PhD Lydie Bonnefoy-Claudet

PhD Nabil Ghantous

Emotions' Impact on Tourists' Satisfaction with Ski Resorts The Mediating Role of Perceived Value

Keywords: Consumption emotions, perceived value, satisfaction, ski resorts, mediation effect

Emotions have been shown to play an important role in consumers' evaluation of their consumption experiences, including extended multiple-encounter touristic ones. The present research investigates the emotions used in the evaluation of customers' experience at a ski resort and how these emotions drive customers' satisfaction. Two quantitative studies are conducted in the French Alps and the data analysed with descriptive statistics and structural equation modelling. The findings uncover the importance of three emotions -joy, excitement and peacefulness -and a strong mediating role of overall perceived value between consumption emotions and satisfaction. Emotions related to "surprise" play no significant role in the evaluation of the ski resort experience. The present findings suggest that managers should focus on staging customers' stay at the resort to stimulate an emotional experience and position their packages based on the promise of such emotional experiences.

INTRODUCTION

Ski and other winter sports are practiced in more than seventy countries, where around 2000 resorts and between 4000 and 6000 ski fields have been identified [START_REF] Vanat | International Report on Mountain Tourism[END_REF]. As such, winter sports tourism is a strong contributor to growth and economic activity in many mountain regions worldwide [START_REF] Tsiotsou | Using visit frequency to segment ski resorts customers[END_REF][START_REF] Tuppen | The restructuring of winter sports resorts in the French Alps: problems, processes and policies[END_REF] and has received important attention in the literature. More precisely, during the last two decades, researchers have investigated issues such as the importance of customers' characteristics [START_REF] Matzler | Customer satisfaction and loyalty to alpine ski resorts: the moderating effect of lifestyle, spending and customers' skiing skills[END_REF][START_REF] Matzler | Customer satisfaction with alpine ski areas: the moderating effects of personal, situational, and product factors[END_REF] and segmentation [START_REF] Füller | Customer delight and market segmentation: An application of the three-factor theory of customer satisfaction on life style groups[END_REF][START_REF] Konu | Using ski destination choice criteria to segment Finnish ski resort customers[END_REF], destinations' positioning [START_REF] Faullant | A positioning map of skiing areas using customer satisfaction scores[END_REF][START_REF] Sainaghi | Strategic positioning and performance of winter destinations[END_REF] and competitiveness [START_REF] Hudson | Measuring destination competitiveness: an empirical study of Canadian ski resorts[END_REF], service quality [START_REF] Barlas | Achieving positive word-of-mouth communication: The role of perceived service quality in the context of Greek ski centres[END_REF][START_REF] Hudson | Measuring service quality at tourist destinations: an application of importance-performance analysis to an alpine ski resort[END_REF], as well as customers' preferences [START_REF] Siomkos | Measuring customer preferences in the winter sports market: The case of Greece[END_REF], satisfaction [START_REF] Ferrand | The effect of service performance and ski resort image on skiers' satisfaction[END_REF]Vecchiatini, 2002, Matzler et al., 2008) and loyalty [START_REF] Alexandris | Increasing customers' loyalty in a skiing resort: The contribution of place attachment and service quality[END_REF]Clark and Maher, 2007). However, very little is known about customers' emotions linked to an experience at a winter sports resort and their role in driving customers' post-consumption evaluation of their experience. This gap is all the more surprising for three main reasons.

First, the importance of emotions during the consumption experience, as well as in the preand post-consumption stages, is widely accepted today. Consumers are emotional beings in search of sensitive experiences and, in many cases, emotions can be a motive for consuming and can influence the choice between competing products or services [START_REF] Holbrook | The experiential aspects of consumption: consumer fantasies, feelings, and fun[END_REF]. Furthermore, emotions are also a direct result of the consumption experience [START_REF] Dubé | Multiple roles of consumption emotions in post-purchase satisfaction with extended service transactions[END_REF]. As such, they participate in the evaluation of this experience, the exchange with the service provider and the service relation [START_REF] Westbrook | The dimensionality of consumption emotion patterns and consumer satisfaction[END_REF][START_REF] Bosmans | Goal-relevant emotional information: When extraneous affect leads to persuasion and when it does not[END_REF]. Second, building on the experiential and hedonic nature of touristic activities, the importance of emotions has been documented in numerous empirical studies in many tourism sectors (e.g. [START_REF] Bigné | The impact of experiential consumption cognitions and emotions on behavioral intentions[END_REF][START_REF] Chuang | The effects of emotions on the purchase of tour commodities[END_REF][START_REF] Duman | The role of affective factors on perceived cruise vacation value[END_REF][START_REF] Gnoth | Emotions, mood, flow and motivations to travel[END_REF][START_REF] Han | Assessing customers' emotional experiences influencing their satisfaction in the lodging industry[END_REF]. Third, among the different service and tourism experiences, emotions are considered to be of particular importance in the case of extended [START_REF] Dubé | Multiple roles of consumption emotions in post-purchase satisfaction with extended service transactions[END_REF] and multiple-encounter [START_REF] Zins | Consumption emotions, experience quality and satisfaction[END_REF] experiences. As underlined by [START_REF] Zins | Consumption emotions, experience quality and satisfaction[END_REF], consumers do not form concrete expectations for all the situations that could occur in a multiple-encounter experience. As such, they cannot assess their experience through the sole cognitive mechanism of confirmation/ disconfirmation of their expectations, leaving more space to their emotional evaluation.

Ski resorts are a typical case for multiple-encounter, hedonic, extended touristic experiences.

They offer a relatively complex service because of the great number of its components: the slopes, the lodgings, the tourist office are at the core of services' offering of the resort, but there are also a lot of other places supporting many peripheral services and that encompass every shop, restaurant and bar, ski lifts, furniture rental, etc. Surprisingly, they have received little attention in research on consumption emotions. The overall research question underlying the present work is hence to understand emotions' role in customers' post-consumption evaluation of their experience at a winter sports resort. To this end, the paper pursues the three following objectives:

-to uncover which emotions are used by customers in their evaluation of their stay at a ski resort;

-investigate to what extent do these emotions drive customers' satisfaction; -and investigate how do they drive satisfaction by considering the mediating role of overall perceived value.

In the following paragraphs, we start by reviewing the relevant literature on consumption emotions' role in driving overall perceived value and satisfaction to formulate the research model. Then, the two empirical studies undertaken in accordance with the previous objectives are described. Finally, the last two sections present the major findings and a discussion of the main implications and future research venues.

CONCEPTUAL BACKGROUND AND RESEARCH HYPOTHESES

Emotions and consumption experiences

Emotions are part of a broader set of affective reactions among which are moods, feelings, or attitude [START_REF] Bagozzi | The role of emotions in marketing[END_REF]. Beyond the role and importance of emotions, the nature and structure of affective reactions and emotional states have also been a subject of interest for researchers for many years. Two criteria are usually used to define emotions: valence and intensity. To state it differently, an emotion can be positive or negative and be more or less felt by individuals [START_REF] Izard | Human Emotions[END_REF]. Concerning the measurement of emotions, two approaches coexist in marketing research. The first one views emotions as being categorical, independent and recognizable [START_REF] Izard | Human Emotions[END_REF][START_REF] Kemper | A Social Interactional Theory of Emotions[END_REF][START_REF] Plutchik | Emotion: a Psycho-Evolutionary Synthesis[END_REF], while the second one considers that emotions arise from a combination of two or three factors, generally pleasure, arousal and dominance [START_REF] Mehrabian | An Approach to Environmental Psychology[END_REF][START_REF] Batra | Affective responses mediating acceptance of advertising[END_REF][START_REF] Batra | Developing a typology of affective responses to advertising[END_REF].

Between these two approaches, [START_REF] Richins | Measuring emotions in the consumption experience[END_REF] proposed a measurement tool specific to the field of consumption, based on six studies conducted in various domains (e.g. the use of one's favorite object, the purchase of an important product or of a service). The "Consumption Emotion Set" [START_REF] Richins | Measuring emotions in the consumption experience[END_REF] is a wide inventory of understandable terms reflecting 43 emotions felt by consumers. Although the main aim of the author was to propose an inventory large enough to cover the broad set of consumption emotions, she reduced it by deleting the redundant terms and by gathering the remaining ones in 16 clusters such as excitement, anger and surprise. Her approach is thus comparable to the factorial one [START_REF] Mehrabian | An Approach to Environmental Psychology[END_REF][START_REF] Batra | Affective responses mediating acceptance of advertising[END_REF][START_REF] Batra | Developing a typology of affective responses to advertising[END_REF]. Finally, it is noteworthy that Richins also compared the CES to other instruments including the PAD of [START_REF] Mehrabian | An Approach to Environmental Psychology[END_REF], the inventory of [START_REF] Plutchik | Emotion: a Psycho-Evolutionary Synthesis[END_REF] as well as Batra and Holbrook's affective responses to Ad categories (1990). She showed the superiority of the CES in accounting for the richness of emotional experiences.

Emotions' role in customers' experience evaluation

It is widely accepted today that customers evaluate their service encounters and experiences based on a mix of cognitive and emotional assessment of all the clues they interact with during their experience [START_REF] Berry | Creating new markets through service innovation[END_REF][START_REF] Mano | Assessing the dimensionality and structure of the consumption experience: evaluation, feeling and satisfaction[END_REF][START_REF] Wirtz | Consumer satisfaction with services: integrating the environmental perspective in services marketing into the traditional disconfirmation paradigm[END_REF].

The role of emotions has been reported in several studies. For instance, [START_REF] Liljander | Emotions in service satisfaction[END_REF] reported that emotions -especially negative ones -have a direct impact on the satisfaction level of visitors of a labor force bureau experiencing strong emotions. In a touristic setting, [START_REF] Duman | The role of affective factors on perceived cruise vacation value[END_REF] found that Cruise customers' feelings related to novelty, control and hedonics, have a direct impact on their level of satisfaction and both a direct and an indirect impact -through satisfaction -on their overall perceived value of the Cruise. Paralleling these findings, [START_REF] Ng | Service experience evaluation: the interrelationships of customer affect and service outcomes[END_REF] reported that both positive and negative affect experienced by collective hedonic services' customers had a significant direct impact on their perceived value, as well as a direct and indirect impact -through value -on their level of satisfaction.

Four different directions can be found in past literature to explain emotions' role in customers' experience evaluation. First, emotions can bias consumers' evaluations of their consumption experiences, as affect has an influence on the coding, storage and retrieval of information linked to these experiences in customers' memory [START_REF] Bagozzi | The role of emotions in marketing[END_REF]Curren and Harich 1994). Such bias was addressed and supported in different studies relating to different service contexts (e.g. de Ruyter and Bloemer, 1999), including in a touristic setting (e.g. [START_REF] Sirakaya | The role of mood on tourism product evaluations[END_REF].

The second explanation relates to the specific case of service failure and recovery. Service failure might occur in any service encounter, even a brief one. However, one might expect a higher probability of failure in extended, multiday service experiences that might involve many service providers, such as a week spent at a ski resort. Several empirical researches support that customers' emotions during the service failure and recovery process have an impact on their evaluation of their overall experience (e.g. Dubé and Maute, 1996;[START_REF] Hui | What to tell consumers in waits of different lengths: an integrative model of service evaluation[END_REF]. More specifically, empirical results show that emotions have an impact on customers' satisfaction with the service recovery and mediate the impact of the cognitive evaluations of justice on satisfaction (e.g. Del Rio-Lanza et al,. 2009;[START_REF] Schoefer | The role of cognition and affect in the formation of customer satisfaction judgements concerning service recovery encounters[END_REF].

Similarly, emotions mediate the impact of perceived justice on loyalty behaviors [START_REF] Chebat | How emotions mediate the effect of perceived justice on loyalty in service recovery situations: an empirical study[END_REF] and moderate the impact of the providers' recovery efforts on customers' satisfaction [START_REF] Smith | The effect of customer's emotional responses to service failures on their recovery effort evaluations and satisfaction judgments[END_REF]. The third explanation builds on the fact that the emotional aspects are an important part of the service encounter whether the emotional benefits are at the core of the service or not [START_REF] Price | Going to extremes: managing service encounters and assessing provider performance[END_REF]. This is due to the fact that service consumption is, to a great extent, a process consumption [START_REF] Grönroos | Marketing services: the case of a missing product[END_REF] where customers' perceptions of how the service is delivered are at least as important of their perceptions of what was delivered. This explanation can be illustrated with results from two studies conducted by [START_REF] Mattila | When does mood matter?[END_REF] and [START_REF] Mattila | The role of emotions in service encounters[END_REF] in the hospitality industry. Both studies focus on very brief service encounters where emotional benefits are not at the core of the encounter, but where the affective component of the encounter still had a significant direct impact on customers' overall evaluation of the encounter, the provider and customer's satisfaction.

Finally, the fourth explanation is specific to service contexts where emotional benefits are at the core of the service offering or, as stated by Price et al. (1995, p. 86) where "the consumer is motivated by the affective benefits offered by the service". This is the case of many extended touristic and leisure service experiences -such as winter sports tourism -based on hedonic benefits and where sensory stimulation, themed spaces and emotional content are major benefits sought and valuated by the customer [START_REF] Arnould | River Magic: extraordinary experience and the extended service encounter[END_REF][START_REF] Hirschman | Hedonic consumption: emerging concepts, methods and propositions[END_REF]. In this framework, [START_REF] Price | Going to extremes: managing service encounters and assessing provider performance[END_REF] found that positive affect was a significant antecedent of satisfaction for participants of a multiday rafting experience. [START_REF] Dubé | Multiple roles of consumption emotions in post-purchase satisfaction with extended service transactions[END_REF] propose that this link between affect and satisfaction in extended service transactions goes even beyond the expected valence congruity impact. According to these authors, positive emotions during the service experience lead to enhanced satisfaction whereas negative emotions would only decrease satisfaction if they are attributed to the service provider, and not to the customer himself or to the situation.

Hence, we propose the following: P1: Customers' emotions have a direct impact on the overall perceived value of their experience at a ski resort P2: Customers' emotions have a direct impact on customers' satisfaction with their experience at a ski resort

The mediating role of value

Overall perceived value can also be seen as a mediator of the impact of consumers' emotions on their satisfaction, since value is not only influenced by emotions but also acts as an antecedent of satisfaction. In the previous paragraph, emotions' were linked to value as an evaluation of the service experience. Emotions can also be linked to value building on the very conceptualization of the latter as a comparison between what is given and what is received by the customer within the framework of a particular transaction [START_REF] Zeithaml | Consumer perceptions of price, quality, and value: a means-end model and synthesis of evidence[END_REF]. In other words, consumers put in balance the sacrifices to access the service and the benefits obtained from it. These sacrifices and benefits must then be understood in a broad sense.

Sacrifices can involve financial as well as temporal or psychological costs [START_REF] Bender | Consumer purchase-costs: do retailers recognize them[END_REF], incurred risks or energy spent [START_REF] Lai | Consumer values, products benefits and customer value: a consumption behavior approach[END_REF]. Benefits on the other hand can be functional, social, aesthetical as well as emotional [START_REF] Sheth | Why we buy what we buy: a theory of consumption values[END_REF][START_REF] Lai | Consumer values, products benefits and customer value: a consumption behavior approach[END_REF]. Emotions' role as perceived benefits is particularly important and salient when hedonism is central to the service experience, a case where emotions become a key factor of value creation [START_REF] Edvardsson | Service quality: beyond cognitive assessment[END_REF].

In turn, overall perceived value acts as an antecedent of satisfaction, as customers draw their satisfaction judgment based on prior expectations as well as on the value of the experience in terms of the benefits to sacrifices comparison [START_REF] Fornell | The American customer satisfaction index: nature, purpose, and findings[END_REF][START_REF] Oliver | Value as excellence in the consumption experience[END_REF][START_REF] Mcdougall | Customer satisfaction with services: putting perceived value into the equation[END_REF].

However, it must be specified that two other perspectives on the relation between value and satisfaction are sometimes considered. The first one stipulates that global value and satisfaction can act in parallel (Oliver, 1996[START_REF] Oliver | Value as excellence in the consumption experience[END_REF]Cronin et al., 2000). For [START_REF] Aurier | Comprendre et mesurer la valeur du point de vue du consommateur[END_REF], this approach can only be valid within the framework of repeated experiences with the service, so that value and satisfaction can be considered in a cumulative view. The second one considers value as a consequence of satisfaction (Cronin et al., 2000). However, this approach relates better to consumption value instead of exchange value. Unlike exchange value, which is an evaluation of a transaction based on benefits and sacrifices, consumption value refers to the usage value of a service [START_REF] Holbrook | Consumer Value: A Framework for Analysis and Research[END_REF], which is closer to a preference for an object than to an evaluative judgment. In this case, satisfaction stemming from each particular experience is going to feed the value attached to the object. In other words, satisfaction contributes to form the preference for the category of services.

The focus of the present research being on value as an overall evaluation of an experience in terms of benefits and sacrifices, we build on the aforementioned stream of research that considers value as an antecedent of satisfaction and propose the following: H1: Overall perceived value has a direct positive impact on customers' satisfaction P3: Customers' emotions have an indirect impact on customers' satisfaction with their experience at a ski resort through the mediation of overall perceived value

METHOD AND RESEARCH CONTEXT

Two separate empirical studies were designed to address the three research objectives presented in the introduction, including the test of the research model presented in figure 1.

The geographical setting of both studies is the French region of Rhône-Alpes. The latter is the French region that receives the most tourists and is particularly attractive because of its numerous ski resorts. For instance, during winter 2009/2010, the two administrative departments of Savoie (Savoie and Haute-Savoie) registered more than 38 million commercial nights and ski lifts generated a revenue of about 800 million Euros1 .

Figure 1 approximately here

Study 1

The purpose of the first study was to explore and assess the emotions that the customers associate with their experience at a ski resort. Richins' CES was chosen as a baseline framework because of the variety of emotions it offers and as it is also a very adaptable tool. Indeed, [START_REF] Richins | Measuring emotions in the consumption experience[END_REF] recommends adapting the CES to the consumption context to which it would be applied. Another advantage is the existence of a validated French version of the CES [START_REF] Ferrandi | Une première application de l'échelle de Richins pour mesurer les réactions émotionnelles à la publicité[END_REF], as the field of this research takes place in France. The French version was submitted for evaluation to a convenience sample of 267 consumers through an online survey. The respondents were approached via a snowballing procedure starting with a pool of professors, students and administrative staff from the authors' university who received the questionnaire by email and later transmitted it to their friends and family. The respondents evaluated the relevancy of each of the 43 translated items for describing the emotions felt during a stay at a ski resort, using a seven point scale ranging from "absolutely irrelevant" to "extremely relevant". After discarding all the respondents who have spent less than three consecutive days at a ski resort, only 137 questionnaires were finally used.

In order to assess emotions' relevancy, the data were first recoded and dichotomized as follows: items with individual scores ranging from 1 to 4 were recoded as "relevant" and those with scores higher than 5 were recoded as "irrelevant". Second, the percentage of respondents having considered the item as "relevant" was calculated for each item. Finally, only the items rated as "relevant" by more than 50 percent of the respondents were considered as appropriate emotions to describe a consumption experience of a stay at a ski resort. This first study resulted in a short list of 11 emotions, all of positive valence (table 1).

Study 2

The purpose of the second study was to test the research hypothesis and propositions. A questionnaire was developed including measures for each of the three constructs. Emotions were measured using the eleven relevant items adapted from the CES during the first study.

However, two additional emotions, "surprised" and "astonished", were also included in the questionnaire for several reasons. First, even though they were not deemed pertinent by more than 50% of the respondents in the first study, we consider that these two items could be useful to characterize emotions felt by novice customers. Furthermore, a part of the data was collected in a new ski-resort, which features are different from other traditional French Alps resorts. Due to its configuration and its architecture, we deemed it interesting to keep emotions related to surprise because some of the respondents might never have experienced this kind of resorts. Finally, a growing stream of research considers surprise as a key element in delighting consumers [START_REF] Chitturi | Delight by design: the role of hedonic versus utilitarian benefits[END_REF]Oliver et al., 1997;[START_REF] Vanhamme | What if you surprise your customers... Will they be more satisfied? Findings from a pilot experiment[END_REF]. These arguments led us to include the two emotions in the final questionnaire.

Perceived value was measured with a three items scale proposed and validated in a French context by [START_REF] Aurier | Comprendre et mesurer la valeur du point de vue du consommateur[END_REF], consistently with Zeithaml's (1998) definition of value adopted in this research. Finally, customers' satisfaction was tapped through two items, related to the global level of satisfaction ("globally, I am satisfied with my stay") and expectations' confirmation ("this stay meets my expectations"). The items used to measure perceived value and satisfaction are presented in the Appendix.

Data collection was carried during weekdays over two weeks in April 2009 at the "Arc" ski station in the French Alps. During the fifteen days period on which the collection took place, the weather was mild and stable, and so was snow quantity and quality, hence insuring that the data collection and the data set were not affected by exceptional weather conditions. The respondents were approached on the terraces of the bars, hotels and restaurants of the station and this was done in agreement with these establishments' managers. As such, the research constructs were measured "in-process", that is to say during the consumption experience, in order to avoid the influence of special moments of the guests' experience such as peak or final moments [START_REF] Brunner-Sperdin | It is all about emotional state: managing tourists' experiences[END_REF]. The questionnaires were self-completed by the respondents. Overall, data collection yielded 540 usable questionnaires. The sample distribution by gender is representative of the French population with 48% male respondents. However, vacationers from 35 to 49 years, living in the Ile-de-France region, whose household is composed of four or more persons, were over-represented in the final sample.

EMPIRICAL FINDINGS

Before testing for the causal relationships between the model's constructs, the thirteen emotions' items were analyzed with a principal component analysis (PCA) to uncover the underlying structure of customers' emotions. The value of the KMO index is 0.911, indicating that the present data set is adequate for component analysis. PCA with a Promax rotation indicated a four factor solution representing 75.94% of the total explained variance. Seven of the thirteen items grouped on three factors that reproduce three clusters initially found by Richins: Joy (happy, pleased, joyful), Peacefulness (calm, peaceful) and Surprise (surprised, astonished). However, the fourth factor regrouped the six remaining items which were originally linked to five different emotional clusters of the CES.

The four factors solution was then subjected to a confirmatory factor analysis using structural equation modelling, resulting in unsatisfactory model fit (e.g. χ²/df= 5.15, AGFI= 0.876, RMSEA= 0.09). Model respecification, based on the analysis of the modification indices and standardized residuals [START_REF] Kline | Principles and Practice of Structural Equation Modeling[END_REF], led to the elimination of two items: contented and warm hearted. The respecified solution shows satisfactory fit indices (e.g. χ²/df = 3.53, SRMR = 0.03, AGFI = 0.926, RMSEA = 0.07, CFI = 0.973). The factor combining items from different emotional clusters of the CES was labeled Excitement as its two items with the highest loadings belong to the excitement cluster in the CES, and the two remaining items do not express any opposite ideas (table 2). The four dimensions' reliability and convergent validity were respectively assessed with the composite reliability index and the average variance extracted (AVE). For all of the four dimensions, these measures are beyond the conventionally acceptable thresholds [START_REF] Hair | Multivariate Data Analysis: A Global Perspective[END_REF]. The psychometric quality of the satisfaction and perceived value scales was also assessed separately. Both scales had very satisfactory AVE (0.74 for value and 0.84 for satisfaction) and composite reliability (0.89 for value and 0.92 for satisfaction).

Table 3 approximately here

The research model was then tested with structural equation modelling using the Amos 18 software. The model was estimated with the Maximum Likelihood procedure and by applying a non-parametric bootstrap (N=1000 resampling) as the latter allows to test the significance of indirect effects, giving thus one of the best alternatives for testing for mediation [START_REF] Mackinnon | A comparison of methods to test mediation and other intervening variable effects[END_REF][START_REF] Zhao | Reconsidering Baron and Kenny: myths and truths about mediation analysis[END_REF]. The structural model shows very satisfactory fit to the data (χ² (df) = 244.17 (89) , AGFI= 0.92, SRMR= 0.028, CFI= 0.974, RMSEA= 0.057). In addition, the hypothesized model has a high explanatory power, as it respectively explains 43% and 66.2% of the variance of perceived value and customers' satisfaction.

Next, we analysed the regression weights for all the hypothesised links. They show that perceived value has the strongest direct impact on customers' satisfaction with their stay at the resort (std. weight = 0.598), hence lending strong support for H1. Furthermore, the empirical findings show partial support for propositions P1, P2 and P3. In fact, emotions' impact on perceived value and customers' satisfaction varies greatly from one affective dimension to another. For instance, Excitement has the strongest direct impact on perceived value (std. weight = 0.368) and the strongest indirect impact on satisfaction (std. weight = 0.22). As such, its total impact on satisfaction (std. weight = 0.588) is almost as important as that of perceived value. However, Excitement does not have any direct impact on satisfaction, as its impact is fully mediated by perceived value. Joy is the only emotional dimension to have a direct impact both on perceived value (std. weight = 0.237) and satisfaction (std. weight = 0.184), as well as an indirect impact on satisfaction (std. weight = 0.142) through the partial mediation of perceived value. Peacefulness on the other hand only moderately influences satisfaction (std. weight = 0.147), without having any impact on perceived value. Finally, Surprise did not have any significant impact on either of the dependent variables.

The standardised regression weights for each hypothesized link as well as their significance level obtained through bootstrapping are reported in table 3. The observed differences in the magnitude of the standardised regression weights, ranging from 0.147 to 0.598 are also noteworthy. There are no universally established rules for interpreting the magnitude of the regression weights. A commonly accepted "rule of the thumb" in social sciences is given by [START_REF] Cohen | Statistical Power Analysis For The Behavioral Sciences[END_REF] who indicates three cut-off values for standardised regression weights delineating weak (less than 0.1), moderate (around 0.3) and strong (higher than 0.5) effects. In the present case, this indicates that only perceived value has a strong direct effect on customers' satisfaction. Furthermore, while the impact of Joy and Peacefulness on satisfaction is rather weak, the impact of Excitement and Joy on perceived value is moderate. In other words, customers' emotions have stronger impact on perceived value than on customers' satisfaction, and only value can be considered as a strong direct driver of satisfaction. These findings corroborate the pivotal role of perceived value in the research model as value channels the effects of tourists' emotions towards their satisfaction with the ski resort experience.

DISCUSSION

Theoretical implications

The results of the two empirical studies have many theoretical implications. First, we notice the small number of emotion types that clients of ski resorts seem to feel. Only 11 items represented by three dimensions were considered as relevant by consumers to describe the emotions felt during a stay at a ski resort. This result corroborates the contextual nature of consumption emotions, as several empirical studies based on the CES in different contexts found a different number of items and dimensions [START_REF] Ruth | Linking thoughts to feelings: investigating cognitive appraisals and consumption emotions in a mixed-emotions context[END_REF][START_REF] Zins | Consumption emotions, experience quality and satisfaction[END_REF][START_REF] Smith | The effect of customer's emotional responses to service failures on their recovery effort evaluations and satisfaction judgments[END_REF][START_REF] Laros | Emotions in consumer behavior a hirearchical approach[END_REF].

Second, it is also interesting to highlight the results related to the Surprise dimension. In the first study, the surprise related items were not judged as relevant by French consumers to qualify the emotions associated with a ski resort consumption experience 2 . When included in the second study despite this lack of pertinence, the Surprise dimension reflected in those two items is the only emotional dimension to have no significant impact on neither of the two selected outcomes: perceived value and customer satisfaction. These two results were all the more unexpected that surprise is usually presented in the literature as a strong emotional state that is able not only to create value and satisfy customers, but also to activate a higher level of satisfaction by delighting customers [START_REF] Chitturi | Delight by design: the role of hedonic versus utilitarian benefits[END_REF][START_REF] Vanhamme | What if you surprise your customers... Will they be more satisfied? Findings from a pilot experiment[END_REF]. One possible explanation for the lack of importance and impact of surprise might be found in the managerial context of French ski resorts and more precisely in their marketing strategy.

French resorts generally lack a unified management of the global customer experience at the resort. In this framework, recent studies suggest that the holistic service setting and its staging potential can significantly affect the emotional states of guests during a touristic experience 2 Using the same method described earlier to calculate the relevance scores, the items "surprised" and "astonished" were judged as pertinent respectively by 29.2% and 26.3% of the respondents. (Brunner-Sperdin andPeters, 2009, Brunner-Sperdin et al., 2012). In addition, these resorts seem to have traditionally privileged a "quantitative" positioning of the offering of each component of the experience, based mainly on the number of slopes, their difficulty levels, number of ski lifts, number of shops and restaurants, etc. [START_REF] Tuppen | The restructuring of winter sports resorts in the French Alps: problems, processes and policies[END_REF]. In other words, these resorts do not position their offerings as a global experience based on emotions and sensations, as one would expect for such a multiday hedonic service. As such, French ski resorts might be less able to propose an emotionally based intense experience that would activate customers' delight through the channel of surprise. Indeed, when comparing the scores of the four emotional dimensions, the average score of Surprise (2.75) is relatively small in comparison to that of the other dimensions of Joy (4.62), Peacefulness (4.28) and Excitement (3.91). Conversely, the functional based value proposition would hence explain the little surprise experienced by the customers and in turn the lack of impact of the surprise effect on perceived value and customer satisfaction.

A second explanation could come from the valence-neutral measure of surprise. Generally, positive surprises enhance satisfaction [START_REF] Vanhamme | What if you surprise your customers... Will they be more satisfied? Findings from a pilot experiment[END_REF]. In the present study, respondents were not asked whether they had felt some positive or negative surprise. They only had to evaluate the intensity with which they had felt surprise during their stay. When responding, it is likely that some have referred to positive surprises and some to negative ones. Thus, it is possible that the effects of positive and negative surprises cancel each other out, suggesting a lack of effect. In this sense, it is difficult to draw conclusions about the relevance of surprise in the context of a stay in winter sports resort and this lack of impact from surprise on satisfaction should, once again, be interpreted with caution.

The third important result relates to the major role played by perceived value as can be seen in the previous section. In addition to being the most important antecedent of customers' satisfaction with their stay at a ski resort, perceived value plays either as a partial or a full mediator of the impact of two emotional dimensions, Excitement and Joy, on satisfaction. The importance of perceived value as a mediator can also be statistically assessed by comparing the previous results to those of an alternative model that does not include value. When the latter's impact is ruled out, the percentage of variance of customers' satisfaction explained by the alternative model drops to 46%. This indicates a substantial contribution of perceived value to the explanation of satisfaction, with a value of [START_REF] Cohen | Statistical Power Analysis For The Behavioral Sciences[END_REF] f² of 0.5973 . These results are consistent with previous research on the value concept that report evidence of its importance, and particularly of its explanatory and predictive role of important issues such as customer satisfaction [START_REF] Ng | Service experience evaluation: the interrelationships of customer affect and service outcomes[END_REF] and loyalty (Boulding et al., 1993;[START_REF] Parasuraman | The impact of technology on the quality-value-chain: a research agenda[END_REF]. The issue of value creation for consumers is thus central because it is a source of competitive advantage [START_REF] Woodruff | Customer value: the next source for competitive advantage[END_REF].

Finally, one last empirical finding, also linked to the mediating role of value, deserves some particular attention. Parallel to its role as mediator of Joy and Excitement's impact on satisfaction, perceived value does not mediate the impact of Peacefulness. As a matter of fact, Peacefulness did not even have any significant impact on perceived value. This result could be interpreted, though with high precaution, based on the very conceptualization of perceived value as a benefit to cost comparison, as well as based on the research context. In fact, in addition to having a research context based on an intense sport activity (winter sports), respondents in the second study are mostly young consumers (85.4% are less than 50 years old). As such, Peacefulness could be considered as less of a sought and valued benefit than the ones procured by Joy and Excitement. Some moderating effects could be tested here in future studies, so as to show a possible influence of individual variables. One possible variable is involvement, as Brunner-Sperdin and Peters (2009) report from an empirical study that guests' involvement during their stay at a high-quality hotel has an important influence on their emotional experience. Another possible variable that could moderate the roles of peacefulness versus joy and excitement in driving value is customers' need for stimulation. This is consistent with recent results from [START_REF] Lin | Servicescape moderation on personality traits, emotions, satisfaction, and behaviors[END_REF] who report that the individual personality trait of arousal-seeking tendency has a significant effect on the emotions felt by customers during a touristic experience.

Managerial implications

We identify three major types of managerial implications.

First, managerial implications derive from the identification of emotions that are most relevant in the context of a stay at a ski resort. Knowing that this type of service experience is able to generate emotions related to joy, excitement and peacefulness allows managers to think about segmentation criteria and thus positioning. In that sense, it is clear that a typology of customers would be useful. Instead of focusing on functional criteria such as the number of ski lifts or miles of ski runs, managers could then highlight the ability of stations to raise emotions. More and more stations of the Alps are doing so. However, additional effort lies in the match between the emotions highlighted in the discourse and the particular needs of targeted segments.

Second, this work shows that even in the case of a highly hedonic service, customers rate their experience in terms of perceived benefits and sacrifices. Therefore, managers should seek to increase the overall value by reducing costs or increasing benefits. We have shown that this creation of value for the customer leads to satisfaction. The emotions experienced by customers are a source of value. This article provides clues as to which emotions are most likely to be assessed as benefits. The emotions related to joy and excitement are the most valuable for customers. Thus, we encourage managers to focus on how to generate this kind of emotions.

Similarly, a systematic consideration of the positive and negative emotions generated by the various elements of the service would be useful for the resorts. The aim is to avoid negative emotions and maximize the rise of positive ones instead. As such, a thorough analysis should be undertaken to uncover which components of the service are most likely to stimulate customers and to make them live a joyful experience. It also seems essential to better understand why the role of surprise is inconclusive. While previous research suggests that it is useful to surprise customers [START_REF] Vanhamme | What if you surprise your customers... Will they be more satisfied? Findings from a pilot experiment[END_REF], our results raise questions.

Resorts' managers should consider the surprise elements more carefully and try to understand whether it is the intensity of the surprise, its valence or a mix of both elements that adds value to customers' experience and enhances their satisfaction.

Limitations and future research directions

The present research also bears several limitations that could offer some interesting venues for future research. First, the research context of the empirical studies was limited to winter sports in a ski resort, a specific type of multiday hedonic service experiences. Despite its economic importance, this subsector of the tourism and hospitality industry has received little attention in the past and the present work contributes to the general understanding of the specificities of this context. However, this single context perspective constitutes a limitation to the generalizability and external validity of the research, especially that some of the conclusions and explanations suggested in the previous section are contingent to the context of the studies.

Future research should extend this work and compare its findings in two ways: by including other hedonic multiday services as well as by comparing to ski resorts in other countries with a different -probably more emotional based -marketing and positioning.

Second, in the alternative model where value's role is ruled out, the impact of Joy, Peacefulness and Surprise on satisfaction is very close to their impact observed in the initial model. However, Excitement has no significant impact on satisfaction in the absence of perceived value. The present situation requires careful analysis as the existence of a direct impact between the independent and dependent variable in the absence of the mediator, also known as the "effect to be mediated", has long been considered as a prerequisite for testing for mediation [START_REF] Baron | The moderator-mediator variable distinction in social psychological research: cenceptual, strategic, and statistical considerations[END_REF]. However, recent technical literature on mediation clearly underlines that the existence of the effect to be mediated is not necessary, as the impact of one variable on another can be fully mediated by two competing mediators, where the two mediated effects are of same magnitude but of opposite sign [START_REF] Zhao | Reconsidering Baron and Kenny: myths and truths about mediation analysis[END_REF]). This situation is also known as suppression. In the present case, it indicates that another mediator than value carries a negative impact from Excitement to customers' satisfaction. However, such competing indirect effect could not be tested in the present work due to the limited number of variables included in the questionnaire.

Finally, we have chosen in the present research to use structural equation modelling in order to test the hypothesis and propositions developed based on the literature. Structural equation modelling was deemed adequate here for several reasons, including its ability to test simultaneously several causal links, evaluate the overall fit of the research model and test for the mediated effects. However, structural equation modelling also has limitations (e.g. [START_REF] Kline | Principles and Practice of Structural Equation Modeling[END_REF]. One important such limitation is the possible existence of several models derived from the same set of variables and that could fit the data equally well. The existence of statistically equivalent models can be considered as a limitation in the present case since, as can be seen from the literature review, the direction of the relationship between perceived value and satisfaction is still a controversial topic in the marketing literature (e.g. [START_REF] Aurier | Comprendre et mesurer la valeur du point de vue du consommateur[END_REF], Cronin et al., 2000).

Table 2 approximately here

Table 4 approximately here

 4

http://pro.rhonealpes-tourisme.com/publication/43968680, last accessed on 3 May

According to Cohen (1988), an f² value larger than 0.35 can be considered as substantial.


Mohamad Hamze
email: mohamad.hamze@u-bourgogne.fr

Fabrice Peyrard
email: fabrice.peyrard@irit.fr

Emmanuel Conchon
email: emmanuel.conchon@irit.fr

An improvement of NFC-SEC with signed exchanges for an e-prescription-based application

Keywords: NFC, e-prescription, Security, e-signature, ISO/IEC 13157, healthcare application

In the context of an aging population, drug intake can be a potential source of errors leading to death in some cases. Almost all of these errors are unintentional and come from incorrect prescriptions, unsuitable dosages for the patient or incompatibility with other treatments. To limit these risks which are especially important in the elderly or predependency, we propose a secure system for drug treatment through the NFC (Near Field Communication) contact-less communication technology. The proposed system provides security mechanisms such as integrity, authentication, encryption and non-repudiation. To ensure this security, an extension of the international standard ISO/IED 13157 (NFC-SEC) is proposed to handle electronic signature based on a public key infrastructure.

INTRODUCTION

Everyday our health system is improving so that elders can now have a longer life expectancy. Nonetheless, for many of them, seniors require an assistance to improve their quality of life leading to a strong effort in this direction by the research community. In this context, to support the autonomy of elderly people, we choose to focus on the risk of medication errors. More specifically, we choose to highlight three common sources of medication error. First is when the physician is writing his prescription: the patient may inadvertently omit to tell the doctor about another medication he is taking for the treatment of another disease. Second, during the pharmacist dispensation, a prescription may be poorly written so that the pharmacist may misread the prescription leading to the dispensation of the wrong drug or of the wrong dosage for instance. Third, when taking his medication, the patient can make an error with the dosage, the schedule or even with the drug he takes. The risk associated with each of these three sources is very different from one to another with a probability of occurrence which increases from source 1 to source 3. Indeed, a good physician (doctor) and a good pharmacist should ask the relevant questions to avoid most of these risks. However, the third case depends only of the patient and has therefore a great probability to occur especially in the case of the elderly.

We present in this paper a process of development and use of electronic prescribing (e-prescribing) in an ubiquitous environment to reduce the risk of medication errors. Indeed, potential errors induced by the prescriber or pharmacist can be limited with the use of an electronic prescription (e-Rx) system. The drug intake phase is assisted by an ambient intelligence system in order to reduce the associated risks.

The ubiquitous system is based on electronic prescription and on a NFC (Near Field Communication) contact-less communications technology between patient, prescriber, pharmacist and drug boxes. The originality of our contribution relies on the following points: (1) the use of a single wireless technology NFC throughout the overall process, (2) a natural behavior of the patient through the process by being vigilant at every stage at the acceptability of the system, (3) a secure design ensuring the confidentiality of patients personal data (ethics), the traceability and the non-repudiation of the data exchanges.

In this paper, it has been chosen to highlight the security issues of the NFC technology and to propose a solution that tackles these issues for a healthcare system. A big part to ensure the patient safety is the necessity to track every people, devices and medication involved in the medical treatment. Indeed, misidentified patient or medications can cause serious, or even fatal, errors in medication care [START_REF] Lahtela | Rfid and nfc in healthcare: Safety of hospitals medication care[END_REF]. In addition, for a secure system several other requirements have to be filled: confidentiality, integrity, availability and non-repudiation of the exchanged data.

An NFC communication is usually done through an insecure channel which is not satisfactory from a security standpoint as shown as in [START_REF] Haselsteiner | Security in near eld communication (nfc)[END_REF] [START_REF] Mulliner | Vulnerability analysis and attacks on nfc-enabled mobile phones[END_REF]. To tackle this issue, several security standards have been published. For example, the International Standard ISO/IEC 13157 (NFC-SEC) [START_REF]Information technology -Telecommunications and information exchange between systems -NFC Security -Part 1: NFC-SEC NFCIP-1 security services and protocol[END_REF][3] published in 2010 enables two NFC devices to establish a secure channel in Peer-to-Peer mode. Nonetheless, they still do not provide a solution for every security requirements. For instance, the NFC-SEC standard does not provide entity authentication. In addition, it cannot ensure non-repudiation because it does not contain any functionalities to sign the exchanged data. To deal with this problem, we propose to extend the NFC-SEC standard with the use of an electronic signature delivered by a Public Key Infrastructure (PKI).

The remaining of this paper is organized as follows: in section 2, the proposed ubiquitous system to improve drug intake based on e-Rx is presented; in section 3, the NFC technology is introduced with a focus on the security issues for healthcare applications; in section 4, the proposed security architecture and the extension of the NFC-SEC standard are presented; finally, a conclusion and some future works are provided.

PROPOSED COMMUNICATION PROCESS

System overview

The proposed system is based on a recommendation made in 2012 by the CLIO (Comité de Liaison Inter-Ordres) Santé, which is the liaison committee of French medical regulatory authorities. In this note, the CLIO has presented a solution for the introduction of e-prescription (e-Rx) in the French e-health organization.

Currently, this system mainly relies on two electronic health records (EHR): The shared personal medical record (DMP) and the pharmaceutical record (DP).

-The DMP is the French shared patient record where the health professionals (medical doctor, surgeon etc.) can exchange medical information about the patient. This EHR stores labs exams, medical background, letters between physicians, medical images but no e-Rx. It has to be noticed that the patient can hide some information in this record and, for instance, only allow the access to a small subset of information for a specific doctor. -The DP is handled by pharmacists and stores information about every medication that have been delivered to the patient in the last 36 months.

The information is split between the DMP and DP and a e-Rx system should be suitable to establish a link between them to carry the information between doctors and pharmacists. Therefore, the CLIO recommendation is to have a third repository dedicated to e-Rx.

The new CLIO healthcare pathway is presented in Figure 1 from step (1) to step (6). Once the doctor is authenticated on the system, he can access to the DMP of his patient to collect information (step (1)). Both the identity of the patient and of the doctor are ensured with a smart card (see section 2.3). After the medical exam, the doctor can edit a new e-prescription (e-Rx) and sends it to the e-Rx national repository (step (2)). He also gives a paper-based prescription to the patient. With his prescription, the patient goes to the pharmacy of his choice to receive his medication. In the pharmacy, the patient gives his smart card to the pharmacist who can then access to the DP and can receive the e-Rx to deliver (step (3) and ( 4)). He can substitute some drugs for generic ones. If so, he updates both the DP and the e-Rx registries (step (5) and ( 6)).

This system seems to be an effective and cost-saving way to reduce several errors (transcription for instance) and to ease the exchange of information between the doctor and the pharmacist. But, this system has no direct impact on the way the patient deals with his own medication.

As depicted on Figure 1, we propose to extend this proposition with a dedicated solution to provide new services to the patient among which is the possibility to make the intake of medicines easier. This solution is not to be opposed to the centralized e-Rx repository but can rather be viewed has a complementary tool to enforce the patient safety and security.

To provide these new functionalities, the patient has to received the e-Rx. To do that, we choose to use a NFC contact-less technology (see section 3.1 ). Indeed, the NFC technology is of growing interest and is present in most of modern phones. This technology is an extension of the RFID technology and provides a peer-to-peer communication mode which can be used for the exchange of e-Rx. Moreover, the range of communication is very short (below 10cm) so that the communication link has to be willingly established keeping the social interactions that currently exist and helping in the memorization of the transmission by the patient.

This e-Rx is then stored on the patient smartphone and can then be used to have reminders of his drug intakes for instance. Nonetheless, this NFC system has to be as secure as the system based on the centralized repository for e-Rx.

System communication architecture

Three kinds of actors have been defined: the patient, the prescriber (i.e. the health professional which can be a doctor or a nurse for instance) and the pharmacist. In addition to this three actors, the drug box also has a preeminent role as it contains a big part of the information (i.e. the intelligence) of the ambient system. The system is split in three parts where different interactions can occur:

-interactions between the patient and the prescriber (step (A)), -interactions between the patient, the pharmacist and the drug box (step (B) and (C)), -interactions between the patient and the drug box (step (D)).

Interactions between the patient and the prescriber After the medical exam, the e-Rx is provided by the prescriber to the patient via NFC (see step (A) on Figure 1). This e-Rx has the same level of security as the paper one and has to be digitally signed by the prescriber to ensure the non-repudiation of the contained data.

Note that the patient can also give the prescriber an access to his previous prescriptions (or a subset) so that the prescriber can have valuable information to write his e-Rx.

Interactions between the patient, the pharmacist and the drug box

With his e-Rx on his smartphone, the patient or his helper goes to his usual pharmacy to receive his medication. The pharmacist consults the national e-Rx repository based on the e-Rx id provided via NFC. Note that this proposition enforces the CLIO system in terms of confidentiality. Indeed, the pharmacist has only access to the e-Rx to deliver and not to every e-Rx stored in the repository. If a substitution is made, the e-Rx is updated and then transmitted both to the national repository and to the patient mobile phone with NFC. This e-Rx has information about the current date, the substituted drugs, the drug box that are given to the patient (Unique ID, type etc.) and about the pharmacist identity for traceability purpose.

Moreover, the e-Rx can be used by the pharmacist to store on the drug box memory, information that are usually written on it. Indeed, we propose to add a NFC-tag to the drug box to store information about the patient, the prescriber, the dosage and the date of the prescription as well as the date of the dispensation.

At the end of this step, the patient has an updated e-Rx on his mobile phone and has received several smart drug boxes. All of these elements will allow the proposition of new services for the patient.

Interactions between the patient and the drug box

With the e-Rx on his smartphone, the patient will then be allowed to receive scheduled reminders to take his drugs. When an alert is received, the patient has to pass the phone over the drug box (i.e. to tag) to acknowledge the drug intake. The drug box tag is read by the smart-phone to ensure first that the box contains the drug the patient is supposed to take and second that the box belongs to him. Alzheimer patients for instance can forget what their medication box looks like even after years of usage of this same drug. If the patient uses the correct drug box, the time and date are stored in the box tag. If a box is tagged without any reminder issued by the smart-phone, this date is used to compute the time between the last intake and the current one. If this time interval is too short leading to a risk for the patient health, an alert is generated in order to cancel the drug intake.

Every validated drug intake is then logged on the smart-phone to provide a historical overview of the patient behavior. This overview can be used by the doctor to adjust the medical treatment with more information than with an interview only. For Alzheimer patients, this overview can also be used by helpers to keep a track of the drugs taken. Moreover, a functionality is provided to allow the patient to add specific information during every drug intakes explaining why he did or did not take the prescribed drug (side effects for instance).

Information stored on the drug box can also be used to enforce the overall traceability from the dispensation standpoint (to recover some box within a contaminated lot for instance) and from the drug intake standpoint. Indeed, this information can be used by the patient to start over a new overview even if he looses his smart-phone or his e-Rx. Without an e-Rx, the patient will still be able to know if a drug box belongs to him, if the drug intake is possible at the current time and even find the prescribed dosage on the drug box.

To sum up, two kinds of communication can occur. Peer-to-peer communications between the doctor (e.g the pharmacist) and the patient and communications between the patient and the drug box.

Security considerations

In the proposed system several security issues can be pointed out. First, as the e-Rx is considered in France as a medical information, it has to be encrypted and transmitted in a secure way to prevent eavesdropping. Similarly, the data stored on the box has to be encrypted. Moreover, every actors of the system has to be identified. For every communication the exchanged data has to be signed in order to ensure the non-repudiation. Furthermore, the use of the digital signature will help to detect potential modification of the information stored in the e-Rx or on the drug box.

In the French health system, health professionals and patients are equipped with a smart card that can be used to ensure the basic operation for our system: the 'CPS Card' and the 'Carte Vitale 2'.

CPS Card ASIP santé is a national registration and certification authority that ensures trust in the exchange of health data. It delivers to each health professional a smart card called CPS (Carte des Professionnels de Santé) used as an electronic certificate. A CPS card is a professional electronic identity card. It helps holders to prove their identities and their professional qualifications. It is protected by an individual PIN code. A CPS card is the key for e-health services now and in the future in France. It enables healthcare professionals to: (1) Identify themselves and avoid identity theft; (2) Add electronic signatures to documents; (3) Send electronic treatment forms to the mandatory state health and supplementary insurance organizations; (4) Create, add to and refer to the electronic health records of their patients; (5) telemedicine; (6) Use a secure messaging service for healthcare professionals; [START_REF]Information technology -Telecommunications and information exchange between systems -Near Field Communication -Interface and Protocol (NFCIP-2)[END_REF] Thanks to contact-less technology, it can also be used for other applications such as accessing premises .

Carte Vitale 2

The Carte Vitale 2 is the health insurance card in France used for the reimbursement of treatment costs by the national social security agency. With the Carte Vitale 2, health professionals can electronically transmit sheets to care health insurance. The Carte Vitale 2 is supposed to guarantee the identification of the insured person and allows him to sign the electronic care sheet. It must be presented for each visit to the doctor and for every purchase of medication. At the time of writing, the identification is made by the health professional based on the name of the card holder and his photography printed on the card. But, it can be noticed that the card already offer cryptographic functionalities which could be used to ensure security of the exchange and the holder authentication if activated.

So, the CPS card empowered every health professional with digital certificates that can be used for encryption or signature. But, the communication technology has to support also encryption and signature to ensure the overall security of the system.

BACKGROUNDS

Near Field Communication (NFC) Technology

NFC is an extension of RFID based on contactless communication standards. NFC provides short-range communication on a high frequency (13.56 MHz) and is used by devices with low capacity of memory and of computing. It allows data to be exchanged between devices that are within a few centimeters (10 cm) and supports data transfer rates of 106, 216, 424, and 848 Kbit/s. NFC allows the use of small tags that made it possible to be used with small products. Moreover the communication does not require a direct line of sight.

NFC in mobiles can operate in three different modes determined by the application used; it can communicate with another active NFC mobile in Peerto-Peer mode, or communicate with a passive RFID/NFC tag in reader/writer mode, or communicate with an NFC reader in card emulation mode [START_REF] Vedat Coskun | Near Field Communication: from theory to practice[END_REF]. Our work in this paper concerns NFC mobiles in Peer-to-Peer communication mode.

Standardization NFC is standardized in ISO/IEC 18092 [6] and ISO/IEC 21481 [START_REF]Information technology -Telecommunications and information exchange between systems -Near Field Communication -Interface and Protocol (NFCIP-2)[END_REF] that define communication interfaces and protocols between two NFC devices. For easier integration, NFC has been derived from the same platform as ISO/IEC 14443 [START_REF]Identification cards -Contactless integrated circuit(s) cards -Proximity cards -Part 1: Physical characteristics[END_REF] [START_REF]:2004, Information technology -Telecommunications and information exchange between systems -Near Field Communication -Interface and Protocol (NFCIP-1)[END_REF], or from proximity cards that define the communication with contact-less integrated circuits (IC). NDEF (NFC Data Exchange Format) defines the logical formats for data exchanges.

NFC survey

In healthcare : Alemdar [START_REF] Alemdar | Wireless sensor networks for healthcare: A survey[END_REF] presents in 2010 a state of the art of sensor networks for healthcare where the BAN (Body Area Network), PAN (Personal Area Network), gateway to wide networks, wide networks, and end-user healthcare monitoring application are described. This study is a large overview of the different wireless technologies. The presented work on contact-less technology in particular RFID and NFC, highlights the support for activities of daily living detection , the support of location tracking and the support of medication intake.

On this last point, Ho [START_REF] Ho | A prototype on rfid and sensor networks for elder healthcare: progress report[END_REF] is one of the first to propose a prototype integrating a sensor network and RFID technology for the in-home medication monitoring. Pang [START_REF] Pang | A pervasive and preventive healthcare solution for medication noncompliance and daily monitoring[END_REF] recently proposed iPackage: a pervasive healthcare solution for medication noncompliance problem . This prototype allows to tag individual tablets of a medicine box. The proposed solution is cumbersome and the performances obtained do not fully meet the authors expectations.

Ilie-Zudor [START_REF] Ilie-Zudor | A survey of applications and requirements of unique identification systems and rfid techniques[END_REF] published in 2011 a journal article which is also a state of the art of applications with unique identifications. It categorizes fifteen application areas including healthcare. The advantages of RFID-based applications are presented including pharmaceutics where RFID can be used as a substitute of bar-codes or can be used for hospital equipment and personnel tracking, for patient medical history or for implant prosthetic and elderly care. It is stated that RFID technology can reduce human errors in the process.

In their work Jara and al. [START_REF] Jara | An architecture based on internet of things to support mobility and security in medical environments[END_REF][START_REF] Jara | Drugs interaction checker based on iot[END_REF][START_REF] Jara | An internet of things-based personal device for diabetes therapy management in ambient assisted living (aal)[END_REF] present architectures for AAL (Ambient Assisted Living) based on IoT (Internet of Things). In [START_REF] Jara | An architecture based on internet of things to support mobility and security in medical environments[END_REF], Jara and al. present the need for secure communications in a medical environment based on symmetric ciphers and on DESFire tag for specific smartphones applications. In [START_REF] Jara | Drugs interaction checker based on iot[END_REF], the focus is on IoT with the use of NFC to ensure compatibility between drugs. Finally, in 2011, they published [START_REF] Jara | An internet of things-based personal device for diabetes therapy management in ambient assisted living (aal)[END_REF] a very interesting journal article where a system for diabetes therapy management has been proposed. This system defines a solution for a secure therapeutic monitoring based on a personal health NFC card of the patient.

Garcia and Bravo [START_REF] García-Vázquez | Supporting the strategies to improve elders' medication compliance by providing ambient aids[END_REF] proposed in 2011 a solution to assist the intake of medication for elderly people with cognitive disabilities. The objective of the system is to remind, guide and motivate the person to take his medication. NFC technology is used as a carrier to help identify boxes of drug.

In [START_REF] Bravo | Tagging for nursing care[END_REF][START_REF] Bravo | Enabling nfc technology to support activities in an alzheimer's day center[END_REF] Bravo and al. use NFC technology to assist people with Alzheimer's disease in their daily lives. It is based on tags that are embedded in the environment of the person enabling him to be guided and assisted thanks to a NFC smartphone.

Finally, the work of Lahtela [START_REF] Lahtela | Rfid and nfc in healthcare: Safety of hospitals medication care[END_REF] deals with a secure mechanism for the use of medications in a hospital environment. With NFC technology identification, the proposed system can reduce human errors in medication.

The closest work with our solution has been proposed by Vergara and al. [START_REF] Vergara | Mobile prescription: An nfc-based proposal for aal[END_REF]. In this work, the authors provide a mobile prescribing solution using a smartphone with interaction between the medical doctor and drug boxes. However, it does not consider the process as a whole (patient, doctor, pharmacist, drug manufacturer). Moreover, the security of exchanged data is not taken into consideration neither is the traceability of exchanged documents with NFC.

It can also be noted that Garcia and Bravo [START_REF] García-Vázquez | Supporting the strategies to improve elders' medication compliance by providing ambient aids[END_REF] project which supports strategies to improve the treatment compliance of elderly with ambient intelligent systems could be coupled with our own support and control system of e-prescribing and drug intake solution to have a complete system dedicated to the elderly with cognitive disabilities resulting from Alzheimer or Parkinson disease as well as people with head trauma.

Security issues : Although the NFC communication range is limited to a few centimeters, it is not enough to ensure security. Indeed, three safety axis for NFC are to ensure: (1) Security of mobiles (NFC devices and applications); (2) Safety of the communication channel; (3) System Security (reader and tag).

Mifare Classic cards are one of the most popular solution with more than 200 million copies worldwide. These inexpensive cards implement the symmetric security algorithm Crypto-1 whose vulnerability was demonstrated in 2009 by Garcia [START_REF] Garcia | Wirelessly pickpocketing a mifare classic card[END_REF]. He showed four possible attacks on this kind of card. The most significant result is the attack of the secret key in less than a second. Courtois [START_REF] Courtois | The dark side of security by obscurity -and cloning mifare classic rail and building passes, anywhere, anytime[END_REF] has also shown how to clone this type of card in 1 second. With such a low time rate, the spoofing of an ID tag can be easily done for instance.

In 2006, Hancke [START_REF] Hancke | Practical attacks on proximity identification systems[END_REF] proposed relay attack on an RFID system (tag/reader). In 2010, Francis et al. [START_REF] Francis | Practical nfc peer-to-peer relay attack using mobile phones[END_REF] showed the feasibility of this same relay attack between NFC smartphones. They proposed the use of an information system based on the mobile devices location coupled with a digital signature to counter this attack.

Madlmayr et al. [START_REF] Madlmayr | Nfc devices: Security and privacy[END_REF] studied the security and the confidentiality of NFC devices. They call for the integration in applications of encryption and authentication mechanisms not only of terminals but also of people. More recently Roland [START_REF] Roland | Digital signature records for the nfc data exchange format[END_REF] in 2010 proposes in his paper a digital signature records for NDEF NFC layer to ensure messages integrity and authenticity. In other works, Francis et al. [START_REF] Francis | A security framework model with communication protocol translator interface for enhancing nfc transactions[END_REF] offer a Security applications Framework for e-identification, e-payment and e-ticketing with NFC reader/tag mode. This framework offers a CPTI (Communication Protocol Translator Interface) protocol for secure P2P transactions with token between terminal and cards. It is based on an asymmetric encryption mechanism and digital signature.

In addition, commonly known threats to the NFC security [START_REF] Jovanovic | Analysis of the latest trends in mobile commerce using the nfc technology[END_REF] are: (1) Eavesdropping, where a third party can receive a signal using an antenna. (2) Unwanted activation, which is somewhat similar to eavesdropping. Third party attacker tries to activate the card without the owner's knowledge; (3) Data Corruption, or modification of transmitted data using an NFC device working with the valid frequency; (4) Data Modification, where the attacker is sending valid, but altered data to the receiving NFC device; (5) Data Insertion, where attacker tries to insert a new message into a NFC communication; (6) Manin-The-Middle-Attack, where two parties who want to establish communication are tricked into communicating with or via the third party which is therefore enabled to record the entire conversation; (7) Denial of service, where the attacker tries to interfere with the RF field, in order to prevent the transaction. Also, Haselsteiner and BreitfuB [START_REF] Haselsteiner | Security in near eld communication (nfc)[END_REF] show multiple attacks against NFC-based systems that rely on the lack of link level security of the NFC technology.

NFC Security standard ISO/IEC 13157

NFC (Near Field Communication) data exchanges pose a security problem that the International Standard ISO/IEC 13157 published in June 2010 addresses. It consists of two parts: 'NFC-SEC: NFCIP-1 security services and protocol' [START_REF]Information technology -Telecommunications and information exchange between systems -NFC Security -Part 1: NFC-SEC NFCIP-1 security services and protocol[END_REF] and 'NFC-SEC cryptography standard using ECDH and AES' [START_REF]Information technology -Telecommunications and information exchange between systems -NFC Security -Part 2: NFC-SEC cryptography standard using ECDH and AES[END_REF]. This NFC-SEC cryptography Standard specifies cryptographic mechanisms based on the Elliptic Curves Diffie-Hellman (ECDH) protocol for key agreement and the AES algorithm for data encryption and integrity.

This standard enables the encryption of exchanged data based on a symmetric algorithm where the shared secret is generated from digital certificates of the communicating entities. This process can be split in four steps as depicted as in Figure 2.

-Step 1: Key agreement: enables the establishment of the shared secret (z) from the derivation of a part of the private key of the transmitter and derivation a part of the receiver's public key. It begins with the generation of an Elliptic Curve (EC) Key Pair and the validation of the EC public key. Each NFC-SEC entity generates a random nonce (N ) which will be used to provide more entropy for the keys derivation. N is then concatenated ( ) with the EC public key (Q) and the result is sent to the other entity (Fig. 3). z is then computed by the ECDH derivation Primitive [START_REF]Standard Specifications for Public-Key Cryptography[END_REF] from the user's private key and the public key of the other entity.

With the properties defined in Table 1, two Key Derivation Functions (KDF) are specified; one for the Shared Secret Service (SSE) and one for the Secure Channel Service (SCH). 1. SSE establishes a shared secret M K SSE between two NFC-SEC entities. This secret must be cryptographically uncorrelated from any shared secrets established beforehand or afterwards (Fig. 3);

M K SSE = KDF SSE (N S , N R , z, ID S , ID R ) (1)
2. SCH provides a secure channel between two NFC-SEC entities with link keys M K SCH , KE SCH , KI SCH , and subsequently protect all communications in both direction across the channel.

{M K SCH , KE SCH , KI SSH } = KDF SCH (N S , N R , z, ID S , ID R ) (2)
The data must be encrypted or decrypted using the symmetric encryption key KE SCH : EncData = EN C KE SCH (Data) (4)

Data = DEC KE SCH (EncData) (5)
(c) Integrity of all encrypted data transferred on the SCH is preserved through a MAC (Message Authentication Code) (i.e a fingerprint) generated with the symmetric key KI SCH and the AES algorithm. -Step 4: Finally, The NFC-SEC entities terminate SSE and SCH and destroy the associated shared secret and the link keys. Indeed, the M K SSE , M K SCH , KE SCH and KI SCH keys must be different for every NFC-SEC transaction.

More details on the standard can be found in [START_REF]Information technology -Telecommunications and information exchange between systems -NFC Security -Part 2: NFC-SEC cryptography standard using ECDH and AES[END_REF]. NFC communication is done via an insecure channel. NFC tags can be read and legitimate transactions with readers can be heard by a third party attacker. Therefore, we need to protect privacy, personal devices, and exchanged data to prevent eavesdropping and ensure trust between the patient, the doctor and the pharmacist. As a result, establishing a secure channel between two NFC devices is clearly the best approach to protect against eavesdropping and any kind of data modification attack.

PROPOSED SECURE AND TRUST ARCHITECTURE

We propose the use of NFC-SEC to ensure security communication. The confidentiality and integrity are ensured by the symmetric keys M K SCH , KE SCH and KI SCH that are derived from equation ( 2) and used in equations ( 4) and ( 5) and by the MAC computed from equation ( 3). This is ensured because if the attacker can find N A , N B , ID A and ID B , he still can't find the shared secret z. Indeed, the shared secret z is calculated from a user's private key and the public key of the other. Without the private key, the attacker can't reverse the process.

NFC-SEC enables two NFC devices in Peer-to-Peer mode to establish a secure channel but does not provide all requested security features.

Firstly, NFC-SEC standard does not provide authentication [START_REF] Alshehri | Formal security analysis of nfc m-coupon protocols using casper/fdr[END_REF] mechanisms which is a strong weakness to fight against Man-In-The-Middle attacks as demonstrated by Haselsteiner and al. [START_REF] Haselsteiner | Security in near eld communication (nfc)[END_REF].

Secondly, doctor or pharmacist or patient must not be able to deny that they exchanged information at some point (to respect non-repudiation). In addition, 'e-Rx ' must not be modified by an attacker when exchanged or stored in the patient smartphone (to respect integrity). Thus, when the patient goes to the pharmacy, the pharmacist must ensure that the received 'e-Rx ' is not altered and is delivered by a doctor. Therefore, any data exchanged between users has to be signed.

As previously, stated NFC-SEC does not provide functionality to sign the exchanged nor stored data failing to ensure authentication and non-repudiation.

Proposed trust architecture

To deal with this problem, we proposed to use a digital signature (e-signature) to sign every exchanged of e-Rx at communication time. This method ensures a trust between the different parts of the communication due to the reliability of the signature checks, authentication and authorization required for both receiver and sender. It insures integrity of data, easily traces transactions between parties, and insures that any actor can not deny that he sends a signed information.

The e-signature relies on the utilization of a public-private key pair with a hash function. First, the sender uses the hash function to calculate a footprint of data to be signed. He uses the private key to encrypt (i.e. sign) this footprint. Then, he sends the message containing the clear data and the signature to the receiver. Upon receiving this message, the receiver decrypts the signed footprint using the public key of the sender. He calculates the footprint of the clear data with the hash function and compares the result with the decrypted footprint. If they are equals then the receiver is sure that the data were not altered (integrity) during the communication and that the sender is who he claims to be (nonrepudiation). Public Key Infrastructure (PKI) We propose a PKI (Fig. 5) to deliver e-signatures. This PKI is composed of the following equipments:

1. A root Certification Authority (AC root) that self-generates its own certificate (key pair). 2. Two secondary certification authorities (AC sec) which could be integrated into the social security system: -The ASIP santé (section 2.3) which delivers certificates for CPS user and which already exists.

-An authority that distributes electronic certificates to patients. 3. A directory to manage valid and usable public keys and those which are on the CRL (Certificate Revocation List). 4. A Web server is used for:

a) The reception of a request for a certificate from the user, and its sending to the secondary authority. b) Sending a certificate received from the secondary authority to the user with the addition of the public key in the directory. c) Receiving information (public key, identifier...) sent by a user to check :

-If a public key is on the CRL or is under use -If it is signed by the secondary authority, and if the authority's public key is signed by the root authority. d) Sending a user public key based on the request of another user. e) The return of the verification results.

These authorities distribute signing certificates (C sig pat , C sig doc , C sig pha ) for (patient, physician, pharmacist) that contains actor key pair (K pub sigpat / K pri sigpat , K pub sig doc / K pri sig doc , K pub sig pha / K pri sig pha ).

These certificates are stored as follow: For the doctor and pharmacist, they are stored on the CPS card. While for the patient, they are stored in the smartphone. Note that we could store the patient certificates in 'Carte Vitale 2 ' if the cryptography functionalities were activated.

Authentication. At the beginning of a NFC communication, N and Q are exchanged among peers to generate the shared secret z in order to establish the secure channel. Therefore, to avoid the classical threat in unauthenticated key agreement protocols and to insure authentication between different entities before establishing a secure channel, we propose to use e-signatures (Fig. 6). First, each entity generates N then signs the concatenation of N and Q and append the resulting e-signature to the data to transmit. Next, each entity sends the result to the other for verification. Finally, if there were no alteration during the communication (verification of the fingerprint and of the e-signature), they compute the shared secret z and establish a secure and trust channel.

Trust exchange and data storage. Next, the patient is going to exchange and store the signed data such as 'e-Rx '. Therefore, we propose to sign these data first and then send them in a secured manner with NFC-SEC (Fig. 7). After signing the 'data', we obtain 'SigData'. Then, we encrypt 'SigData' using the NFC-SEC encryption protocol and we obtain 'EncSigData'. Finally, we apply the M AC on information and send them to the receiver using NFC-SEC. Finally at the reception, by applying the protocol NFC-SEC, we obtain the initial signed data 'SigData' that can be verified or stored for a later check.

CONCLUSION

In this paper, we have presented a new system based on e-Rx to assist people with their daily medication intakes. This system relies on the NFC technology which has been enhanced to provide all requirements for a secure healthcare application (among which is confidentiality, authentication and non-repudiation). We have proposed an extension of the NFC-SEC standard to support electronic signature in order to authenticate and to ensure the non-repudiation every exchanged data. This extension relies on a PKI which can be seamlessly integrated in the existing French e-health system to deliver electronic certificate to every actors.

At the time of writing, an Android prototype has been developed and it is planned in future works to evaluate the impact of the e-signature extension on the communication process in terms of energy consumption, bandwidth and delays and to compare it with the NDEF e-signature mechanism. Finally, we are planning to extend our proposition to enable a e-signature support in reader tag communication in order to strengthen security in the communication between user and drug box.

Fig. 1 .

 1 Fig. 1. Global system architecture

-Step 2 :

 2 Key confirmation: Both NFC-SEC entities check that they indeed share the same key. Each entity generates a key confirmation tag (MacTag) based on a Message Authentication Code (MAC) and sends it to the other entity. Both then verify the key confirmation tag upon reception. -Step 3: PDU security: The NFC-SEC entities (Fig. 4) protect data exchange using encryption. This mechanism involves (a) Sequence Integrity, (b) Confidentiality and Origin authentication and (c) Data integrity. No signature mechanism of packets is supported in the standard. (a) NFC-SEC provides a sequence integrity mechanism in accordance with the

Fig. 2 .

 2 Fig. 2. General flow of the NFC-SEC services

Fig. 3 .

 3 Fig. 3. MSC of establishing of a shared secret M KSSE

4. 1 AFig. 4 .

 14 Fig. 4. MSC of data security exchange

Fig. 5 .

 5 Fig. 5. Architecture of Public Key Infrastructure

Fig. 6 .

 6 Fig. 6. MSC of authentication entities before communication.

Fig. 7 .

 7 Fig. 7. MSC of trust exchange and data storage.

Table 1 .

 1 Cryptographic properties of standard NFC 13157

	Actions	Algorithms
	Key agreement	ECDH P-192, IEEE 1363 and FIPS 186-3
	Key Derivation Fonction AES-XCBC-PRF-128, RFC 4434 (IPSEC v2)
	Key confirmation	AES-XCBC-MAC-96, RFC 3566 (IPSEC v2)
	Encryption	AES-128-CTR, IV init: AES-XCBC-PRF-128
	Integrity	AES-XCBC-MAC-96