ Body segment angles profiles (29 YA-20 OA) • Variability in left-right rotation angles profiles of the head, hips, shoulders • Forward tilt profile of the trunk more consistent present work was supported by grants from the French Ministry of the Interior, Road Safety Department. The author would like to thank the young and older adults participants for their participation, interest, and cooperation. References: : [1] Sécurité Routière 2017-France [2] Dommes et al. Accident; Analysis and Prevention, 59, 135-143. (2013) , [3] Kalantarov et al. Transportation Research Part F: Traffic Psychology and Behaviour, 53, 155-171. (2018), [4] Sprenger et al. CASA 2019, [5] Amini et al.Transport Reviews, 41(6), 788-813 (2021). Illustrations : freepik.com Forward head motion & trunk tilt angle promising predictors of street crossing Consistent body behavior between YA and OA to initiate street crossing


Nesrine Kaaniche

Maryline Laurent

Privacy-preserving Multi-user Encrypted Access Control Scheme for Cloud-assisted IoT applications

Keywords: Cloud-assisted IoT, Attribute based Encryption, access control, aggregation, privacy

In this paper, we present a privacy preserving encrypted access control scheme to aggregate data for Cloud assisted IoT applications. Our scheme is based on attribute based encryption mechanisms and consists in enciphering a set of data contents, with respect to sub-sets of a general access policy. As such, the gateway is able to decrypt the resulting aggregated data only if it holds the matching certified attributes and it has received a sufficient number of partial ciphertexts. Our construction has several advantages. First, it provides a finegrained access to aggregated data contents that are enciphered by different multiple encrypting entities. Second, it provides a privacy preserving encryption process, such that a curious gateway can neither identify the enciphering IoT device nor decipher single data chunks. Third, our concrete construction provides low computation and communication costs, adapted to resource-constrained devices, compared to most closely related schemes.

I. INTRODUCTION

During the last decade, Internet of Things (IoT) approached our lives in many ways, thanks to the availability of several communication systems that have been increasingly deployed, mainly for smart monitoring and control applications. According to the U.S. International Data Corporation (IDC) [START_REF] Torchia | Worldwide semiannual internet of things spending guide[END_REF], IoT is experiencing a fast expansion with an estimated 16.7% growth year over year in 2017 to reach nearly $1.4 trillion by 2021. Typically, IoT deployments permit a collection of smart objects, generally considered as resource-constrained devices, to communicate among themselves and also to an external gateway or a base-station, for further processing. Thus, cloud computing-enhanced IoT has recently received considerable attention, as the gateways deployed at the network edge can not only provide low latency, location awareness but also improve real-time and quality of services in IoT application scenarios, while protecting the secrecy of transmitted sensed data and preserving the privacy of devices.

Privacy-preserving data aggregation is one of the typical cloud assisted IoT applications, and many privacy-preserving data aggregation schemes have been proposed in the past years for ensure reliable processing of data collected from different IoT devices. Indeed, in IoT applications, data are always transmitted, stored and dynamically shared through heterogeneous and distributed networks [START_REF] Nguyen | Survey on secure communication protocols for the internet of things[END_REF], [START_REF] Hammoudeh | A wireless sensor network border monitoring system: Deployment issues and routing protocols[END_REF]. Consequently, encryption and access control mechanisms are important in order to prevent unauthorized entities from accessing data [START_REF] Roman | Securing the internet of things[END_REF], [START_REF] Carlin | Defence for distributed denial of service attacks in cloud computing[END_REF], [START_REF] Belguith | Phoabe: Securely outsourcing multi-authority attribute based encryption with policy hidden for cloud assisted iot[END_REF].

Contributions -In this paper, we introduce a new privacy preserving multi-user encrypted access control scheme to aggregated data, based on the use of Ciphertext-Policy Attribute based Encryption (CP-ABE) mechanisms [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], that ensures privacy-preserving processing for IoT applications. CP-ABE is a powerful primitive that provides an encrypted access control mechanism, based on fine-grained access structures. However, this encryption technique suffers from heavy computation overhead which is burdensome for resource-constrained devices. As such, our construction consists in performing in a secure collaborative manner the encryption of a set of data chunks. The main idea behind our encrypted access control scheme relies on the distribution of the enciphering operation among different devices, with respect to sub-sets of a general access structure. That is, each device encrypts its input data and sends the partial enciphered information to an untrusted gateway. Thus, if this latter holds the matching certified attributes and receives a sufficient number of partial ciphertexts then it will be able to aggregate and then decrypt the computation result.

Paper organization -Section II introduces a motivating use-case and highlights the design goals. Section III presents Attribute based Encryption mechanisms and reviews related work. Section IV details the network and security models. Section V provides useful theorems and presents our concrete construction. Section VI gives a security analysis and section VII discusses the performances of the proposed scheme. SectionVIII gives possible improvements before concluding in section IX.

II. PROBLEM STATEMENT

In this section, we first give a motivating scenario (cf. section II-A). Then, we highlight the security and functional design goals (cf. section II-B).

A. Motivating Scenario

The use of IoT devices is gaining an expanding interest mainly for remote health monitoring which is widely applied by several health organizations to provide better personalized services. Indeed, Wireless Body Area Networks (WBANs) consist of intelligent and resource-constrained devices that can be placed on the patient body to monitor his health status. WBANs devices monitor various parameters such as blood gas, blood pressure, pulse rate, temperature, electrocardiogram (ECG), and electroencephalogram (EEG) (cf. Figure 1).

While dealing with medical data, security and privacy are among the most challenging issues. For instance, the EGC can reflect users some specific behaviors, such as sleeping, having meals and so on. In the sequel, the reveal of such health data might violate users privacy. Therefore, how to efficiently aggregate different types of data and preserve users privacy is still challenging in cloud assisted WBANs. Hence, the data transmitted in health-care applications should be authenticated and secured against malicious access. In addition, developing security techniques to secure patients' data should fulfill low communication and computation cost requirements. Thus, the resource consumption in a WBAN is tied up to the amount of data being processed, stored, and transmitted. Hence, aggregation has been often presented as a solution to take advantage of the aggregating node computing capabilities in order to process sensed data. In the architecture depicted in Figure 1, the WBAN gateways are responsible for performing aggregation of the data received from the smart things deployed on the body of the patient, then to transmit deciphered data to the cloud. This latter receives all IoT devices' aggregated data via the fog device, and makes some data analytics according to some application requirements. Thus, aggregated data should be accessed by a set of authorized gateways, thus ensuring a flexible access control mechanism.

B. Design Goals

The design of our encrypted access control scheme is motivated by providing the support of both robustness and efficiency while fulfilling the following properties:

• multi-user fine grained access controlour proposal should ensure flexible access policies among different groups of users. In addition, the aggregated accessed data may be enciphered with different IoT devices. • data confidentialitythe proposed scheme has to protect the secrecy of encrypted data contents against malicious entities, even in case of collusions. • privacypreserving users' privacy is multifold. First, it is useful in a context where anonymity should be enforced to forbid any user's identification or personal information leakages (e.g. sex, age, address). Second, unauthorized users should not be able to obtain any information about honest users' inputs, or to link the obfuscated content to a specific entity. Third, access to obfuscated data should not reveal identifying information of the requesting entity. • low processing and communication coststhe designed algorithm should have low computational complexity and reduced communication overhead, to efficiently adapt to IoT applications.

III. ATTRIBUTE BASED ENCRYPTION

In 2005, Sahai and Waters introduced the concept of Attribute Based Encryption [START_REF] Sahai | Fuzzy identity-based encryption[END_REF], as a generalization of Identity based Encryption (IBE), introduced by Shamir [START_REF] Shamir | Identity-based cryptosystems and signature schemes[END_REF], in 1984, with the original idea to provide public and private key pairs based on user's unique identity. ABE appears as a promising technique, designed for ensuring encrypted fine grained access control, for many users based on general access policies. In ABE, both users' private keys and ciphertexts are associated with a set of attributes or a structure over attributes and the user is able to decrypt a ciphertext if there is a match between his private key and the ciphertext [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. For instance, Goyal et al. [START_REF] Goyal | Attribute-based encryption for fine-grained access control of encrypted data[END_REF] distinguish two ABE categories, namely: Key-Policy ABE (KP-ABE) and Ciphertext-Policy ABE (CP-ABE). There exist some differences between KP-ABE and CP-ABE mechanisms. In fact, for KP-ABE schemes, the secret key of user U is derived with respect to an access structure Γ u , and the ciphertext is generated according to a set of attributes S CT . As such, the user U can decrypt the ciphertext CT if the set of attributes S CT satisfy the access tree associated with the user' secret keys. On the contrary, for CP-ABE schemes, the secret key of user U is associated with a set of attributes S u , and the ciphertext is created with respect to an access tree Γ. As such, U can decrypt the ciphertext CT if the set of attributes S u associated to his secret key satisfy the access tree.

CP-ABE is a very interesting primitive, that permits to ensure fine-grained access control, by directly embedding the access policy on the ciphertext. However, its processing and communication overheads are still highly resource-consuming, mainly for IoT devices [START_REF] Kaaniche | Data security and privacy preservation in cloud storage environments based on cryptographic mechanisms[END_REF]. In [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF], Touati et al. proposed a cooperative CP-ABE scheme, such that resource-constrained devices can delegate the most consuming operations to unconstrained nodes. However, their scheme does still require a central trusted party that has to derive the secret enciphering key. As such, [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF] cannot be adapted for fully distributed environments. Afterwards, the authors presented a collaborative KP-ABE scheme for Cloud assisted IoT applications [START_REF] Touati | Collaborative kp-abe for cloud-based internet of things applications[END_REF]. Their construction is based on the use of computing and storage capacities of cloud servers and assistant nodes to perform heavy operations and save resources of tiny smart objects. In the same vein, Oualha and Nguyen extended the CP-ABE construction proposed by Bethencourt et al. in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], to apply the scheme in the context of resource-constrained IoT devices [START_REF] Oualha | Lightweight attribute-based encryption for the internet of things[END_REF]. The authors proposed a hybrid approach alternating precomputations and on-demand computations can be devised to overcome the issue of limited storage and processing capacities' of IoT. Recently, in 2017, Odelu et al. presented a new RSA-based CP-ABE scheme with constant size ciphertexts (CSKC) and low complexity for both decryption and encryption processes [START_REF] Odelu | Expressive cp-abe scheme for mobile devices in iot satisfying constant-size keys and ciphertexts[END_REF]. However, these proposed schemes do not consider enciphering a set of different data chunks, hence providing a multi-encryptor setting and enabling the deciphering entity to only decrypt the aggregated data content.

IV. DESIGN MODELS

In this section, we formalize our system (cf. section IV-A) and security (cf. section IV-B) models.

A. System Model

For our system model, five entities are identified: an attribute authority (AA), a manager (GM), a set of IoT devices {U i } {i=1,••• ,n} , a set of sink aggregating entities {S j } {j=1,••• ,m} and a selected IoT trusted node defined such as:

• attribute authority AA -is responsible for bootstrapping the whole system in the initialization phase. We assume that AA is a trusted entity. It also issues certified attributes and related secret keys for the aggregating entities and IoT devices. • manager GM -is in charge of generating the general access predicate used to encrypt data contents as well as the aggregating function for each specific cloud-IoT application.

• aggregating entity (S j ) -is considered as a local network gateway. It is responsible for collecting and deciphering aggregated data contents. • IoT device (U i ) -collects and encrypts sensed data before forwarding them to the aggregating entity. • trusted IoT node (U s ) -is a trusted selected IoT device and it periodically assigns to each involved IoT device U i a sub-access predicate to be used for encrypting data. Our scheme is composed of six randomized algorithms based on three phases, namely SYSINIT, CO-ENCRYPT and AGGREGATION. During the SYSINIT phase, the central attribute authority generates public system parameters and derives secret keys of aggregating entities, based on the setup and keygen algorithms, respectively. This phase is executed once for the system initialization. The CO-ENCRYPT phase starts when the encryption of data chunks are requested. The second phase relies on two different algorithms, namely accshare, executed by the trusted IoT node and encpart, performed by each participating entity. The AGGREGATION phase permits an aggregating authorized entity to build the resulting ciphertext and to decrypt it with respect to its associated attributes. This phase is based on two different algorithms, i.e; aggregate and decrypt. The different algorithms are detailed in Section V.

B. Security Model

For designing a secure and privacy preserving encrypted access control scheme, we consider two main adversaries.

We first point out the case of semi-honest gateway. That is, a semi-honest adversary provides proper inputs or outputs, at each step of the protocol, and properly performs any expected calculations, but it may attempt to gain extra information from the protocol. As such, we consider the semi-honest threat model against the privacy requirement with respect to the anonymity and unlinkability properties. Second, we consider the case of malicious adversaries, trying to override their rights. That is, malicious users may attempt to deviate from the protocol or to provide invalid inputs. For instance, a malicious party can also influence other parties to deviate from the protocol by substituting their local inputs in order to get information about honest parties' inputs. Likewise, the malicious party may refuse to participate or leave the protocol before the end. As such, we consider the malicious user security model mainly against the confidentiality property.

V. CONCRETE CONSTRUCTION OF OUR PRIVACY PRESERVING ACCESS CONTROL SCHEME TO AGGREGATED ENCRYPTED DATA

Our privacy-preserving access control scheme is relying on ABE in the sense that clients' keys and decryption capabilities are related to the attributes they possess. In our proposal, the ciphertext is generated with respect to a set of messages and the aggregating gateway's credentials (certified attributes) determine his capability to decrypt the result of a computed function f over the enciphered set of messages. That is, the manager GM defines the aggregating function f and the general access policy, w.r.t. each application requirements. Our scheme consists in performing the encryption of a set of different data chunks collected by a set of IoT devices. It relies on the distribution of the enciphering operation among different devices, with respect to sub-sets of a general access structure Γ, such that Γ = ∪ i∈[1,n] γ i . More precisely, each device U i encrypts its sensed data message m i relying on a sub access structure γ i and sends the partial enciphered information to an untrusted aggregating gateway S j .

In the following, we introduce preliminaries before detailing our concrete construction.

A. Mathematical Background

In this section, we provide some prerequisites, namely access structures and bilinear maps.

Definition 5.1: (Access Structure [1]) Let P = {P 1 , P 2 , • • • , P n } be a set of parties, and a collection A ⊆ 2 {P1,P2,••• ,Pn} is called monotone if ∀B, C ⊆ 2 {P1,P2,••• ,Pn} : if B ∈ A and B ⊆ C then C ∈ A. An access structure is a collection A of non-empty subsets of {P 1 , P 2 , • • • , P n } ; i.e. A ⊆ 2 {P1,P2,••• ,Pn} \ {∅}.
The sets in A are called authorized sets, and the sets not in A are called unauthorized sets. Note that in several ABE schemes, these parties are considered as the attributes. Definition 5.2: (Bilinear Maps) Let G 1 , G 2 , and G T be three cyclic groups of prime order p. Let g 1 , g 2 be generators of G 1 and G 2 respectively . A map ê : G 1 ×G 2 → G T is said to be bilinear if it satisfies the following properties: (i) bilinearity: for all g 1 ∈ G 1 , g 2 ∈ G 2 , (ii) non-degeneracy: ê(g 1 , g 2 ) = 1 and (iii) there is an efficient algorithm to compute ê(g 1 , g 2 ) for any g 1 ∈ G 1 and g 2 ∈ G 1 .

B. Access Tree Model

Let Γ be a tree representing the access structure, following the definition given in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. Indeed, each non-leaf node of Γ is described by the number of its children num x and a threshold value t x , where 1 ≤ t x ≤ num x . If the threshold value t x = num x , then it is an "AND "gate, otherwise it is an "OR "gate.

As introduced in [3], three additional functions are defined namely parent(x), att(x) and index(x). The parent(x) function denotes the parent of the node x, the att(x) denotes the attributes associated with the leaf node x and the index(x) denotes a number associated with the node. Satisfying an access tree -Let Γ be an access tree rooted at the node r. We denote by Γ x the subtree of Γ rooted at the node x, such that Γ r = Γ. As such, Γ x (S) = 1 if a set of attributes denoted S satisfies the access tree Γ x . If x is a non-leaf node, Γ x (S) is computed by recursively evaluating the subtrees Γ x (S) for all its x children.

Γ x (S) returns 1 if at least t x children returns 1. If x is a leaf node, then Γ x (S) = 1 if att(x) ∈ S.

C. Concrete Construction

Our construction is an access control scheme for multi-user encryption settings, based on the ciphertext policy attribute based encryption algorithm introduced in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. To support the multi-user encryption feature, the proposed scheme considers that the encryption process is performed by each participating device U i relying on a secret s i with respect to a dedicated access subtree γ i , while the decryption process should be performed with respect to a general access structure Γ = ∪ i∈ [1,n] γ i , where n is the number of sub-trees.

Let U = {U 1 , • • • , U n } be a set of IoT devices such that |U| = n. Each participant U i has to encrypt a message m i (i.e; i ∈ [1, n]), w.r.t. an access subtree γ i and publish the partial ciphertext CT i to the aggregating entity S j . The encryption of each message m i by U i relies on a different secret share s i . The decryption of the resulting message M , defined as

M = f ({m i } {i∈[1,n]}
) may be executed by any S j 1 . In the following, we detail the different algorithms of our construction, thus we suppose that GM has already set up the general access tree Γ and the aggregating function f . That is, during the SYSINIT phase, AA executes setup and keygen defined as follows:

• setup -this algorithm is executed by the attribute authority. It takes as input the security parameter κ and outputs the global public parameters pp and the master secret key msk. the setup algorithm first defines a bilinear setting (ê, G 1 , G 2 , p, g), such as ê : G 1 × G 1 ← G 2 and g of 1 For ease of presentation, f refers to the multiplication function. Yet, in general use cases, f may be any bijective and homomorphic function.

a generator of G 1 . Then, it selects at random an integer α ∈ Z. Let h := g β ∈ G 1 and H be a cryptographic hash function, such that H : S → G 1 . The global parameters of our system are as follows:

pp = {G 1 , G 2 , ê, p, g, h, ê(g, g) α , H}
We note that the master secret key of the attribute authority is the couple msk = {β, g α }.

• keygen -this algorithm is performed by the attribute authority, as detailed in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], in order to derive private keys associated with a set of attributes S = {a j } {j∈ [

sk = {D = g (α+r)/β , ∀a j ∈ S, D j = g r • H(a j ) rj , D j = g rj }
During the CO-ENCRYPT phase, two algorithms accshare and encpart are performed by the trusted device U s and each participating entity U i respectively:

• accshare -this algorithm is performed by U s , in order to set up required enciphering elements for the n participating users {U i } i∈ [1,n] . Note that this algorithm is performed periodically, for saving the energy consumption of involved IoT devices. That is, U s defines the access subtree γ i associated with each user

U i , such that {(U i , γ i )}, where i ∈ [1, n] and Γ = ∪ i∈[1,n] γ i .
Then, it chooses a secret deciphering key s such as s = n i=1 s i and s i is the secret share associated with each device U i . Finally, U s sets C = h s and outputs :

{{(γ i , s i )} i∈[1,n] , C}
Recall that each (γ i , s i ) is privately shared with the corresponding U i , while C is published for further processing by the aggregating entities.

• encpart -this algorithm is run by each participating IoT device U i , in order to derive a partial ciphertext CT i for a message m i , with respect to an access sub-tree γ i , a secret share s i and the aggregating function f . U i proceeds similarly as explained in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. That is, for each node x of its associated sub-tree γ i , U i defines a polynomial q x of degree

d x = k x -1
where k x is the threshold value of the node x and q x (0) = q parent(x) (index(x)). , such that C i,j = g qy j (0) and C i,j = H(att(y)) qy j (0) . Afterwards, U i encrypts the message m i with respect to γ i and outputs the partial ciphertext CT i such that:

Let L = {Y 1 , Y 2 , • • • , Y n }
CT i = { Ci , ∀y j ∈ Y i , j ∈ [1, |Y i |] : C i,j , C i,j }
where, Ci depends on the aggregating function f pointed out by the manager. In the sequel, the encrypted message CT i is defined as follows:

     Ci = m i • ê(g, g) αsi C i,j = g qy j (0) C i,j = H(att(y)) qy j (0)
Recall that the partial ciphertext CT i associated to each IoT device U i does not include γ i . Remark 5.3: Processing cost efficiency for IoT devices -Considering resource constraints of IoT devices, in terms of storage and processing, our scheme assumes that several elementary functions may be used for several encryption sessions (i.e., computation of polynomials and encryption of leaves' nodes). As such, only a few number of exponentiations and multiplication is required by each single IoT device. In addition, for devices with a very limited lifetime and low storage and computation capacities, it is assumed that these objects are pre-configured by the manufacturer with a secret s i . As such, once installed in the system, this secret is shared with the IoT trusted node. As a consequence, the IoT trusted device computes the ciphertext element C with respect to the secrets of involved IoT devices, while selecting different combinations of devices for each session. And, the communication overheads are highly reduced during the whole lifetime of resource-constained IoT devices, while avoiding exchanging secrets and re-computing some ciphertexts' elements periodically .

During the AGGREGATE phase, two algorithms aggregate and decrypt are performed by the aggregating node S j :

• aggregate -this algorithm is executed by the aggregating entity S j , upon receiving the n ciphertexts from the participating entities {U i }, where i ∈ [1, n]. It permits to build a global ciphertext, with respect to the global public access tree Γ and the aggregating function f . The aggregate algorithm outputs an aggregated global ciphertext CT , defined as:

CT = { C, C, ∀Y i ∈ L, ∀y j ∈ Y i : C i,j , C i,j }
where C is received from the trusted IoT node and C is computed as follows:

i∈[1,n] Ci = n i=1 m i • ê(g, g) α n i=1 si = M.ê(g, g) αs
In the following, we denote by C y and C y each element C i,j and C i,j , respectively. • decrypt -this algorithm, executed by the aggregating entity S j , permits to decrypt the aggregated ciphertext CT , including the global access structure Γ and the private key sk associated with S. The decrypt algorithm is mainly based on the Bethencourt et al. construction [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF].

To do so, for decrypting the aggregated ciphertext with respect to the function f , the aggregating entity uses a recursive algorithm DecryptNode(CT, sk, x), as defined in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF] which takes as input the global ciphertext CT , the private key sk, associated with a set of attributes S, and a node x from the global access tree Γ. If x is a leaf node, then we denote by a i = att(x).

If the attribute a i ∈ S, then

DecryptNode(CT, sk, x) = ê(D i , C x ) ê(D i , C x ) = ê(g, g) rqx(0)
else, DecryptNode(CT, sk, x) =⊥. If x is a non-leaf node, then DecryptNode(CT, sk, x) processes as follows, except for the root node and its direct children: For all the children nodes z of x, the algorithm computes F z = DecryptNode(CT, sk, z). Let S x be an arbitrary k x -sized set of child nodes z where F z =⊥. Recall that if there are no such existing set then the node is not satisfied and the algorithm returns ⊥. In addition, we denote by i = index(z) and S x = {index(z), z ∈ S x }. In the sequel, the aggregator computes F x , defined as:

F x = z∈Sx F δ i,S x (0) x = ê(g, g) rqx(0)
Finally, S j derives A = ê(g, g) rs , associated with the root node and decrypts M such that:

C ê(C,D) A = M VI. SECURITY DISCUSSION
To prove the efficiency and the security of our scheme, a security analysis is presented in this section.

A. Correctness

The correctness of the proposed scheme relies on Theorem 6.1, based on the correctness of aggregate and decrypt algorithms which are defined w.r.t. the multiplication function.

Theorem 6.1: Correctness -The proposed scheme is correct if for all security parameter κ, all universe descriptions S, all (pp, msk) ∈ setup(κ), all S ⊆ S, all (m, M ) ∈ M (i.e; M is the message space), all (γ, Γ) ∈ G (i.e; G is the access structure space), all sk ∈ keygen(pp, msk, S), all (C, (s i , γ i )) ∈ accshare(pp) and all CT i ∈ encpart(γ i , s i , m i ), then aggregate(pp, f, {CT i } i∈ [1,n] ) = CT , where n is the number of received ciphertexts, if S satisfies Γ, such that Γ(S) = 1, then the decryption algorithm decrypt(pp, CT, sk) outputs M .

Proof: Upon receiving n different encrypted data chunks for the participating devices [1,n] , the aggregating entity S j executes the aggregate algorithm, with respect to f , defined by GM . The aggregation process mainly relies on the computation of C, based on the received { Ci } i∈ [1,n] . That is, the computation of C is performed as follows:

{CT i } i∈[1,n] = { Ci , ∀y j ∈ Y i , j ∈ [1, |Y i |] : C i,j , C i,j } i∈
C = i∈[1,n] Ci = n i=1 m i • ê(g, g) α n i=1 si = M.ê(g, g) αs
In the sequel, the global ciphertext CT is defined as follows:

CT = { C, C, ∀y : C y , C y }
where y is a leaf node of the global access structure Γ.

Upon building the global ciphertext and receiving the secret keys associated to S (i.e; S is the set of attributes of the aggregating entity) from AA, the aggregating entity can decrypt CT , if his credentials satisfy the access structure (i.e; Γ(S) = 1). Our decryption algorithm mainly relies on the Bethencourt et al. construction [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], w.r.t. the DecryptNode function, executed for each access-tree node. As such, the decrypt algorithm outputs the resulting message M , as follows:

C ê(C,D) A = M • ê(g, g) αs ê(h s ,g (α+r)/β ) ê(g,g) rs = M • ê(g, g) αs ê(g,g) αs ê(g,g) rs ê(g,g) rs = M
As such, we prove the correctness of our proposed construction, with respect to Theorem 6.1.

B. Confidentiality

To ensure efficient multi-user encryption scheme while enhancing fine-grained access control, our construction mainly relies on the CP-ABE scheme proposed by Bethencourt et al. [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. As such, the data confidentiality preservation is tightly related to the security of this used encryption algorithm.

Theorem 6.2: The proposed multi-user encryption scheme ensures the secrecy of both encrypted data chunks and aggregated data contents.

Sketch of Proofthe proof of Theorem 6.2 is twofold. First, the secrecy of encrypted data contents depends on the security of the attribute based encryption algorithm used to encipher data chunks provided by IoT devices. Thus, our proposed scheme inherits the indistinguishability property from [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], such that if a malicious adversary has some information about the plaintext, it should not learn about the ciphertext. This security notion requires the computational impossibility to distinguish between two messages chosen by the adversary. Note that in ABE schemes, the adversary may lead an attack against the indistinguishability property either on his own or through a collusion attack. Indeed, similar to [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], each private key element contains a random value r related to each participating entity, which prevents colluding users to override their rights and successfully perform a collusion attack. In addition, subaccess encrypting predicates used to encrypt data chunks are not communicated to the aggregating gateway S j . As a consequence, this latter cannot deduce data chunk content, even by conducting a brute force attack, because of the use of C = h s = h n i=1 si . In fact, this value is published by the IoT trusted device, where a malicious aggregator needs to have each single C i = h si and the corresponding sub-access tree γ i to be able to conduct such attack. Second, the secrecy of resulting aggregated contents depends on the consistency of the aggregating algorithm agg, such that aggregated data contents are only accessed by the authorized aggregator. Indeed, the general enciphering access predicate is published by the system administrator to the involved aggregating entities. As such, thanks to the use of attribute based encryption, data are only accessed by entities whose attributes satisfy the access policy.

C. Privacy Theorem 6.3: The proposed scheme is private against both malicious and honest but curious adversaries.

Sketch of Proof -The proof of Theorem 6.3 is twofold. First, it considers the case of malicious users against the privacy of contents. That is, a malicious adversary tries to get access to a single encrypted data chunk. Obviously, this sub-case is related to the confidentiality requirement (cf. Theorem 6.2). Recall that a malicious aggregator cannot deduce data chunks even by conducting a brute force attack, because of the use of a general access tree Γ and a single ciphertext element C. Second, it considers the case of honest but curious adversaries against the privacy of devices. That is, a curious aggregating gateway attempts to distinguish between two legitimate enciphering devices U 1 and U 2 , trying to link the encrypted data related to each device. Mainly, our scheme inherits this privacypreserving property from the used attribute-based encryption mechanism [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. That is, the encryption of a message relies on a random secret s = n i=1 s i , thus a non-identifying enciphering secret, contrary to traditional public key encryption mechanisms. In our proposed multi-user encryption scheme, each device uses a different random s i to encrypt the sensed message m i . Thus, our multi-user encrypted access scheme ensures the privacy of users, against honest but curious adversaries.

VII. PERFORMANCES ANALYSIS

Table I presents a comparison between our proposal and most closely related schemes, w.r.t. functional requirements.

It is worth noticing from Table I that compared to the different presented constructions [START_REF] Sahai | Fuzzy identity-based encryption[END_REF], [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF], [START_REF] Touati | Collaborative kp-abe for cloud-based internet of things applications[END_REF], [START_REF] Odelu | Expressive cp-abe scheme for mobile devices in iot satisfying constant-size keys and ciphertexts[END_REF], our proposed scheme provides the multi-user ciphertext-policy encryption feature, relying on general access structures. That is, as stated in section III, although the KP-ABE scheme offers fine-grained access control feature, it has one main disadvantage. Indeed, data owners cannot decide on who has access to their encrypted data, except by their choice of descriptive attributes for the data, since the access policy is embedded in the user private keys. As a result, the data owners have to trust the key issuer. Ciphertext-policy ABE schemes remove such inconvenience by directly embedding the access policy on the ciphertext. The data owners can now authorize who can have access on their encrypted data. While constructions proposed in [START_REF] Sahai | Fuzzy identity-based encryption[END_REF], [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF] and [START_REF] Odelu | Expressive cp-abe scheme for mobile devices in iot satisfying constant-size keys and ciphertexts[END_REF] do not support the aggregation feature, schemes presented in [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF] and [START_REF] Touati | Collaborative kp-abe for cloud-based internet of things applications[END_REF] permit an assistant trusted node to distribute the encryption process among a set of devices, thus allowing it to generate the resulting ciphertext. As such, the aggregating node is mainly the aggregating node, as aggregation cannot be performed by any external entity, unlike our proposed scheme.

The processing and communication costs introduced by the proposed approach are considerably optimized, where the number of polynomials, that have to be assigned to each gate of an access tree, thanks to the use of sub-access trees associated to each participating device, similarly as presented in [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF].

| γ M + (1 + Y Γ )γ E × [3] CP-ABE general tree × (2Y Γ + 1)|G| + |G T | γ M + 2(2 + Y Γ )γ E × [18] CP-ABE general tree × (2Y Γ + 1)|G| + |G T | γ M + 2(2 + Yγ i )γ E (2Y Γ + n)γ M [17] KP-ABE threshold × t(|G| + |G T |) 2Yγ i γ E (1 + n)γ M [11]
CP-ABE AND-gates

× 3|G| + L Y Γ γ E + 3(γ E + γ M ) × ours CP-ABE general tree (2Yγ i + 1)|G| + |G T | γ M + 2Yγ i γ E nγ M
Note: and × indicate that the requirement is achieved or not, respectively; Y Γ is the number of attributes in the access policy Γ and Yγ i is the number of attributes in the access policy γ i where i= [1,n] γ i = Γ ;|G| and |G T | are the size of an element of G and G T , respectively; L is the length of the message and t is the threshold value; γ E and γ M represent the computation cost exponentiation and multiplication computation costs respectively.

For the aggregate algorithm, our construction presents an interesting computation cost nγ M , compared to most closely related schemes, namely [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF], [START_REF] Touati | Collaborative kp-abe for cloud-based internet of things applications[END_REF]. For more realistic performance results of our scheme, we conducted some experiments, for several exponentiation and multiplication operations on an Intel E5-1650-v3 6 cores. Our measurements show that exponentiations and multiplications take about 1.2 ms and 0.5 ms, respectively. In addition, referring to the cpabe toolkit2 [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], the computation costs of the key generation and encryption algorithms are mainly depending on the number of involved attributes. The cpabe toolkit provides a set of programs implementing CP-ABE schemes, using the PBC library 3 . The code is split into two packages, libbswabe (i.e; a library implementing the core cryptographic operations) and cpabe (i.e; higher level functions and user interface). For instance, the encryption algorithm takes about 1.5 second relying on an access tree containing around 60 attributes [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF].

VIII. POSSIBLE IMPROVEMENTS

The proposed mechanism permits a set of collaborating resource-constrained devices, with the assisting trusted IoT node, to encrypt different sensed data chunks, thus enabling an external gateway to decrypt the set of aggregated data, w.r.t. a general access tree. The assistant node is set up to support IoT devices. However, our multi-user encryption scheme may be deployed for several different settings, namely for multifog cooperative applications, where each fog network holds a different data chunk and has to cooperate with other fogs' nodes to encrypt their related data. As such, if a cloud gateway satisfies the general access structure, it can only decipher the aggregated data content.

For this purpose, we extend our proposed scheme, to ensure a collaborative multi-user encryption, that is the set of involved fogs' nodes need to cooperate for deriving the enciphering secret s, based on the key distribution algorithm, introduced in [START_REF] Burmester | A secure and scalable group key exchange system[END_REF]. The different algorithms are defined as follows:

• setup -the setup algorithm first selects leveled 4linear maps [START_REF] Hohenberger | Full domain hash from (leveled) multilinear maps and identity-based aggregate signatures[END_REF]. In fact, it defines two symmetric pairing functions ê1 and ê2 , such that ê1 :

G 1 × G 1 → G 2 and ê2 : G 2 × G 2 → G 3 ,
pp = {G 1 , G 2 , G 3 , ê1 , ê2 , p, g 1 , g 2 , h, ê1 (g 1 , g 1 ) α , H}
The master secret key of AA is msk = {β, g 1 α }.

• keygen -the private key sk contains a new key element, referred to as D, and is defined as follows:

sk = { D = g 1 α(1+r)/β , ∀a j ∈ S, D j = g 1 r • H(a j ) rj , D j = g 1 rj }
• accshare -this algorithm is performed by GM . It defines the global access structure Γ, the aggregating function f and the access sub-tree γ i associated with each participating fog node U i , such that {(U i , γ i )}, where i ∈ [1, n] and Γ = ∪ i∈[1,n] γ i . • secgenpart -this algorithm is mainly based on [START_REF] Burmester | A secure and scalable group key exchange system[END_REF] construction. It is executed by each participating fog node U i , in order to derive an element E i of his partial secret s i , needed to compute the global shared enciphering secret s. For this purpose, each participant U i derives a secret s i , computes and shares two public elements z i and µ i defined as z i = h si and µ i = ê1 (g 1 , g 1 ) αsi , respectively. Afterwards, based on the published elements of the remaining participants, each user U i calculates and publishes his partial enciphering element E i defined as the couple ê2 (g 2 , ê1 (g 1 , g 1 ) αs ) = ê2 (g 2 , ê1 (g 1 , g 1 ) α(s1s2+•••+sns1) )

E i = (X i , Y i ) = ([ zi+1 zi-1 ] si , [ µi+1 µi-1 ] si ),
Then, U i proceeds similarly as explained in section V. That is, U i encrypts the message m i with respect to γ i and outputs the partial ciphertext CT i such that:

CT i = { Ci , C, ∀y j ∈ Y i , j ∈ [1, |Y i |] : C i,j , C i,j }
where C value is similarly computed and sent by all participants. As this ciphertext's element depends on the enciphering secret s, it permits to detect whether there is an inconsistency among the different received values, before proceeding to the aggregation and decryption processes. Ci depends on f pointed out by GM and it is defined as Ci = [m i ] n • K.

Recall that the partial ciphertext CT i associated to the fog node U i does not include γ i . • aggregate -it outputs a global CT defined as:

CT = { C, C, ∀Y i ∈ L, ∀y j ∈ Y i : C i,j , C i,j }
where C is defined as follows:

C = n i=1 [ Ci ] n -1 = n i=1 [(m i ) n ] n -1 n i=1 K n -1 = M • K
• decrypt -this algorithm, executed by the aggregating entity S j , permits to decrypt the aggregated ciphertext CT , including the global access structure Γ and the private key sk associated with S. It is mainly similar to the proposed construction, detailed in section V. Thus, for leaves and intermediate nodes, the aggregator computes F x , defined as: F x = ê1 (g 1 , g 1 ) rqx(0) . For the direct children of the root node, this extended construction introduces a new algorithm referred to as DecRootChild. Indeed, it relies on the execution of the DecryptNode function and is defined such that DecRootChild(CT, sk, x, µ i-1 ) = ê2 (µ i-1 , DecryptNode(CT, sk, x)).

If the aggregating entity satisfies a childroot node x, such that index(x) = i, then DecRootChild(CT, sk, x, µ i-1 ) = ê2 (g 2 , g 2 ) αrsisi-1 . If the set of attributes S satisfies the global access structure Γ, then the aggregating entity computes a quantity A, as follows: = ê2 (g 2 , g ) αr i∈ [1,n] sisi-1 = ê2 (g 2 , g 2 ) αrs

A = i∈[
Finally, the aggregating entity S j decrypts M as follows: C IX. CONCLUSION The fast growing and the ubiquity level inflation of Internet of Things leads us to propose a secure and privacy preserving multi-user encryption scheme for fine-grained access control adapted for Cloud-assisted IoT applications. Our construction takes advantage of the CP-ABE scheme to obtain a flexible and fine grained access control scheme. It enables an aggregating entity to collect sensory data from different devices and decrypt them if it satisfies a general access structure. The proposed cooperative scheme does not reveal any information about the enciphered single data chunks, thus ensuring the privacy of involved entities. Furthermore, it is proved to be suitable for resource-constrained devices based on a theoretical performance analysis.

Fig. 1 .

 1 Fig. 1. WBAN Fog based Architecture

  1,n],x∈Sr DecRootChild(CT, sk, x, µ i-1 ) = i∈[1,n],x∈Sr ê2 (g 2 , g 2 ) αrsisi-1

  ,ê1(h s ,g1 α(1+r)/β )) ê2(g2,g2) αrs = M • ê2 (g 2 , g 2 ) αs ê2(g2,ê1(g1 βs ,g1 α(1+r)/β )) ê2(g2,g2) αrs = M • ê2 (g 2 , g 2 ) αsê2(g2,ê1(g1,g1) sα(1+r) ) ê2(g2,g2) αrs = M

  1,|S|]} of a requesting entity. That is, AA selects a set of random values {r, {r j } {j∈[1,|S|]} }, related to the requesting entity and to its associated attributes S = {a j } {j∈[1,|S|]} . The private key sk is defined as follows:

  be the set of leaf nodes of the global access tree Γ, where each subset Y i (i.e; i ∈[1, n]) is assigned to a user U i , with respect to its associated subtree γ i . Let q yj be the polynomial assigned to each leaf node y j ∈ Y i (i.e; j ∈ [1, |Y i |] ), associated to the IoT device U i . For each leaf node y j ∈ Y

i (i.e; j ∈ [1, |Y i |]),

the IoT U i computes two group elements C i,j and C i,j

  where G 1 , G 2 and G 3 are three multiplicative groups of prime order p. It also selects three random generators g 1 and g 2 of G 1 and G 2 , respectively. Then, it selects at random two integers α, β ∈ Z. Let h := g 1 β ∈ G 1 and H be a cryptographic hash function, such that H : S → G 1 . The global parameters pp are defined as follows:

  required to derive the global secret element s.• encpart -this algorithm is run by each U i , in order to derive a partial ciphertext CT i for a message m i , w.r.t. γ i and the aggregating function f . To do so, each U i first computes two elements (C, K) associated to the global enciphering secret s, based on the set of shares {E j }, where j ∈ [1, n], j = i. That is, each participant calculates C relying on the set of shares{X j } j∈[1,n],j =i , such that C = h s = h s1s2+s2s3+•••+sns1. Similarly, U i computes K relying on the set of shares {Y j } j∈[1,n],j =i , such that K = ê2 (g 2 , g 2 )

αs is derived as follows:

http://acsc.cs.utexas.edu/cpabe/index.html

https://crypto.stanford.edu/pbc/


Alexandre Ruellan

Alain Guinault

Cyrille Sollogoub

Violette Ducruet

Sandra Domenek
email: sandra.domenek@agroparistech.fr

Solubility factors as screening tools of biodegradable toughening agents of polylactide

Keywords: biodegradable, biopolymers and renewable polymers, mechanical properties, packaging, plasticizer

Changes in the thermomechanical properties of polylactide (PLA) plasticized by two biodegradable and biobased molecules, Polysorb ID37 (PID37) and squalene, were compared to formulations with petroleum-based plasticizers, namely, acetyl tributyl citrate, poly(ethylene glycol) 400, and dioctyl adipate (DOA). The solubility parameters of the additives were calculated and were related to the plasticization behaviors. PID37 proved to be miscible with PLA because of its polar functions and short alkyl groups. It decreased the PLA glass-transition temperature (T g ) and increased in ductility when T g approached room temperature. Squalene had a low miscibility because of the absence of polar groups. T g was not depressed. Ductility improvements were nevertheless reached because the immiscible inclusions efficiently induced crazing by the distribution of stress concentration points all over the material; this delayed failure. The maximum elongations at break were 60% for squalene, 400% for DOA, and 500% for PID37. The solubility factors were, thus, an efficient prediction tool for the plasticizing behavior.

INTRODUCTION

For almost 2 decades, new polymers have been developed with the aim of lowering the environmental impact of plastics manufacturing. Polylactide (PLA), which is a biobased and compostable polyester produced on a large scale, exhibits numerous advantages, including a glass-transition temperature (T g ) that is higher than room temperature, ease of processing, high transparency, printability, and moderate cost. However, even if PLA offers satisfying mechanical properties, its low deformation at break remains a limitation for many high-volume applications, such as textile fiber production and food packaging. 1,2 External plasticizing is a widely applied method for enhancing polymer ductility because of existing know-how and the ease of implementation of such a process on the industrial scale. Many studies have been conducted to find effective PLA plasticizers. Plasticizers should be high-boiling-point molecules, miscible with the polymer, having a high associated free volume and low T g . For polar polymers such as polyesters, plasticizer molecules should have polar groups acting as points of interaction to ensure good compatibility and nonpolar groups (as alkyl chains) masking the neighboring polymer chain dipoles and increasing the free volume. [START_REF] Ruellan | Poly(lactic acid) Science and Technology: Processing, Properties, Additives and Applications[END_REF] As plasticizers are often used in compounds at concentrations of up to 30 wt %, it is interesting that they are biodegradable and biobased if such claims are envisaged to be associated with the polymer. Additives derived from biomass byproducts have already been shown to enhance the ductility of PLA. Miscibility has been observed to be a key factor. In fact, merely miscible glucose monoester and fatty acid esters, [START_REF] Jacobsen | [END_REF] glycerol, 5 liquefied rice bran, 6 a-tocopherol, and resveratrol 7 did not induce significant T g decreases nor improvements in the elongation at break. In contrast, oligomeric lactic acid, 5 liquefied wood, 6 and limonene 8 caused large decreases in the PLA T g concomitantly with gains in the ductility. To enhance the compatibility with PLA, chemically modified biomass fractions, such as epoxidized soybean oil 1,9,10 and epoxidized palm oil, [11][12][13] have been tested.

Improvements in the elongation at break were obtained, 9,[11][12][13][14] whereas the PLA glass-transition merely decreased.

To produce competitive plasticizers, the performance of biobased plasticizers need at least to approach that of one of the petrochemical molecules. Among petroleum-based plasticizers that have already been investigated, citrate esters [15][16][17][18][19][START_REF] Sierra | Presented at ANTEC 2010[END_REF][START_REF] Courgneau | [END_REF][22] are the far most prominent ones. Labrecque et al. 22 mixed triethyl citrate, tributyl citrate, acetyl triethyl citrate, and acetyl tributyl citrate (ATBC) at a concentration of 20 wt % with PLA. In all cases, T g was lowered, and the elongation at break augmented to 300%. Poly(ethylene glycol)s (PEGs) have also attracted large interest, mainly because they are commercially available in a large range of chain lengths. It has been observed that smallchain-length PEG [weight-average molecular weight (M w ) < 1000] 15,[START_REF] Courgneau | [END_REF]23,24 tends to induce stronger thermomechanical changes than those with longer chain lengths. 15,[25][26][27] Furthermore, adipate esters, which have two polar functions, have been studied as PLA plasticizers. 17,28,29 Martino et al. 29 used dioctyl adipate (DOA) up to a concentration of 20 wt % and successfully increased the elongation at break to approximately 300%.

In this study, we examined two fully biobased and biodegradable molecules as new plasticizers for PLA. Polysorb ID37 (PID37) is an isosorbide diester recently developed by the Roquette Group; at first, it was intended for the lamination of poly(vinyl chloride), but it is potentially usable as a PLA plasticizer. 30,31 The isosorbide core is derived from glucose and prepared from the double dehydration of sorbitol, and the ester alkyl chains are sourced from vegetable oils. PID37 was recently registered in the European Union Regulation Registration, Evaluation, Authorisation and Restriction of Chemicals (REACH). The second potential plasticizer, squalene, is a common natural hydrocarbon extracted from vegetables or shark liver. Its main uses are in cosmetics, food supplements, and adjuvants of vaccines.

With an aim to probe the effects of those molecules on PLA ductility and to investigate the corresponding plasticizing mechanisms, we compounded amorphous PLA with PID37 and squalene and compared the properties to those of known Two different mechanisms of PLA ductility increases were observed as a function of the plasticizer solubility. The first one was linked to the decrease in T g by the plasticizer, and the second one was linked to the induction of crazing.

EXPERIMENTAL

Materials

PLA 4060D, with a D-lactic acid content of 11 6 1% (according to the datasheet), was purchased from NatureWorks. ATBC, poly(ethylene glycol) 400 (PEG 400), DOA, and squalene were supplied by Sigma-Aldrich (France). PID37 was provided by the Roquette Group (France). Chemical structures of the plasticizers are shown in Figure 1. Before compounding, the PLA pellets and plasticizers were dried at 608C for 24 h under dried air to remove water traces with an SOMOS 60L. The relative humidity of dried pellets was controlled to be lower than 350 ppm with an Aboni FMX HydroTracer.

Neat PLA and plasticized PLA sheets were prepared in two successive steps. First, the direct melt-mixing of additives with PLA was carried out with a corotating twin-screw extruder (Thermo Haake Ptw 16-40D) with a screw diameter of 16 mm and a length-todiameter ratio of 40 : 1. Blends of PLA containing 5, 10, 15, and 20 wt % of each plasticizer were prepared. The liquid addition of each plasticizer was performed in the third of seven zones of the extruder. The processing conditions are given in Table I. After cooling under air, the strand was pelletized. The obtained pellets were stored in hermetic metalized sealed bags to prevent rehydration. Second, the different PLA compounds were thermomolded (Laboratory Press Gibitre Instruments, 20 tons). The pellets were premelted at 1808C without pressure for 180 s, and then, the heated plates of the press were closed with a progressive increase in pressure up to 220 bar for 120 s to eliminate air bubbles. The obtained sheets were then cooled to ambient temperature by air. The thickness of the sheets was approximately 1 mm.

Characterization of the PLA Films

To quantify the amount of plasticizer added to PLA, around 6 g of the formulated pellets were placed into a 125-mL Soxhlet apparatus containing 200 mL of ethanol and extracted under reflux for 8 h. Then, the extracted PLA pellets were dried for 2 days at 408C in vacuo. We measured the weight content of the plasticizer by weighing the difference of the PLA pellets. Analyses were done in duplicate.

The average molecular weight and dispersity values of the neat and formulated PLA sheets were measured by size exclusion chromatography with a Waters Co. apparatus equipped with an isocratic pump (GILSON 307), a column oven (Waters Control Module II), a gel column (Styragel H5E 7.8 3 300 mm 2 ) having a separation range from 2000 to 1000,000 g/mol, an autosampler (Waters 717 plus), and a refractive index detector (Waters 2414). Data acquisition and analysis were carried out with the help of Breeze Software. The analyses were performed at 358C with tetrahydrofuran as an eluent at a flow rate of 1 mL/min. The calibration was done before the experiments with polystyrene standards (Shodex Standard from Showa Denko, range 5 3070-778,000 g/ mol). For sample preparation, neat and formulated PLA pellets were dissolved in tetrahydrofuran (20 mg/L) on a shaker at 608C for 45 min. The analyses were done in triplicate.

The thermal analyses were carried out with a Mettler Toledo DSC1 STARe System under a nitrogen atmosphere (50 mL/min). The calibration of the device was done with pure water and an indium standard before the experiments. Samples of around 7 mg were cut from the thermomolded sheets and put into hermetic aluminum pans (40 mL). For each sample, calorimetric scans were carried out at a heating/cooling rate of 108C/min. Thermal history was suppressed by heating from 0 to 708C (first scan), and this was followed by an isotherm at 708C for 5 min. Then, the samples were cooled down from 70 to 2408C (second scan); subsequently, a heating scan from 240 to 1008C (third scan) was performed. T g was taken at the midpoint of the heat capacity step in the third scan. The experiments were done in triplicate.

The plasticizer T g was determined at the midpoint of the heat capacity step with a heating scan from 295 to 258C at a heating rate of 28C/min. The experiments were carried out in duplicate.

The tensile properties were investigated at 238C, at 50 6 10% relative humidity, and at a crosshead speed of 25 mm/min with a universal tensile machine (Instron model 4301). Dog-bone samples (ISO 527-2, type 5A) were cut from the thermomolded sheets. Before tensile testing, the samples were conditioned at 238C and 50 6 10% relative humidity for at least 72 h. The thickness of the samples varied from 0.9 to 1.1 mm. Each given value was an average of 10 measurements.

The morphologies of the samples before and after the tensile tests were observed with scanning electron microscopy (Hitachi 4800 II). Observations were done directly on the surface of the dog-bone-shaped samples without any previous preparation.

Calculation of the Solubility Parameters

The molar volumes and molar interaction constants of the PLA and plasticizers were determined according to the van Krevelen and Hoftyzer atomic group contribution method. Tables can be found in van Krevelen et al.'s work. [START_REF] Van Krevelen | Properties of Polymers: Their Correlation with Chemical Structure; Their Numerical Estimation and Prediction from Additive Group Contributions[END_REF] Because the length of the PID37 alkyl ester chains is unknown, calculations were done with a saturated alkyl chain length between 6 and 10 carbons. Because PEG 400 is an oligomer with an average molar mass between 380 and 420 g/mol (according to the data sheet), calculations were done with degrees of polymerization (n i s) of 6 and 7.

The average molar volumes [V g (T)'s; cm [START_REF] Ruellan | Poly(lactic acid) Science and Technology: Processing, Properties, Additives and Applications[END_REF] /mol] at 258C of the amorphous and glassy chains of PLA were estimated with eqs.

(1) and ( 2). According to size exclusion chromatography measurements [number-average molecular weight (M n ) 5 104,200 g/ mol], the average n i was about 1450. With amorphous molar volume increment values at 298 K, [START_REF] Van Krevelen | Properties of Polymers: Their Correlation with Chemical Structure; Their Numerical Estimation and Prediction from Additive Group Contributions[END_REF] the van der Waal's volume of the repeating lactide unit (F i ; cm 3 /mol) was estimated to 55.72 cm 3 /mol:

V g T ð Þ5F 1:3010:55310 23 T g 10:45310 23 T À Á (1) F5 X n i F i ( 2
)
where F is the van der Waal's volume of the polymer chain (cm 3 /mol), T is room temperature (K), and n i the polymerization degree of the molar chain. The Hansen solubility parameters (HSPs) of each plasticizer were calculated with eqs. ( 3)-( 5). [START_REF] Van Krevelen | [END_REF]35 The used molar constants [START_REF] Van Krevelen | Properties of Polymers: Their Correlation with Chemical Structure; Their Numerical Estimation and Prediction from Additive Group Contributions[END_REF] are presented in Table II. However, the estimation of HSP of very long chain polymers such as PLA 4060D with only the group contribution method is not reliable enough because the three-dimensional configuration is not considered. Therefore, we used literature values obtained by computed calculations and published by Abbott: 36

d d 5 X F d i X V i (3)
d p 5 ffiffiffiffiffiffiffiffiffiffiffiffi P F 2 Pi p P V i (4)
d h 5 ffiffiffiffiffiffiffiffiffiffiffi ffi P E hi P V i s (5)
where d d is the dispersion component of the solubility parameter (J 1/2 cm 23/2 ), d p is the polar component of the solubility parameter (J 1/2 cm 23/2 ), d h is the hydrogen-bonding component of the solubility parameter (J 1/2 cm 23/2 ), F di is the dispersion contribution of the molar attraction constant [(J 1/2 cm 23/2 )/ mol 21 ], F pi is the polar contribution of the molar attraction constant [(J 1/2 cm 23/2 )/mol 21 ], E hi is the hydrogen-bondingenergy contribution of the molar attraction constant (J/mol), and V is the molar volume contribution of the chemical group involved (cm 3 /mol).

The solubility of the five molecules in PLA was assessed with the HSP relative energy difference (RED) from eqs. ( 6) and ( 7):

Distance5 ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi ffi 4ðd dplast 2d dPLA Þ 2 1ðd pplast 2d pPLA Þ 2 1ðd hplast 2d hPLA Þ 2 q (6)

RED5

Distance Radius (7) where d d , d p , and d h are the components of the solubility parameters of the plasticizer obtained from eqs. (3), (4), and (5), respectively, and the ones of PLA obtained from Abbott. [START_REF] Abbott | Poly(lactic acid): Synthesis, Structures, Properties, Processing, and Applications[END_REF] The radius is the maximal distance [START_REF] Abbott | Poly(lactic acid): Synthesis, Structures, Properties, Processing, and Applications[END_REF] beyond which the additives are not miscible anymore with the polymer. Therefore, the closer the RED value is to zero, the better the compatibility is.

An RED value higher than 1 indicates theoretical nonmiscibility of the plasticizer with the matrix.

A second method can be applied with the group contribution method [eq. ( 8)]. In this case, the Hildebrand solubility parameter (d or HiSP), which is the outcome of HSP with eq. ( 9), is obtained. Cohesive energy values (E coh 's) can calculated as follows: 32

d5 ffiffiffiffiffiffiffiffi E coh V r (8) d5 ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi ffi d 2 d 1d 2 p 1d 2 h q (9)
where d is the solubility parameter (J 1/2 cm 23/2 ).

The obtained value of the HiSP of PLA with eq. ((3).( 8)) was 22.1 J 1/2 cm 23/2 ; this was close to the value of 21.9 J 1/2 cm 23/2 determined with eq. ( 9) and HSP of PLA found in ref. 36. Consequently, in this study, we found HSP of PLA from ref. 36 as suitable to be compared with the calculated HSP of plasticizers with the group contribution method.

The solubility of the five molecules in PLA was also assessed with HiSP. In this case, the numerical difference between HiSP of PLA and HiSP of the plasticizers was computed. The larger the value was, the lower the compatibility of the plasticizer with the matrix was.

RESULTS AND DISCUSSION

Analysis of the Plasticizer Content and Average Molecular Weight of Compounded PLA

The plasticizer incorporated in the compounds was quantified, and Table III shows a comparison of the measured concentrations with the target concentration. For ATBC, PEG 400, DOA, and PID37, the incorporated amounts were close to the target values; this indicated little additive loss during twin-screw extrusion. The squalene quantities were substantially smaller than the target amounts and showed a loss of the plasticizer during processing. Indeed, an accumulation of liquid squalene inside the twin-screw extruder was observed.

The average molecular weight of the PLA samples is also given in Table III. The blank PLA showed moderate thermal degradation of the macromolecular chain length during twin-screw extrusion. This decrease was linked to the high sensitivity of PLA to hydrolysis and/or the thermomechanical input. 2,17,[START_REF] Courgneau | [END_REF] When ATBC, DOA, PID37, or squalene was added, the degradation was less important; this was likely due to the lower extrusion temperatures needed for plasticized PLA and/or to the internal lubrication, which reduces the shearing. In contrast, PEG 400 induced large decreases in both M n and M w . The decrease in the macromolecular chain length caused by the compounding of PLA with PEG was already largely described in the literature and explained by transesterification reactions between PLA and PEG. [START_REF] Courgneau | [END_REF][START_REF] Hyon | [END_REF] Miscibility Study

The high D content of the PLA grade (11 6 1% according to the datasheet) used in this study inhibited PLA crystallization. Generally, at D contents higher than 6%, PLA is amorphous under common experimental conditions. 38,39 Therefore, compatibility between PLA and the different plasticizers was assessed with the help of HSP and HiSP, which are prediction methods adapted to amorphous polymers. [START_REF] Van Krevelen | Properties of Polymers: Their Correlation with Chemical Structure; Their Numerical Estimation and Prediction from Additive Group Contributions[END_REF] The datasets are presented in Table II. The solubility prediction by the two methods was different. HiSP predicted the highest solubility for PEG, whereas HSP classified PID37 to be the most soluble. This difference was caused by the contribution of the hydrogen interaction, which is only taken into account in Hansen's method. [START_REF] Abbott | Poly(lactic acid): Synthesis, Structures, Properties, Processing, and Applications[END_REF] d h of PEG 400 was very far from that of PLA (Table IV) because of the absence of hydroxyl groups able to establish H bonds. ATBC and PID37 additives were predicted to be soluble in PLA according to HSP and HiSP. PEG 400 and DOA had nearly the same solubility in PLA after Hansen's method. On the contrary, squalene was predicted to be faintly soluble in PLA.

The prediction of the solubility was confirmed by the study of the miscibility and miscibility limits of the plasticizers through the measurement of the T g decrease of compounded PLA and modeling with Fox's equation: 1

T g 5 x PLA T gPLA 1 x Plast T gPlast (10)
where T g is the glass-transition temperature of the formulated material; T gPLA and T gPlast are the glass-transition temperatures of the neat PLA and the pure plasticizer, respectively; and x PLA and x Plast are the weight fractions of the neat PLA and plasticizer, respectively.

The results are presented in Figure 2. PID37 showed similar behavior to ATBC. Both molecules were miscible with PLA over the whole experimental concentration range; this was shown by the concordance between the experimental and predicted T g values. With regard to PEG 400, the experimental values were slightly lower than the calculated ones, maybe because of a supplementary decrease in T g caused by PLA chain scission during processing (Table III). A deviation of the T g decrease from Fox's equation indicating the reaching of the miscibility limit was observed after 15 wt % PEG 400. This concentration was smaller than the miscibility limit of the short PEGs (M w < 34,000 g/mol) established at 20 wt % 15,40 and higher than the limit of 10 wt % observed in ref. 21 Squalene and DOA showed a leveling off of T g at 48 and 418C, respectively, despite the increase in the plasticizer content. The miscibility limit of DOA in PLA was reached at a concentration of 5 wt %; this was in accordance with Murariu et al. 41 and the one of squalene at 3 wt %. These observations were in accordance with the prediction of low solubility by the HSP and HiSPs. Solubility theories are thus a valuable tool for screening biobased plasticizers.

Tensile Properties of the Plasticized PLA Figure 3 shows typical results of the tensile testing of the PLA samples containing different plasticizers. The numerical data are given in Table V. Neat PLA showed brittle fracture at an elongation at break of about 5%, a behavior largely described in literature. 17,22,24,29 The fracture mechanism of PLA glasses was crazing because of the low entanglement density. 42 The blending with the different plasticizers induced the brittle-to-ductile transition. Two behavior groups could be distinguished; this was in accordance with the prediction of the solubility parameters.

PID37 was classified with ATBC and PEG 400 in the first behavior group. In that case, the brittle-to-ductile transition occurred when the plasticizer content was high enough to depress T g to the tensile testing temperature, more precisely when the onset of the glass-transition region was at 238C. The PLA/ATBC mixtures showed no decrease in the stress at yield up to 10 wt % plasticizer, whereas beyond this value, plasticizing was very efficient. The curves lost the yield peak and showed plastic flow and hardening at high elongations due to necking. This sudden change between 10 and 15 wt % ATBC was already shown. [START_REF] Courgneau | [END_REF] For ATBC, this most probably occurred only starting from this amount with enough free volume to the polymer to allow chain rearrangement. Molecules with branched nonpolar groups, such as ATBC, have the faculty to shield polymer dipoles and space polymer chains from each other. Softening is then mainly brought about by the added free volume of the branched molecule. [START_REF] Moorshead | Advances in Polymer Science[END_REF] Interestingly, PID37, which had a higher dispersive component (Table IV) but in sum had almost equal solubility parameters and molecular volumes, showed a more gradual behavior. A gain in elongation at break was observed at a concentration of 15 wt %. The highest value of the elongation at break observed was equal to that of ATBC plasticizing; this made PID37 an interesting biobased and biodegradable alternative to ATBC. Probably the long aliphatic chains of PID37 helped to reduce the polar interactions of the PLA chains and provide chain mobility at lower contents. The more gradual plasticizing behavior was also measured with PEG, which is a linear molecule. However, at high PEG contents, the elongation at break decreased again, likely because of phase separation as the miscibility limit was reached. 23,[START_REF] Piorkowska | [END_REF] This was consistent with the miscibility prediction by the analysis of the T g , shown in Figure 2. PEG phase separation induced flaws in the material, from which cracks started, and this induced consequence failure at lower elongations. 23,[START_REF] Piorkowska | [END_REF] DOA and squalene compounds could be classified in the second behavior group. The materials reached high elongation at break values, whereas T g of PLA remained higher than room temperature (Table V). Stress crazing is typical of brittle materials, whereas stress shearing enables high plasticity and ductile behavior. 45 The transition between these two mechanisms is related, on the one hand, to the molecular entanglement density. A low entanglement density promotes crazing, whereas a high entanglement density causes shearing. [46][47][START_REF] Dettenmaier | Advances in Polymer Science[END_REF] The plasticizers DOA and squalene apparently did not bring enough free volume to the polymer to allow chain rearrangement under stretching because of their low miscibility. The T g values of the DOA and squalene formulations were significantly higher than the tensile testing temperature. The ductility was, therefore, linked to cavitation and crazing. The crazes in the material appeared most likely from the matrix discontinuities created by the inclusion of additive droplets. The soluble quantity of the plasticizers could have enhanced chain slippage into the craze; this is needed for rapid fibril formation. [START_REF] Dettenmaier | Advances in Polymer Science[END_REF][START_REF] Kramer | Crazing in Polymers[END_REF] The stress at yield level of the shear flow plateau decreased as a function of the plasticizer quantity. The occurrence of cavitation and fibril formation was observed by extensive stress whitening of both samples, a phenomenon that was not observed in the case of miscible molecules (Figure 4).

To illustrate the cavitation mechanism, scanning electron microscopy pictures of the surface of the stretched samples of PLA plus 15 wt % plasticizer until breakage were taken (Figure 5). For highly miscible molecules, that is, ATBC and PID37, no significant presence of the dispersed phase was observed. A few narrow cracks perpendicular to the stretching direction appeared. On the basis of the corresponding tensile curves, the strain hardening before ultimate rupture could have been caused by disentangled portions of the polymer. In the case of PEG 400, which was less soluble than ATBC or PID37 when the results of the two solubility theories were averaged, some undissolved droplets of additives were observed. Although there were a few microcrazes, no stress whitening was observed. In the case of the DOA and squalene samples, an important quantity of the dispersed phase was seen, and the cavitation phenomenon evolved into bigger cracks, especially for the merely soluble squalene.

Even with immiscible plasticizers, the ductility of PLA could thus be improved. In a number of applications, the improvement in elongation at break observed in this study could be sufficient to meet requirements. The advantage of this mechanism is that the apparent Young's modulus remained high. However, one condition for applications is that stress whitening is not prohibitive. For example, the maximum elongation at break of the PLA/DOA mixtures reached 410%, which was higher than the one obtained with PEG 400 (Table V). The modification of the crack-propagation behavior and reduction of the brittleness during maintenance of the stiffness are typical effects of impact modifiers on PLA. [START_REF] Wang | [END_REF][51][52][53][54][55] According to NatureWorks, effective impact modifiers are rubbery compounds with a low T g and crystallinity. Moreover, they are immiscible and dispersed in small domains in a glassy matrix and present good interfacial adhesion with PLA. [START_REF]Technology Focus Report: Toughened PLA[END_REF] Both DOA and squalene showed these characteristics. However, below 10 wt % DOA, Murariu et al. 41 observed a decrease in the impact strength explained by the antiplasticization effect.

The difference between DOA and squalene could be anticipated with the help of the solubility factors, which showed that squalene was clearly outside of the solubility sphere of PLA, whereas DOA was just at the limit. The small part of miscible DOA molecules that lowered T g could bring enough mobility to enhance chain slippage at the edges of the crazes, as proposed by Piorkowska et al. [START_REF] Piorkowska | [END_REF] Moreover, the slightly better miscibility of DOA likely allowed a more homogeneous distribution of the additive droplets in PLA. These differences might have been responsible for the higher elongation at break obtained with DOA compared to squalene. Indeed, a larger number of stress concentration points ensures a better sharing of the mechanical energy during the stretching process; this delays the effective failure of the sample. [START_REF] Piorkowska | [END_REF]

CONCLUSIONS

The plasticizing behaviors of the biobased molecules PID37 and squalene in PLA were discriminated with the help of their solubility factors. They provided a sound prediction of the possibility of a given molecule to lower T g . If the additive miscibility in PLA was important, the ductility increased only when the PLA became rubbery at testing temperature. In consequence, a minimal amount of plasticizer was required, and the rigidity of the material is strongly depressed. In this case, PID37 was found to be an effective biobased and biodegradable plasticizer. If the plasticizer was merely miscible as in the case of squalene, the ductility could nevertheless be enhanced, whereas PLA remained in the glassy state by cavitational deformation. Furthermore, the efficient dispersion of nonmiscible inclusions allowed us to maintain the stiffness. Because moderate ductility is required in applications, squalene could constitute an interesting ecofriendly additive for PLA plasticization.

Figure 1 .

 1 Figure 1. Chemical structures of the PLA and plasticizers.

Figure 2 .

 2 Figure 2. Experimental T g values of the PLA/plasticizer formulations plotted with the corresponding Fox equation (dashed lines): (a) ATBC, (b) PEG 400, (c) DOA, (d) PID37, and (e) squalene. [Color figure can be viewed in the online issue, which is available at wileyonlinelibrary.com.]

Figure 3 .

 3 Figure 3. Typical stress/strain curves of the PLA/plasticizer formulations: (-) PLA, (--) PLA 1 5 wt % plasticizer, (--) PLA 1 10 wt % plasticizer, (-•-) PLA 1 15 wt % plasticizer, and (-••-) PLA 1 20 wt % plasticizer. [Color figure can be viewed in the online issue, which is available at wileyonlinelibrary.com.]

Figure 4 .

 4 Figure 4. Picture of the PLA samples with plasticizers (15 wt %) after failure.

Figure 5 .

 5 Figure 5. Scanning electron micrographs of the surface of the PLA samples with plasticizers (15 wt %) near the failure zone after failure.

Table I .

 I Processing Conditions for Blend Compounding by Twin-Screw Extrusion

	petrochemical plasticizers having similar molecular weights.
					PLA 4060D	Additive
				Screw rotation	feeding	feeding
	Formulation		Temperature profile (8C)	speed (rpm)	input (kg/h)	input (kg/h)
	Neat PLA		175/180/190/190/190/190/180	300	0.620	-
	PLA 1	5 wt % ATBC	175/180/180/180/180/180/170	300	0.600	0.031
		10 wt % ATBC	175/180/170/170/165/160/160	300	0.600	0.072
		15 wt % ATBC	175/175/170/165/160/155/155	300	0.550	0.098
		20 wt % ATBC	175/170/160/160/160/150/150	300	0.550	0.136
	PLA 1	5 wt % PEG 400	175/180/180/175/175/170/170	300	0.600	0.032
		10 wt % PEG 400	175/175/170/170/170/170/165	300	0.600	0.075
		15 wt % PEG 400	170/170/170/165/160/155/150	300	0.600	0.107
		20 wt % PEG 400	170/170/165/160/155/150/150	300	0.600	0.150
	PLA 1	5 wt % DOA	175/180/180/180/190/180/175	300	0.620	0.033
		10 wt % DOA	175/175/175/180/180/175/170	300	0.620	0.070
		15 wt % DOA	175/175/175/180/180/175/170	300	0.620	0.108
		20 wt % DOA	175/175/175/180/180/175/170	300	0.620	0.154
	PLA 1	5 wt % PID37	170/180/175/175/170/170/170	300	0.580	0.030
		10 wt % PID37	170/180/170/165/165/165/160	300	0.580	0.066
		15 wt % PID37	170/180/170/160/160/160/155	300	0.580	0.104
		20 wt % PID37	170/180/170/160/155/150/150	300	0.580	0.147
	PLA 1	5 wt % squalene	175/180/180/170/170/170/165	300	0.610	0.034
		10 wt % squalene	175/180/170/170/170/170/165	300	0.610	0.070
		15 wt % squalene	175/180/170/170/170/170/165	300	0.610	0.104
		20 wt % squalene	175/180/170/170/170/170/165	300	0.610	0.149

Table II .

 II Molar Constants for the Calculation of the Solubility Values Obtained from Ref.32

						Molar
		F d	F p	2	E h	volume
	Group	(J 1/2 cm 23/2 mol 21 )	(J cm 23 mol 21 )	(J/mol)	(cm 3 /mol)	ATBC	PEG 400	DOA	PID37	Squalene
	>C<	270	0		0	219.2	1	0	0	0	0
	@C<	70	0		0	25.5	0	0	0	0	6
	>CHA	80	0		0	21.0	0	0	0	4	0
	@CHA	200	0		0	13.5	0	0	0	0	6
	ACH 2 A	270	0		0	16.1	11	16-18	18	10-18	10
	ACH 3	420	0		0	33.5	4	0	2	2	8
	ACOOA	390	240,100	7000	18	4	0	2	2	0
	AOH	210	250,000	20,000	10	0	2	0	0	0
	AOA	100	160,000	3000	3.8	0	7-8	0	2	0
	Ring	190	0		0	16	0	0	0	2	0
	One plane	-	Total 3 0.50	-	-	0	0	1	0	1
	of symmetry

F d , dispersion contribution; F p , polar contribution; E h , hydrogen-bonding-energy contribution.

  [START_REF] Bondi | Physical Properties of Molecular Crystals, Liquids and Glasses[END_REF]

Table III .

 III Extracted Plasticizer Contents, Molar Weight Averages, and Dispersities of the PLA/Plasticizer Formulations

		Targeted plasticizer	Extracted plasticizer
	Formulation	content (wt %)	content (wt %)	M n (g/mol)	M w (g/mol)	Dispersity
	Nonextruded PLA	-	-	104,500 6 2300	244,500 6 4100	2.34 6 0.01
	PLA 1 ATBC	0	-	79,300 6 4500	209,600 6 5400	2.64 6 0.09
		5	4.2 6 0.3	88,000 6 2900	211,700 6 3900	2,41 6 0.04
		10	8.9 6 0.4	88,100 6 3500	210,900 6 7000	2.39 6 0.02
		15	13.9 6 0.4	93,900 6 4300	221,800 6 4400	2.36 6 0.06
		20	17.8 6 0.6	90,600 6 2200	217,100 6 2700	2.40 6 0.03
	PLA 1 PEG 400	0	-	83,600 6 1900	214,100 6 6300	2.56 6 0.02
		5	4.9 6 0.4	76,600 6 2600	181,100 6 7500	2.36 6 0.02
		10	10.8 6 0.6	73,900 6 3400	165,900 6 8900	2.24 6 0.02
		15	14.4 6 0.2	69,100 6 4100	157,300 6 5800	2.28 6 0.05
		20	18.3 6 0.4	61,800 6 2400	128,300 6 8900	2.08 6 0.07
	PLA 1 DOA	0	-	81,200 6 2700	211,400 6 4400	2.60 6 0.03
		5	4.7 6 0.2	93,700 6 2400	209,400 6 7500	2.23 6 0.02
		10	8.8 6 0.1	94,500 6 2400	207,600 6 2100	2.20 6 0.03
		15	12.9 6 0.7	90,600 6 1200	204,100 6 4000	2.25 6 0.01
		20	17.2 6 0.5	91,900 6 3200	208,600 6 8100	2.27 6 0.01
	PLA 1 PID37	0	-	85,100 6 3600	208,400 6 7100	2.45 6 0.02
		5	4.3 6 0.4	81,400 6 4100	210,900 6 3800	2.59 6 0.09
		10	9.8 6 0.0	82,200 6 2800	207,300 6 4200	2.52 6 0.04
		15	14.4 6 0.2	80,300 6 1900	202,000 6 1900	2.52 6 0.04
		20	18.8 6 0.6	79,600 6 6500	199,900 6 7900	2.51 6 0.12
	PLA 1 squalene	0	-	85,300 6 2600	206,600 6 4900	2,42 6 0.02
		5	3.7 6 0.3	86,500 6 1900	202,400 6 5300	2.34 6 0.01
		10	7.1 6 0.2	91,300 6 3200	202,100 6 2800	2.21 6 0.05

Table IV .

 IV Physical Data and Computed Solubility Parameters for PLA and Plasticizers Substance

					Difference	-	3.2	1.3-1.0	4.3	2.4-3.3	5.8
		HiSP	d	(J 1/2 ) cm 23/2	21.9	18.7	23.2-22.9	17.6	19.5-18.6	16.1
					R E D	(radius 5 10.7) b	0.76	0.94-0.91	0.93	0.71-0.78	1.18
		HSP	d h	(J 1/2 ) cm 23/2	6.0 b	7.6	14.2-13.7	6.0	8.2-6.8	0
				d p	(J 1/2 ) cm 23/2	9.9 b	2.7	4.2-4.0	0.9	3.0-2.1	0
					)
				d d	(J 1/2 cm 23/2	18.6 b	16.9	17.9	16.5	17.4-17.2	16.1
			T g (8C)			57	283.2	266.2	2104 a	280.8	275.3
	Molar	volume	(cm 3 /mol)			130,500	364	304-340	393	300-428	477
		M w	(g/mol)			244,500	402	370-414	370	342-454	410
						PLA	ATBC	PEG 400	DOA	PID37	Squalene

a According to ref. 57. b According to ref. 36.

Table V .

 V Tensile Testing Results and T g Data for the PLA/Plasticizer formulations

		Plasticizer	Elongation	Apparent Young's	Elongation at	Stress at
	Formulation	content (wt %)	at break (%)	modulus (MPa) a	yield (%)	yield (MPa)	T g (8C)
	PLA 1 ATBC	0	4.8 6 0.8	1660 6 105	4.3 6 0.8	65 6 5	56.1 6 0.2
		4.2 6 0.3	4.3 6 0.3	1540 6 90	3.9 6 0.1	57 6 5	45.9 6 0.5
		8.9 6 0.4	4.4 6 0.4	1405 6 125	4.0 6 0.4	53 6 5	37.9 6 0.3
		13.9 6 0.4	455 6 125	270 6 120	4.3 6 0.8	7 6 3	28.0 6 0.8
		17.8 6 0.6	505 6 70	70 6 20	4.5 6 0.3	4 6 1	21.6 6 0.8
	PLA 1 PEG 400	0	5.0 6 0.3	1755 6 170	4.4 6 0.3	64 6 2	56.0 6 0.7
		4.9 6 0.4	4.9 6 0.7	1580 6 135	4.2 6 0.6	47 6 6	41.86 0.7
		10.8 6 0.6	1106 80	1040 6 80	4.8 6 0.1	29 6 4	30.5 6 0.2
		14.4 6 0.2	275 6 35	740 6 45	4.8 6 0.2	16 6 6	21.7 6 0.4
		18.3 6 0.4	135 6 120	710 6 65	4.6 6 0.4	21 6 4	22.2 6 0.8
	PLA 1 DOA	0	4.9 6 0.9	1750 6 100	4.0 6 0.2	69 6 3	57.4 6 0.4
		4.7 6 0.2	23 6 7	1495 6 60	2.9 6 0.2	52 6 5	42.5 6 0.2
		8.8 6 0.1	54 6 13	1385 6 15	2.6 6 0.1	34 6 1	41.1 6 0.4
		12.9 6 0.7	175 6 40	1340 6 40	2.4 6 0.1	25 6 3	40.9 6 0.3
		17.2 6 0.5	410 6 10	1095 6 60	2.3 6 0.2	21 6 1	40.7 6 0.8
	PLA 1 PID37	0	4.9 6 0.9	1770 6 60	3.9 6 0.2	69 6 3	56.2 6 0.6
		4.3 6 0.4	4.7 6 0.5	1730 6 40	3.6 6 0.4	65 6 3	46.2 6 0.3
		9.8 6 0.0	4.5 6 0.9	1670 6 45	3.2 6 0.2	57 6 3	40.4 6 1.0
		14.4 6 0.2	200 6 25	915 6 110	3.8 6 0.2	20 6 4	31.9 6 0.5
		18.8 6 0.6	530 6 15	30 6 20	3.5 6 0.5	6 6 4	22.4 6 0.5
	PLA 1 squalene	0	5.2 6 0.4	1685 6 85	4.3 6 0.3	67 6 4	56.2 6 0.5
		3.7 6 0.3	40 6 5	1285 6 70	3.2 6 0.6	54 6 5	50.9 6 0.7
		7.1 6 0.2	60 6 10	1150 6 20	3.1 6 0.4	42 6 5	49.4 6 0.3
		9.9 6 0.1	30 6 10	1045 6 55	2.8 6 0.2	29 6 6	48.9 6 0.8
		11.9 6 0.6	20 6 10	1000 6 110	2.5 6 02	26 6 4	48.0 6 1.2

a For comparison, this was obtained without an extensiometer.

9.9 6 0.1 90,200 6 2700 205,600 6 3300 2.28 6 0.03 20 11.9 6 0.6 87,600 6 1400 200,800 6 6300 2.29 6 0.04

ACKNOWLEDGMENTS

This work was financially supported by Brodart Packaging and the Association Nationale Recherche Technologie (ANRT). It is part of the French project BIP-ADEME CREABioM, which is supported by the Agence de l'environnement et de la maîtrise de l' energie (ADEME). The authors gratefully acknowledge the Roquette Group for the free supply of PID37 and, in particular, Vincent Berthe for his valuable help. They also thank Anne Grandmontagne and Cedric Plessis very much for their valuable technical support.