A smart-card-based user authentication scheme for wireless sensor networks(hereafter referred to as a SCA-WSN scheme) is designed to ensure that onlyusers who possess both a smart card and the corresponding password are allowedto gain access to sensor data and their transmissions. Despite many researchefforts in recent years, it remains a challenging task to design an efficientSCA-WSN scheme that achieves user anonymity. The majority of published SCA-WSNschemes use only lightweight cryptographic techniques (rather than public-keycryptographic techniques) for the sake of efficiency, and have been demonstratedto suffer from the inability to provide user anonymity. Some schemes employelliptic curve cryptography for better security but require sensors with strictresource constraints to perform computationally expensive scalar-pointmultiplications; despite the increased computational requirements, these schemesdo not provide user anonymity. In this paper, we present a new SCA-WSN schemethat not only achieves user anonymity but also is efficient in terms of thecomputation loads for sensors. Our scheme employs elliptic curve cryptographybut restricts its use only to anonymous user-to-gateway authentication, therebyallowing sensors to perform only lightweight cryptographic operations. Ourscheme also enjoys provable security in a formal model extended from the widelyaccepted Bellare-Pointcheval-Rogaway (2000) model to capture the user anonymityproperty and various SCA-WSN specific attacks . Since sensors have severe resourceconstraints and due to network characteristics such as unattended operation andunreliable communication channel, authenticated key exchange in WSNs is generallyregarded as more challenging to achieve than in traditional networks with sufficientcomputing resources and pre-existing infrastructures. Achieving authenticated keyexchange becomes even more difficult when user anonymity is desired. As the concernfor privacy increases in our lives, user anonymity has become a vital securityproperty in various WSN applications as well as in many other applications likelocation-based services, e-voting, mobile roaming services, and anonymous webbrowsing.The quest to understand real-world phenomena at a fine spatial-temporal resolutionhas led to a great increase in the interest in wireless sensor networks (WSNs).Where not already in place, a WSN is now being planned and deployed in variousapplication settings such as wildlife monitoring, military surveillance, healthcarediagnostics, and vehicular tracking . Providisca-wsnscheme) allows a user holding its smart card issued by the gateway to achieveauthenticated key exchange with a sensor, preferably in a way that its anonymity ispreserved. Since the early work of Das [sca-wsn schemes has attracted much attentionfrom researchers due to their potential to be widely deployed, and a number ofproposals offering various levels of security and efficiency have been presented[A smart-card-based user authentication scheme for WSNs  and access the sensor data. This requirement is commonly referred to as two-factorsecurity [stolen smart card attack and is consideredpractical under the assumption that users’ smart cards arenon-tamper-resistant. Accordingly, sca-wsn schemes should be designed toachieve their intended security properties, such as authenticated key exchange anduser anonymity, against stolen smart card attacks.One common security requirement for security –25 andisecurity ,27 on tsca-wsn scheme that provides user anonymity. The recent work ofWang and Wang [sca-wsn scheme canprovide user anonymity without recourse to public key cryptography. This result issomewhat surprising because it implies that all existing anonymous schemes usingonly lightweight cryptographic techniques [sca-wsn scheme of Jiang et al.[MK be the master key of the gateway GW, andH be a cryptographic hash function. Then, the two phasesproceed as follow:Despite the many research efforts to date, it remains a challenging task to design anefficient and Wang , 29 showchniques , 13–19 fUser Registration. A user U registers withGW as follows: U chooses its identityIDU andpassword PWU,generates a random number r, computesRPWU =H(r‖PWU),and submits IDU andRPWU toGW via a secure channel.IDU is valid,GW generates a temporary identity forU,TIDU, andcomputes TCU =H(MK‖IDU‖TEU)and PTCU =TCU⊕RPWU,where TEU is theexpiration time ofTIDU.GW then stores in itsverification table, and issues U a smart cardcontaining {H(⋅),TIDU,TEU,PTCU}.If U stores the random number rinto the smart card, which then holds{H(⋅),TIDU,TEU,PTCU,r}.Login Request. U inserts its smart card into acard reader, and inputs IDU andPWU. The smart cardretrieves the current timestampTU, selects a random keyKU, and computesTCU =PTCU⊕H(r‖PWU),PKSU =KU⊕H(TCU‖TU)and CU =H(IDU‖KU‖TCU‖TU).Then, U sends the login request messageMU =⟨TIDU,CU,PKSU,TU⟩ toGW.A who has obtained the information{H(⋅),TIDU,TEU,PTCU, r}stored on the smart card of user U. A eavesdropsand obtains the login request messageMU =⟨TIDU,CU,PKSU,TU⟩, and mounts thefollowing offline dictionary attack.Assume an attacker Step 1. A makes a guess PWU and computesStep 2. For each possible identity A computesCU. Note that, with anoverwhelming probability, Step 3. A repeats Steps 1 and 2 until thecorrect password and identity are found.This dictionary attack works because the identity space is very limited in practice,being usually even smaller than the password space , 29. Allsca-wsn schemethat requires sensors to perform only lightweight cryptographic operations. Ourscheme employs elliptic curve cryptography but restricts its use to anonymoususer-to-gateway authentication in order not to impose any (expensive) public-keyoperations, such as scalar-point multiplications and map-to-point operations, onsensors. We formally prove that our scheme achieves user anonymity as well asauthenticated key exchange in an extension of the widely accepted model of Bellareet al. [sca-wsn schemes like nodecapture attacks, privileged insider attacks, and stolen verifier attacks.In this paper, we present an efficient and provably-anonymous eet al. . In provsca-wsn schemes. Section 3presents our proposed sca-wsn scheme along with cryptographic primitives onwhich the security of the scheme relies. Section 4 provides proofs for the securityproperties of our proposed scheme in the extended security model. Section 5concludes the paper with a comparative efficiency and security of our scheme andother sca-wsn schemes.The remainder of this paper is structured as follows. Section 2 describes an extendedsecurity model for the analysis of anonymous sca-wsn schemes. Oursecurity model captures the notion of two-factor security as well as the resistanceto node capture attacks, privileged insider attacks, stolen verifier attacks, andother common attacks. We provide two security definitions associated with the model,one for authenticated key exchange and one for user anonymity, which collectivelydefine a secure, anonymous sca-wsn scheme.This section describes a security model extended from the Bellare et al.’smodel  to analyGW. Let 𝓔 =𝓤∪𝒮𝓝∪{GW}. Weidentify each entity E ∈ 𝓔 by a string, andinterchangeably use E andIDE to refer to thisidentifier string. To formally capture the user anonymity property, we assumethat: (1) each user U ∈ 𝓤 has its pseudoidentity PIDU in addition to thetrue identity IDU and (2) theadversary 𝓐 is given onlyPIDU but notIDU.Let 𝓢𝓝 and 𝓤 be the sets of all sensors and users,respectively, registered with the gateway U ∈ may run multiple sessions of theauthentication and key exchange protocol of a sca-wsn scheme, eitherserially or concurrently, to establish a session key with a sensorSN ∈ 𝒮𝓝 via assistance of thegateway GW. Therefore, at any given time, there could bemultiple instances of the entities U, SN andGW. We use i of entityE ∈ 𝓔. Instances of U andSN are said to accept when they compute asession key in an execution of the protocol. We denote the session key ofA user U ∈ 𝓤 chooses its passwordPWU from a fixeddictionary 𝒟, andeach GW generates its master secret(s), issues a smartcard to each U ∈ 𝓤, and shares acryptographic key with each SN ∈𝒮𝓝.During the initialization of the protocol, partners of each otherif they participate together in the same protocol session and as a result,compute the same session key. Formally, partnering between instances is definedin terms of the notion of session identifier. A session identifier(sid) is an identifier of a protocol session and istypically defined as a function of the messages exchanged in the session. Letsid of instanceInformally, two instances are said to be ppt) in the security parameterκ, which represents the bit-length of session keys.We note that the size of the dictionary 𝒟 is a fixed constant that isindependent of the security parameter κ. Theppt adversary 𝓐 has complete control of all communicationsbetween entities, can request for access to session keys and long-term keys, andcan extract user’s information stored on the smart card. Thesecapabilities of 𝓐 are modeled via the following oracle queries which areallowed for 𝓐 to make.We assume there exists an adversary 𝓐 running in a probabilisticpolynomial time  prompts SN and GW.U while the latter returns the information storedin the smart card of U.SN): This queryreturns the long-lived secret(s) of the sensor SN,modelling node capture attacks.GW), modellingprivileged insider attacks.GW): This queryreturns the password verifiers stored by GW, modellingstolen verifier attacks.b chosen by the oracle, 𝓐 is giveneither the real session key b = 1 or a randomkey drawn from the session-key space if b = 0.U): This query is usedfor determining whether the protocol provides user anonymity or not.Depending on a randomly chosen bit b, 𝓐 isgiven either the identity actually used for U in theprotocol sessions (when b = 1) or a random identitydrawn from the identity space (when b = 0).SN and GW are said tobe corrupted when they are asked a U is considered ascorrupted if it has been asked both P is defined via the notion of freshness.Intuitively, a fresh instance is one that holds a session key which should notbe known to the adversary 𝓐, and an unfresh instance is one whosesession key (or some information about the key) can be known by trivial means. Aformal definition of freshness follows:The AKE security of an authentication and key exchange protocolDefinition 1 (Freshness). An instanceis fresh if none of the following occurs: queriesorwhereis the partner of𝓐 queries bothandwhenU is E itself or the peer entity of E.𝓐 querieswhen SN is E itself or the peer entity of E.𝓐 queries𝓐 P is defined in the context of thefollowing two-stage experiment:Note that this definition of freshness is unable to capture the notion of perfectforward secrecy.  TheAKE security of protocol ExpAKE0: 𝓐 is not allowed to make the 𝓐 is not allowed to make the 𝓐 is not allowed to access to the Stage 1. 𝓐 makes any oracle queries at will, except that:b′ as a guess on the hiddenbit b chosen by the b =b′.Stage 2. Once 𝓐 decides that Stage 1 is over, it outputs abit Experiment ExpAKE0, and P. Then, we define Let Definition 2 (AKE Security). An authentication and keyexchange protocol P is AKE-secure ifis negligible for anypptadversary 𝓐.An authentication and key exchange protocol that does not provide user anonymitymay still be rendered AKE-secure. That is, the AKE security does not imply useranonymity. Therefore, a new, separate definition is necessary to capture theuser anonymity property. Our definition of user anonymity is based on the notionof cleanness.Definition 3 (Cleanness). A user U ∈𝓤 is clean if none of the followingoccurs: queries bothand𝓐 queries𝓐 Note that the definition of cleanness does not impose any restriction on makingUser anonymity is formalized in the context of the following two-stageexperiment:ExpUA0: U)query if the user U is not clean.𝓐 is not allowed to make the GWand U if it has already made the𝓐 is not allowed to corrupt 𝓐 is not allowed to access to the Stage 1. 𝓐 makes any oracle queries at will, except that:b′ as a guess on the hiddenbit b chosen by the b =b′.Stage 2. Once 𝓐 decides that Stage 1 is over, it outputs abit Experiment ExpUA0, and P. Then, we defineLet Definition 4 (User Anonymity). An authentication and keyexchange protocol P provides user anonymity ifis negligible for anypptadversary 𝓐.sca-wsn scheme restricts the use of elliptic curve cryptography toanonymous user-to-gateway authentication and thereby allows sensor nodes to performonly lightweight cryptographic operations such as symmetric encryption/decryption,MAC generation/verification, and hash function evaluation. We begin by describingthe cryptographic building blocks on which the security of our scheme depends.Our q.Typically, 𝔾 will be a subgroup of the group of points on anelliptic curve over a finite field. Any elliptic curve and finite fieldrecommended by NIST [P be a generator of 𝔾. The ECCDHproblem for 𝔾 is to compute xyP ∈ 𝔾when given two elements  ∈𝔾2, where pptalgorithms 𝓐 . Wedenote by t.Let 𝔾 be an elliptic curve group of prime order  by NIST  can be u by NIST , for exak and a message m, and outputs a MACσ; and (2) the MAC verification algorithmk, amessage m, and a MAC σ, and outputs1 if σ is valid for message m underthe key k or outputs 0 if σ isinvalid. We require that Σ should achieve the strong existentialunforgeability against chosen message attacks. To formally define thisrequirement, let m, σ) such that: (1)σ has notbeen output by the oracle m.The, we say that the MAC scheme Σ is secure if pptadversary 𝓐. We use t.A message authentication code (MAC) scheme Σ is a pair of efficientalgorithms . Then, our scheme usesthree cryptographic hash functions H:{0, 1}*→ {0, 1}κ, J:{0,1}* → {0, 1}ℓ, and I:{0,1}* → {0, 1}ω. These hashfunctions are modelled as random oracles in our security proofs.Let k and a plaintext message m, andoutputs a ciphertext c; and (2) the decryption algorithmk anda ciphertext c, and outputs a message m.For an eavesdropping adversary 𝓐 against Δ, and for aninteger n ≥ 1 and a random bit b∈ R{0, 1}, consider the followingindistinguishability experiment where only a single encryption key isused:A symmetric encryption scheme Δ is a pair of efficient algorithms ←𝓐(Δ)     (     ic)     𝓐← 𝓐(Δ)          ci,j)     𝓐 is different from ci,jis set as follows: n ciphertextscξ,1, …,cξ,nfrom encryptions of the first plaintexts to encryptions of the secondplaintexts. Since there are d such moves fromξ ≤d, ξ who attacks theindistinguishability of Δ in ɛ.argument . Consideξ begins by invoking adversary𝓐, then proceeds to simulate the indistinguishability experiment for𝓐, and finally ends by outputting whatever bit 𝓐 eventuallyoutputs. In the simulated experiment,𝓐ξ generates theciphertexts exactly as in the hybrid experiment cξ,1, …,cξ,nas follows: n plaintext pairs,…,,𝓐ξ outputs themas its own plaintext pairs in experiment c1, …,cn, and setscξ,1 =c1, …,cξ,n= cn.When 𝓐 outputs the 𝓐ξ outputs 1 whenthe given ciphertexts are the encryptions of the firstplaintexts is equal to the probability that 𝓐 outputs 1in the experiment the probability that𝓐ξ outputs 1 whenthe given ciphertexts are the encryptions of the secondplaintexts is equal to the probability that 𝓐 outputs 1in the experiment the probability that𝓐Then, it follows that: ξ has time complexityt, it follows that That is: GW determines the following publicparameters: (1) an elliptic curve group 𝔾 with a generatorP of prime order q, (2) a MAC schemeH, J and I. We assumethat these parameters are known to all parties in the network including theadversary 𝓐. As part of the system initialization, GWchooses two master secrets z ∈ {0,1}ℓ, computes its public key Y =yP, and shares a secret keykGS =J(IDSN‖z)with each sensor SN.The scheme consists of three phases: the registration phase, the authenticationand key exchange phase, and the password update phase. During the systeminitialization, the gateway U should register itself with the gatewayGW before it can ever gain access to the sensor networkand data. The registration proceeds as follows: U chooses its identityIDU andpassword PWU atwill, and submits the identityIDU toGW via a secure channel.GW computes U asmart card loaded with{EIDU,Y,IDGW,𝔾, P, Σ, Δ,H, J, I}.(We assume that q is implicit in𝔾.)U replacesEIDU withXEIDU =EIDU⊕I(IDU‖PWU).A user U needs to perform this phase with SN andGW whenever it wishes to access to the sensor networkand data. The steps of the phase are depicted in Step 1. U inserts its smart cardinto a card reader and inputs its identityIDU andpassword PWU. Then,the smart card retrieves the current timestampTU, selects tworandom kUS∈ {0, 1}κ, andcomputes M1 =⟨TU,IDSN,X,CU,σU⟩to the gateway GW.Step 2. GW rejects the messageM1 (and aborts the session) ifTU is notfresh. Otherwise, GW computesKUG =yX andkUG =J(TU‖X‖Y‖KUG),and checks if TU‖CU,σU)= 1. If the check fails, GW aborts the session.Otherwise, GW decryptsCU with keykUG and thenEIDU with keyz, and checks if the decryption ofEIDU yields thesame IDU asproduced through the decryption ofCU. If onlythe two IDs match, GW retrieves the currenttimestamp TGW,computes M2 =⟨IDGW,TGW,TU,CGW,σGW⟩to the sensor SN.Step 3. Upon receivingM2, SN verifiesthat (1) TGW isfresh and (2) TU‖CGW,σGW)= 1. If any of the verifications fails, SNaborts the session. Otherwise, SN decryptsCGW to obtainkUS andcomputes the session key sk and theauthenticatorρSN asfollows: SNsends the message M3 =⟨ρSN⟩to the user U.Step 4. With M3 in hand,U checks ifρSNis equal toH(kUS‖IDSN‖TU).U aborts the session if the check fails orotherwise computes the session key sk =H(kUS‖TU‖IDSN).U inserts his smart card into a card reader andenters the identityIDU, thecurrent passwordPWU, and thenew password XEIDU withThe smart card computes One of the recommended guidelines for achieving better password security isto enforce regular password updates. In our scheme, users can change theirpasswords either non-interactively or interactively. The non-interactivepassword change procedure proceeds as follows: Although this procedure is simple and non-interactive, it may render thesmart card unusable if the user enters a wrong password by mistake or anadversary intentionally inputs an arbitrary password after gaining temporaryaccess to the smart card. When an invalid password is entered, subsequentlogin requests of the user will be rejected unless it reregisters with thegateway. This problem can be addressed by storing a password verifier on thesmart card, which is used to check the correctness of the user-givenpassword. However, as soon as the smart card contains a password verifier,the scheme becomes vulnerable to an offline dictionary attack under thenon-tamper-resistance assumption of smart cards and, consequently, fails toachieve two-factor security. This is clearly unacceptable and, therefore, wesuggest the following interactive password change procedure.U inserts his smart card into a card reader andenters the identityIDU, the currentpassword PWU, and thenew password TU, selects arandom TU,X,CU⟩to the gateway GW.The smart card retrieves the current timestampGW rejects the request ifTU is notfresh. Otherwise, GW computesKUG =yX andkUG =J(TU‖X‖Y‖KUG),decrypts CU with keykUG and thenEIDU with keyz, and checks whether the two decryptionsreturn the same IDU. Ifthe check succeeds, GW computesρGW =H(IDGW‖IDU‖X‖kUG)and sends it to the smart card. Otherwise, GW sendsa failure message to the smart card.ρGW is notequal toH(IDGW‖IDU‖X‖kUG).Otherwise, it sets The smart card aborts the password change procedure if it receives afailure message orThis interactive password change procedure provides a secure yet practicalway of updating user password, though it is more expensive than thenon-interactive one.sca-wsn schemes bothin terms of computation and security. As shown in the table, our scheme requiresthe sensor SN to perform only lightweight cryptographicoperations while enjoying provable anonymity in an extension of the widelyaccepted model of Bellare et al. [SN. Note that scalar-pointmultiplication is much more expensive than the lightweight cryptographicoperations considered in the table, such as symmetric encryption/decryption, MACgeneration/verification, and hash function evaluation. Moreover, these twoschemes fail to achieve user anonymity despite their use of elliptic curvecryptography. The schemes presented in [sca-wsn schemes fall into one of the twoclasses.In e et al. . While te et al.  andChoie et al.  provideented in , 13–19 ahttp://www.cryptopp.com/benchmarks.html for Crypto++ benchmarksfor commonly used cryptographic algorithms.According to Crypto++ 5.6.0 benchmarks that ran on an Intel Core 2 1.83 GHzprocessor under Windows Vista in 32-bit mode, SHA-1 and HMAC take 11.4 and 11.9cycles per byte respectively; while AES (with 128-bit key) takes 12.6 to 16.9cycles per byte, depending on the operation mode used—see SN to perform1E+1A+2H operations whichamount to about 4.5H operations. Therefore, in terms ofcomputational requirements for SN, our scheme is comparablewith other sca-wsn schemes [SN to performonly 2 hash function evaluations, these schemes do not achieve user anonymityand are vulnerable to a stolen smart card attack. Under thenon-tamper-resistance assumption of smart cards, our scheme is the only one thatprovides user anonymity and resists stolen smart card attacks.Our scheme requires the sensor  schemes , 18, 19  schemes  and Kim  schemes  require sca-wsn specific attacks  as well asother common attacks  [sca-wsnspecific attacks.We now prove that the authentication and key exchange protocol of our scheme isAKE-secure (in the sense of Definition 2) and provides user anonymity (in the senseof Definition 4). Recall that the security model described in Section 2 capturesvarious attacks) , 25, 34.Stolen smart card attacks. Our scheme does not require apassword verifier to be stored on the smart card of user U.Moreover, even if an adversary managed to obtain the ciphertextCU as a password verifiersince, under the ECCDH assumption, it is infeasible to computekUG =J(TU‖X‖Y‖KUG)from X and Y. Thus, our scheme isresistant against stolen smart card attacks.Node capture attacks. In our scheme, each sensor nodeSN holds its individual secret keykGS =J(IDSN‖z)which is shared only with the gateway GW. In other words,different sensor nodes have different secret keys (with an overwhelmingprobability). Thus, the secret keykGS obtained bycapturing a sensor node SN will be of no use inimpersonating another sensor node SN′ whoholds a secret key other thankGS. Therefore, nodecapture attacks are not possible against our scheme.Privileged insider attacks. A privileged insider attack occurswhen the gateway administrator can access a user’s password toimpersonate the user. In our scheme, the gateway GWreceives no password-related information from the user Uand does not manage any table for storing such information. It is thus clearthat privileged insider attacks cannot be mounted against our scheme.Stolen verifier attacks. In a stolen verifier attack, theadversary attempts to impersonate a legitimate user by stealing theuser’s password verifier stored on the gateway GW.However, in our scheme, GW does not store a passwordverifier of any kind but stores only two master secrets yand z which are selected independently of user passwords.Hence, our scheme is secure against stolen verifier attacks.Theorem 1. Our authentication and key exchange protocol, P,provides user anonymity in the random oracle model under the ECCDHassumption in 𝔾 and the security of the symmetricencryption scheme Δ.Proof. Let 𝓐 be a ppt adversary against theuser anonymity property of protocol P. We prove the theorem bymaking a series of modifications to the original experimentExpUA0, bounding the difference in the successprobability of 𝓐 between two consecutive experiments, and ending up withan experiment where 𝓐 has a success probability of 1/2 . Let b chosen by the ExpUAi. Let ExpUAi involving theadversary 𝓐.Experiment ExpUA1. In this experiment, we simulate therandom oracle J as follows:J oracle: For each J query ona string str, the simulator first checks if an entry of theform  is in a list called JList whichcontains all the input-output pairs of J. If such an entryexists in JList, the simulator returns j as the output of theJ query. Otherwise, the simulator chooses a randomℓ-bit string j′, returnsj′ in response to the query, and adds theentry  to JList.Simulation of the ExpUA0. Then,ExpUA1 is perfectly indistinguishable fromExpUA0 and therefore, Claim 1 holds.For all other oracle queries of 𝓐, the simulator answers them as in theoriginal experiment Claim 1. Experiment ExpUA2. Here, we modify the experiment so thatX is computed as follows:ExpUA2 modification:The A =aP.The simulator chooses a random exponent X =rA.For each user instance, the simulator chooses a random KUG is set torayP for some random ExpUA2 and ExpUA1, itfollows that:As a result of the modification, eachClaim 2. Experiment ExpUA3. We next modify the computations ofX and Y as follows:ExpUA3 modification:The A,B ∈ 𝔾 and sets Y =B.The simulator chooses two random elements X =rA. For other instances, the simulator computesX as in experimentExpUA2.For each instance of clean users, the simulator chooses a randomkUG to a randomℓ-bit string. For other instances, the simulator computeskUG as in experimentExpUA2.For each instance of clean users, the simulator sets eachkUG is set to a randomℓ-bit string (for instances of clean users), the success probability of𝓐 may be different between ExpUA3 andExpUA2 if it makes anJ(TU‖X‖Y‖KUG)query. However, this difference is bounded by Claim 3.Since Claim 3. J is the number of queries made tothe J oraclewhere q.Proof. We prove the claim via a reduction from the ECCDH problemwhich is believed to be hard. Assume that the success probability of 𝓐is non-negligibly different between ExpUA3 andExpUA2. Then we construct an algorithm𝓐ECCDH that solves the ECCDH problem in 𝔾 with anon-negligible advantage. The objective of 𝓐ECCDH is tocompute and output the value W = uvP ∈𝔾 when given an ECCDH-problem instance  ∈𝔾2. 𝓐ECCDH runs 𝓐 as asubroutine while simulating all the oracles on its own.ECCDH handles all the oracle queries of 𝓐 asspecified in experiment ExpUA3 but usingU and V in place of X andY. When 𝓐 outputs its guessb′, 𝓐ECCDH chooses anentry of the format random from JList and terminates outputtingK/r. From the simulation, it is clear that𝓐ECCDH outputs the desired result W =uvP with probability at least1/qJ if 𝓐 makes aJ(TU‖X‖Y‖KUG)query for some instance of a clean user U ∈ 𝓤.This completes the proof of Claim 3.𝓐Experiment ExpUA4. We finally modify the experiment sothat, for each clean user U ∈ 𝓤, a randomidentity IDU ingenerating CU.Claim 4. Proof. We prove the claim by constructing an eavesdroppingadversary 𝓐IND-MEK who attacks the indistinguishability ofΔ in IND-MEK begins by choosing a random bit b∈ {0, 1}. Then, 𝓐IND-MEK invokes the adversary𝓐 and answers all the oracle queries of 𝓐 as in experimentExpUA3 except that, for each clean userU ∈ 𝓤, it generatesCU by accessing its ownencryption oracle as follows: IND-MEK outputs c1 bethe ciphertext received in return for the first pair.𝓐IND-MEK setsCU equal to theciphertext c1.𝓐𝓐IND-MEK setsCU to the encryption ofeitherIDU‖EIDU‖kUSor b′, 𝓐IND-MEK outputs1 if b = b′, and 0otherwise. Then, it is clear that: IND-MEK outputs 1 when thefirst plaintexts are encrypted in the experiment ExpUA3,andthe probability that 𝓐IND-MEK outputs 1 when thesecond plaintexts are encrypted in the experiment ExpUA4.the probability that 𝓐 That is, IND-MEK eavesdrops at mostqsend encryptions which is polynomial in thesecurity parameter ℓ. This completes the proof of Claim 4.That is, 𝓐ExpUA4, the adversary 𝓐 gainsno information on the hidden bit b chosen by theIn the experiment Theorem 2. As long as the MAC scheme Σand the symmetric encryption scheme Δ areboth secure, our authentication and key exchange protocol P is secure in therandom oracle model under the ECCDH assumption in 𝔾.Proof. Fix a ppt adversary 𝓐 against thesecurity of the protocol P. To prove the theorem, we make aseries of modifications to the original experimentExpAKE0, bounding the effect of each change in theexperiment on the success probability of 𝓐 and ending up with anexperiment where 𝓐 has a success probability of 1/2. We useb chosen by the ExpAKEi. Let ExpAKEi involving theadversary 𝓐.Experiment ExpAKE1. This experiment is different fromExpAKE0 in that the random oracle Jis simulated as follows:J oracle: For each J query ona string str, the simulator first checks if an entry of theform  is in a list called JList whichcontains all the input-output pairs of J. If such an entryexists in JList, the simulator returns j as the output of theJ query. Otherwise, the simulator chooses a randomℓ-bit string j′, returnsj′ in response to the query, and adds theentry  to JList.Simulation of the ExpAKE0. Then, since J is a randomoracle, ExpAKE1 is perfectly indistinguishable fromExpAKE0, and Claim 5 immediately follows.The other oracle queries of 𝓐 are answered as in the original experimentClaim 5. Experiment ExpAKE2. Here, we modify the experiment sothat X is computed as follows:ExpAKE2 modification:The A =aP.The simulator chooses a random exponent X =rA.For each instance of users, the simulator chooses a randomKUG is set torayP for some random ExpAKE2 and ExpAKE1, itfollows that:As a result, each Claim 6. Experiment ExpAKE3. We further modify the experiment asfollows:ExpAKE3 modification:The A,B ∈ 𝔾 and setsY = B.The simulator chooses two random elementsX =rA. For other instances, the simulator computesX as in experimentExpAKE2.For each fresh instance, the simulator chooses a random kUG to a randomℓ-bit string. For other instances, the simulator computeskUG as in experimentExpAKE2.For each fresh instance, the simulator sets eachkUG is set to a randomℓ-bit string (for fresh instances), the success probability of 𝓐may be different between ExpAKE2 andExpAKE3 if it makes anJ(TU‖X‖Y‖KUG)query. This difference is bounded by Claim 7.Since Claim 7J is the number of queries made tothe J oraclewhere q.Proof. We prove the claim via a reduction from the ECCDH problemwhich is believed to be hard. Assume that the success probability of 𝓐is non-negligibly different between ExpAKE2 andExpAKE3. Then we construct an algorithm𝓐ECCDH that solves the ECCDH problem in 𝔾 with anon-negligible advantage. The objective of 𝓐ECCDH is tocompute and output the value W = uvP ∈𝔾 when given an ECCDH-problem instance  ∈𝔾2. 𝓐ECCDH runs 𝓐 as asubroutine while simulating all the oracles on its own.ECCDH handles all the oracle queries of 𝓐 asspecified in experiment ExpAKE3 but usingU and V in place of X andY. When 𝓐 outputs its guessb′, 𝓐ECCDH chooses anentry of the format random from JList and terminates outputtingK/r. From the simulation, it is clear that𝓐ECCDH outputs the desired result W =uvP with probability at least1/qJ if 𝓐 makes aJ(TU‖X‖Y‖KUG)query for some fresh instance of any U ∈ 𝓤. Thiscompletes the proof of Claim 7.𝓐Experiment ExpAKE4. This experiment is different fromExpAKE3 in that it is aborted if the following eventThen we claim that:Claim 8where qsendis the number of queries made to theoracle.Proof. Assume that the event m,σ) such that: (1)σ has not beenoutput by the oracle m.n be the total number of MAC keys used in the sessionsinitiated via a i∈ {1, …, n}. Letki denote theith key among all the n MACkeys, and ki. ExpAKE3except that: it answers all ith MAC keyki is not used during thesimulation. If Let i is correct, then the simulation is perfect andn ≤qsend and If the guess This completes the proof of Claim 8.Experiment ExpAKE5. We next modify the way of answeringqueries to the H oracle as follows: Simulation of theH oracle: For each H query on a stringstr, the simulator first checks if an entry of the form is in a list called HList which ismaintained to store input-output pairs of H. If it is,h is the answer to the hash query. Otherwise, the simulatorchooses a random κ-bit stringh′, answers the query withh′, and adds the entry to HList.ExpAKE4. Since ExpAKE5 isperfectly indistinguishable from ExpAKE4, it is clearthat:The other oracle queries of 𝓐 are handled as in experimentClaim 9. Experiment ExpAKE6. We finally modify the experiment sothat the session key sk is set to a randomκ-bit string for each fresh instance and itspartner. Accordingly, the success probability of 𝓐 may be differentbetween ExpAKE6 and ExpAKE5 ifit asks an H query of the formH(kUS‖TU‖IDSN)for some uncorrupted U ∈ 𝓤 andSN ∈ 𝒮𝓝. But the difference isbounded by:Claim 10H is the number of queries made tothe H oraclewhere q.Proof. We prove the claim by constructing an eavesdropper𝓐IND-MEK who attacks the indistinguishability of Δin experiment IND-MEK invokes theadversary 𝓐 and answers all the oracle queries of 𝓐 as inexperiment ExpAKE5 except that it generates eachCGW to be sent to a freshsensor instance by accessing its own encryption oracle as follows: κ.𝓐IND-MEK outputs c be theciphertext received in return for the plaintext pair.𝓐IND-MEK setsCGW equal to theciphertext c.Let CGW is set to theencryption of either kUS orb′, 𝓐IND-MEK selectsan entry of the format random from HList and outputs 0 if k =kUS, and 1 otherwise. If𝓐 asks an H query of the formH(kUS‖TU‖IDSN)for some uncorrupted U ∈ 𝓤 andSN ∈ 𝒮𝓝, 𝓐IND-MEKcorrectly guesses the bit b in its indistinguishabilityexperiment with probability at least That is, each ExpAKE6, the adversary 𝓐 obtains noinformation on the hidden bit b chosen by the κ. Therefore, it follows thatIn experiment With the continuing advancements in sensor technologies, WSNs will play anincreasingly important role in commercial, government and military settings. Anumber of recent high profiles such as the revelations by Edward Snowden that the USNational Security Agency has been conducting massive online surveillance of both USand non-US citizens highlighted the potential of ensuring user privacy andanonymity. In WSNs, for example, designing a secure and efficient userauthentication scheme without compromising user anonymity remains an area of activeresearch.sca-wsn scheme, a smart-card-based userauthentication scheme for wireless sensor networks, which achieves user anonymitywithout imposing (expensive) public key operations on sensors. Our result in thispaper does not contradict the result of Wang and Wang [in order for asca-wsnscheme to achieve user anonymity, the use of public key cryptography isinevitable but, if forward secrecy is not desired, can be avoided at least onthe sensor side. Extending our result to the case of three-factorauthentication [In this work, we have presented a and Wang , 29 but tication  would be


Either decreased renal function or increased systolic time interval is associated with cardiac hypertrophy and poor cardiac outcome. The aim of this study was to evaluate combination of renal function and brachial systolic time intervals were associated with increased left ventricular mass index (LVMI) and left ventricular hypertrophy (LVH).2 and bPEP/bET < 0.38 (group 1), eGFR ≥ 45 ml/min/1.73 m2 and bPEP/bET ≥ 0.38 (group 2), eGFR < 45 mL/min/1.73 m2 and bPEP/bET < 0.38 (group 3), and eGFR < 45 mL/min/1.73 m2 and bPEP/bET ≥ 0.38 (group 4), respectively. Patients in groups 1 and 4 had the lowest and highest LVMI among 4 groups, respectively (P < 0.001). In multivariable analyses, increased LVMI and LVH were significantly associated with patients in groups 2, 3 and 4 (vs group 1) (P ≤ 0.019).In total of 990 patients were consecutively included in this study from January 2011 to December 2012. All study participants were further classified into 4 groups by the values of estimated glomerular filtration rate (eGFR) and ratio of brachial preejection period (bPEP) to brachial ejection time (bET). The classification of 4 groups were eGFR ≥ 45 mL/min/1.73 mOur study demonstrated that joined parameter of renal function and systolic time intervals, in terms of eGFR and bPEP/bET, might be an alternative method in risk stratification for increased LVMI and LVH. Either cardiac volume or pressure overload triggers several biological signal cascades leading to cardiac hypertrophy.2 Meanwhile, either arterial pressure or fluid volume overload are common noted in patients with chronic kidney disease (CKD), which can contribute to abnormal cardiac geometry and function in these patients. In epidemiological studies, advanced CKD patients had a high prevalence of LVH.6 The prevalence of LVH is inversely proportional to the value of eGFR.5 CKD patients, who either have reduced estimated glomerular filtration rate (eGFR) or renal damage, frequently have volume retention and electrolyte imbalance which may cause abnormal cardiac function, increased left ventricular mass index (LVMI), and adverse cardiac events. Prior studies demonstrated that reduced eGFR was the important factor affecting not only the progression of renal disease but also abnormal left ventricular geometry.8Abnormal cardiac and vascular structure and function are increased the risk of cardiovascular mobility and mortality.9 The relationship between renal and cardiac disease is close and bidirection.10 Parameters of cardiac systolic function can be measured from echocardiography and peripheral arterial Doppler waveform.13 Systolic time intervals, including preejection period and ejection time, are a well-known indicator for global cardiac systolic function.14 Brachial preejection period (bPEP) and brachial ejection time (bET) calculated from waveform of brachial arterial pressure, electrocardiogram and phonocardiogram were alternative parameters for evaluation of left ventricular systolic function.14 In our previous studies, prolonged bPEP, short bET, and high bPEP/bET were associated with cardiac systolic dysfunction.15 Furthermore, bPEP/bET can serve as a useful parameter in prediction of LVH and cardiac death in patients with CKD and hemodialysis.17On the opposite hand, preexisting cardiac disease is also associated with renal damage and rapid deterioration of eGFR.Although deterioration of renal function and brachial systolic time internals, in terms of decreased of eGFR and high bPEP/bET, have significant associated with LVH, there was no study investigated LVH from combining these 2 important indicators. We hypothesized that mixed parameters of renal function and brachial systolic time intervals were useful tools in the risk classification for LVH. The goal of our study was to evaluate the role of joined with eGFR and bPEP/bET in risk categorization for increased LVMI and LVH.Study participants were enrolled for echocardiographic survey in a regional hospital in Taiwan owing to suspected cardiovascular disease from January 2011 to December 2012 . From standard transthoracic view, we measured left ventricular internal diameter (LVID), interventricular septal wall thickness (IVST), and left ventricular posterior wall thickness (LVPWT) in the end left ventricular diastolic phase. The Doppler and tissue Doppler parameters, such as transmitral E wave velocity (E), E-wave deceleration time, transmitral A wave velocity, and early diastolic mitral velocity (Ea), were measured from standard apical four-chamber view.18 We calculated left ventricular ejection fraction (LVEF) and Left ventricular mass by the modified Simpson method and the Devereux-modified method, respectively.19 LVMI was calculated by dividing left ventricular mass by body surface area. In the present study, we defined LVH as LVMI more than 115 g/m2 in men and more than 95 g/m2 in women.18 All echocardiographic parameters were acquired from 3 continued beats and measured from offline EchoPAC software by a single experienced cardiologist.All study patients were received echocardiographic examination by a standard protocol.20All blood pressures, bPEP, and bET measurements were obtained after echocardiographic examination. The bPEP, bET, and ratio of bPEP/bET were calculated from an ABI-form device (VP1000) by a standard measurement.21Baseline medication, personal characteristic, and laboratory data were collected from medical records. The value of eGFR was calculated by the equation of Modification of Diet in Renal Disease study.2 and bPEP/bET < 0.38 (group 1), eGFR ≥ 45 mL/min/1.73 m2 and bPEP/bET ≥ 0.38 (group 2), eGFR < 45 mL/min/1.73 m2 and bPEP/bET < 0.38 (group 3), and eGFR < 45 mL/min/1.73 m2 and bPEP/bET ≥0.38 (group 4).12The study participants were divided into 4 groups by the values of eGFR and bPEP/bET. Patients were classified into 4 groups when their eGFR ≥ 45 mL/min/1.73 mP-value < 0.05.Statistical analysis was calculated by SPSS 18.0 . The baseline, laboratory, and echocardiographic data were presented as percentage or mean ± standard deviation. Four study groups were analyses by 1-way analysis of variance and Bonferroni post hoc test. Among study groups, group 1 was taken as reference category. Variables which were significance in univariate analysis were selected into multivariable linear and logistic analyses for determinants of LVMI and LVH, respectively. The statistical difference was considered when the 2, LVH = 69.8%), patients in group 2 , group 3 , and group 4  had a higher LVMI (P < 0.001) and higher prevalence of LVH (P ≤ 0.041). Table P = 0.001), group 3  and group 4 . Table P = 0.017), group 3 , and group 4 .A total of 990 patients were divided into 541, 236, 142, and 71 patients in groups 1, 2, 3, and 4, respectively. The differences of clinical data and echocardiographic parameters among four study groups are shown in Tables In the present study, we demonstrated that combination of eGFR and bPEP/bET were useful in risk stratification for increased LVMI and LVH. Patients in group 1 (higher eGFR and lower bPEP/bET) and patients in group 4 (lower eGFR and higher bPEP/bET) had the lowest and highest LVMI among 4 groups, respectively. In addition, compared to patients in group 1, the other groups were associated with a higher LVMI and higher prevalence of LVH in the multivariate analysis.22 showed significantly correlation between the ratio of systolic time intervals and LVMI in patients with hypertension. Our previous studies had demonstrated that bPEP/bET was a significant parameter in prediction of decreased LVEF and increased LVMI.23 The main aim of the present study was to compare LVMI and LVH among 4 groups divided by eGFR and bPEP/bET. Compared with reference group (group 1), we found patients with higher bPEP/bET and/or lower eGFR had an increased LVMI and high prevalence of LVH. These results might suggest patients with relatively normal cardiorenal function had a low LVMI and LVH, but patients with cardiorenal dysfunction had a high LVMI and LVH. Hence, classification of patients into 4 groups using eGFR and bPEP/bET might be useful in recognizing patients with increased LVMI and LVH.Boudoulas et al24 Mechanisms of cardiorenal interaction may include impaired endothelial function, anemia, systemic inflammation, increased active oxygen species or activation of adrenergic nervous system and rennin–angiotensin system.25 Pressure and volume overload are frequently noted in CKD patients, which can contribute to LVH and abnormal left ventricular function in these patients. In fact, CKD patients have a high prevalence of increased LVMI and LVH.26Cardiac and renal failure may interact each other and influence cardiac and renal outcomes.27 High arterial pressure and atherosclerotic process serve important roles in cardiac hypertrophy and its sequentially adverse cardiac events.28 Recently, several studies showed genetic factors of hypertension were associated with poor cardiovascular outcome. Lanni et al29 showed the glycoprotein IIIa protein with platelet antigen 2 (GPIIIA PlA2) isoform was increased in hypertensive patient with stroke and could serve as a genetic determinant of ischemic stroke among high risk patients. Furthermore, Santulli et al showed the GPIIIA PlA2 polymorphism was an independent predictor for cardiac death (odds ratio = 9.594) in patients with atherosclerotic coronary artery diseases.30 Some possible molecular mechanisms, including vascular endothelial dysfunction, sympathetic nervous activation, G-protein-coupled receptor kinase (GRK) expression, and calcium/calmodulin-dependent kinase (CaMK) regulation, were associated with high arterial pressure.31 The GRKs family, especially GRK2, played an important role in essential hypertension.31 In bench studies, different G-protein-coupled receptors, such as β-adrenergic receptor and angiotensin II type 1A receptor, were regulated by GRK2.33 Recently, both in vivo and in vitro studies, Sorriento and Cipolletta et al and Ersilia et al demonstrated that GRK2 mediated cardiac hypertrophy through nuclear factor-κB (NFκB) and extracellular regulated kinase pathway, respectively.35 Besides GRK2, GRK5 also regulated cardiac hypertrophy from NFκB signal transduction.36 Additionally, the family of CaMKs and their genes were associated with hypertension and cardiac hypertrophy. Santulli et al demonstrated that CaMK4 gene deletion was an important role in regulation of vascular pressure through inactivation of endothelial nitric oxide synthase.37The causes of cardiac hypertrophy were multifactors. Growth of myocardial mass was influenced by various neurohormones, growth factors, and circulatory cytokines.There were several limitations to our study. First, our study was a cross-sectional design, was performed only in 1 regional hospital and lacked follow up, which limited our study strength. Second, there was no validation of bPEP/bET in patients with atrial fibrillation and valvular heart diseases. Therefore, our results could not be applied in these patients. Finally, we did not check gene polymorphisms in our patients. Hence, the genetic consideration and molecular signal transduction about cardiac hypertrophy were lack in this study.In conclusion, separating patients into four groups using eGFR and bPEP/bET might be an alternative method in risk stratification for increased LVMI and LVH.


By introducing GCIB sputter to time-of-flight secondary ion mass spectrometry (TOF-SIMS), we analyzed the 3D configuration and chemical composition of subnuclear structures of pyramidal cells in the CA2 region in mouse brain hippocampus. Depth profiles of chemicals were analyzed as 3D distributions by combining topographic analyses. Signals corresponding to anions such as CN− and PO3− were distributed characteristically in the shape of cell organelles. CN− signals overlapped DAPI fluorescence signals corresponding to nuclei. The clusters shown by PO3− and those of adenine ions were colocalized inside nuclei revealed by the 3D reconstruction. Taking into account their size and their number in each nucleus, those clusters could be in the cleavage bodies, which are a kind of intranuclear structure.Structural variations of DNA in nuclei are deeply related with development, aging, and diseases through transcriptional regulation. In order to bare cross sections of samples maintaining sub-micron structures, an Ar The three-dimensional configuration of a nucleus, which is characterized as containing one-dimensional information on a DNA sequence1343m/z. Recently, single-cell-level IMS measurements are required to characterize cell types and to provide explicit evidence to distinguish themSecondary ion mass spectrometry (SIMS) is one of the most popular imaging mass spectrometry (IMS) techniques. With the use of a tightly focused ion beam, it has the highest spatial resolution, beyond even the optical limitation of a laser focus20z-axis2832Depth profiles and 3D reconstructions are the most suitable applications for TOF-SIMS analysesIn the present study, we propose an analytical procedure for 3D configurations in a single cell nucleus using GCIB-TOF-SIMS. To elucidate the 3D distributions of biomolecules reflecting nuclear bodies, we used GCIB for sputtering to expose a flattened region during depth analysis. Our method demonstrated a better spatial resolution of less than 200 nm and successfully showed 3D configurations of nuclei and distinguishable subnuclear structures that can tentatively be identified as cleavage bodies.First, we optimized the acceleration energy of the GCIB sputter to 10 kV 4 nA, as this condition was suitable to bare flattened cross sections with relatively fast sputter rates. The thickness of a sample section was determined as 10 μm, taking cell size and measurement time into account. To analyze similar cells effectively, we selected the CA2 region, a small region between CA1 and CA3 along the S-curve of the mouse brain hippocampus, because pyramidal cells of suitable size for our experiment are closely packed in this region. The region we analyzed is delimited by a white line in a bright-field image of the mouse brain section in We performed TOF-SIMS measurement after GCIB sputtering for this region and obtained 3D high-resolution chemical maps. After TOF-SIMS analysis, we measured the topographic profile by Stylus Profiler. The profile shown in m/z 26.0, m/z 42.0, and m/z 79.0 represent CN−, CNO−, and PO3−, respectively29m/z 110.0, 125.0, 134.1, and 150.1 were considered cytosine, thymine, adenine, and guanine by comparison with mass spectra obtained from standard samples (data not shown) and reported values− (m/z 131.0) and InO2− (m/z 147.0), used to coat the glass slides, showed remarkable increases after about 36 min. As the intensities reached the half-maximal point at 42 min, we decided that the sputter reached the glass surface at that time point. Using these quantities, we estimated the sputter rate as 55 nm/min in this experiment.Next, to determine when the sputtering reached the glass slide, we analyzed the depth profile of ion intensity for various ions2534m/z 0 to 1850 after 42 min. As most of the signals are assembled below m/z 150, a resizing of m/z from 10 to 150 is shown in 29m/z 13.0 as CH−, m/z 16.0 as O−, m/z 26.0 as CN−, m/z 42.0 as CNO−, m/z 63.0 as PO2−, and m/z 79.0 as PO3−. Looking at the m/z region from 100 to 150, we also found peaks we thought reflected nucleic acids, e.g., m/z 134.1 as adenine. Other nucleobases—thymine, guanine, cytosine, and uracil—were also detected, but their intensities were not strong enough to discuss as distinct distributions  palmitic acid , oleic acid , stearic acid , and arachidonic acid , according to previous reports3738We obtained the integrated mass spectrum in the negative ion mode from ibutions . As show−, which showed high intensity in the mass spectrum, showed the largest single cluster inside the cells. We also found small clusters shown by PO3− signals and adenine ion signals. PO3− signals at sputter cycle 0 appeared uniform, similar to the total ion image. After the sputtering, small clustered signals of PO3− were unveiled inside the cells. Ion images reconstructed from adenine signals also showed small clusters, and they colocalized with PO3− signals, while 38% of PO3− clusters did not contain adenine ion.To analyze the 3D distribution of molecules, we reconstructed an ion image for each sputter cycle, i.e., at every 192.5 nm depth plane. Typical images using a pseudocolor scale are shown in − (red). These signals appeared to be complementary.Ion images corresponding to FAs were reconstructed by gathering signals from the entire depth plane, and the results are shown in − signals are shown in blue, clusters from PO3− in green, and clusters from adenine ions in red. To improve visualization, we expanded the sample thickness to the originally sectioned thickness by multiplying by 4.35, and we ignored PO3− accumulation at the sample surface, sputter cycle 0, to avoid the possibility of an artifact such as cholesterol migrationTo compare the loci of these clusters in detail, we reconstructed 3D objects from the binarized ion images. Snapshots of the results are shown in the upper panels of −-rich region is included in the cell body, while multiple clusters of the PO3− and adenine ions are included. To investigate the positional relationships of these clusters, snapshots of the single CN−-rich region are shown together with PO3− and adenine ion clusters in the lower panels of 3− and adenine clusters were in CN−-rich regions. Moreover, most of the adenine clusters were colocalized with PO3− clusters, which are shown in light blue. Five totally colocalized clusters can be seen inside the CN−-rich region in the lower panels of To observe the locus of these clusters inside a single cell, we cropped a cell and indicated its location within an orange dashed line. Merged snapshots including the cell body are shown in upper panels of −-rich regions represented nuclei, we performed DAPI staining of the sections analyzed using TOF-SIMS. We sputtered samples and then obtained ion images of CN− and PO3− 3− clusters and 45 adenine clusters, and the results are shown together in 3. Upon visual inspection, the size distribution of the PO3− clusters seemed to be bimodal, whereas the distribution of the adenine clusters appeared monomodal. The volume of these clusters also varied widely, and the averages of these clusters were obtained as 0.70 ± 0.53 μm3 for PO3− and 0.43 ± 0.28 μm3 for adenine ions. All of the PO3− clusters and adenine clusters are located inside the nuclei, and about three PO3− clusters and two adenine clusters are present in a single nucleus on average. Assuming a spherical shape, their diameters were calculated as 1.1 μm for PO3− and 1.0 μm for adenine ion.Similarly, we also analyzed a total of 73 POet al.To convert voxels to physical volumes, we measured precisely the sample thickness and sputter cycles to reach the glass slide . In our The integrated secondary ion mass spectrum obtained from sample tissue showed various peaks reflecting biomolecules, including FAs . On the 414244−-rich regions and clusters formed by PO3− and adenine ions, respectively, from the ion images , adenosine diphosphate (ADP), or adenosine triphosphate (ATP). As cleavage bodies are known to colocalize with ATP-dependent RNA helicase DDX13− also suggested a cleavage body.As pyramidal cells are directionally arranged along CA regions associated with the anatomical structure of the hippocampus, their polarity is determined by the direction toward apical dendrites and basal dendrites46−-rich region overlapping the nuclei by comparing the loci with DAPI fluorescence, as shown in − signals were considered to be enriched in nuclei. Subcellular analysis of human osteogenic sarcoma cells and human astrocytoma cells using a Raman spectroscope has revealed that Raman shift by the CN double bond was not remarkable in both cytosol and nuclei− and CNO−. In the present study, CNO− was found mainly in cytosol complementary with CN− (data not shown). Consistently, the signal of CN− + CNO− was found all over the cell body in the earlier report− and the distribution of CNO− can be clearly distinguished.We confirmed the CN3− clusters and that of adenine ion clusters is also consistent with the previous result that RNA is absent in 20% of cleavage bodiesMany aspects of the substance of intranuclear structures, such as subnuclear bodies and nuclear speckles, remain unclear, as it is difficult to purify and separate such tiny structures. Taking the results of previous reports5353Aiming at submicron 3D analysis, we combined GCIB sputtering and TOF-SIMS measurement. GCIB bares cross-sections of samples while maintaining microscopic structures without positional drift. Using this modality, we have successfully found negative ions constructing distinct clusters inside nuclei. Our modality has an advantage in that chemicals contained in tiny structures that are hard to separate or purify can be directly analyzed. We believe our method will help to enrich the discussions on theoretical models of the mechanisms underlying intranuclear organelles.4′,6-diamidino-2-phenylindole (DAPI), ultrapure water, and standard samples of nucleotides  were purchased from Wako Pure Chemical Industries .C57BL/6J mice were used in the experiments. All experiments were conducted according to protocols approved by the Animal Care and Use Committee of the Hamamatsu University School of Medicine. Mouse brains were rapidly frozen after harvest in powdered dry ice. Tissue blocks were sectioned at −16 °C using a cryostat  to a thickness of 10 μm. The frozen sections were thaw-mounted on indium-tin-oxide (ITO)-coated glass slides . The samples were stored at −20 °C and dried at room temperature prior to the experiments. Following dehydration, the tissue sections had a thickness in the range of 2.0 ~ 2.5 μm.32+ liquid metal ion gun (LMIG) was used as the primary ion source because it is suitable for detecting relatively large ions. A triple-focusing time-of-flight (TRIFT) mass analyzer provides highly sensitive measurement with a low noise level− (m/z 13.0), C2H− (m/z 25.0), and C4H− (m/z 49.0) were used. The parameters, such as the spatial resolution and direct current, were optimized to obtain good mass spectra under each experimental condition. Negative secondary ions in the m/z range of 0 to 1850 were obtained from 50 μm × 50 μm square regions with an image resolution of 256 × 256 pixels within 90 minutes of acquisition time. Primary ion dose density was 6.8 × 1012 ions/cm2. All spectra were acquired automatically using WinCadenceN software (ULVAC-PHI), which was used also to process TOF-SIMS data, such as the reconstruction of ion images. For further image processing, ion images were exported in a noncompressed 8-bit grayscale tiff.TOF-SIMS depth profiles and analyses were performed by using a PHI TRIFT V nanoTOF  instrument. A 60 keV Au2500+ gas cluster. The direct current delivered to the sample was 4 nA. Compared to the conventionally used C60 sputter beam, Ar2500+ GCIB has the advantage of avoiding contamination from the gas cluster and thus not affecting the mass spectrum2, and 2.5 × 1016 ions/cm2 was the final dose density of the sample.Sputtering was performed by GCIB (ULVAC-PHI) after each TOF-SIMS measurement using a 10 keVArWe performed TOF-SIMS measurement and DAPI staining on the same region of the section. Prior to the TOF-SIMS measurement and DAPI staining, enough sputtering was performed to obtain an aimed depth. First, TOF-SIMS measurements of the cell contents in a linear plane manner were performed. Second, 50 μg of DAPI powder was dissolved into 50 mL of ultrapure water, and staining was performed by incubating the sample in the solution at room temperature for 1 min. To reduce slippage and the collapse of sections, a subsequent wash was not performed, because the signal-to-noise ratio was good enough to allow us to observe the nuclei. The DAPI fluorescence was observed using an inverted microscope  equipped with a charge-coupled device camera , a 40 × objective lens , and an additional intermediate 1.5 × magnification module. Fluorescence intensity over 512 × 512 pixels was acquired as 16-bit grayscale tiff images using Aqua Cosmos Software (Hamamatsu).http://rsbweb.nih.gov/ij/). The 3D objects were reconstructed using V-CAT software version 1.5  and 3D Viewer, a default plugin of ImageJ. The ion aggregations, which we call clusters in the present study, were analyzed using 3D Object Counter−-rich region were estimated using the Kalman Stack Filter plugin, which is also available from the NIH website. For these analyses, nonspecific small clusters (<5 voxels) were ignored. Colocalization of ion signals was analyzed using the Image Calculator function in ImageJ.Ion images exported as 8-bit grayscale tiff images from TOF-SIMS data were processed using the ImageJ program , which is available from the NIH website .


Foods produced on soils impacted by Pb-Zn mining activities are a potential health risk due to plant uptake of the arsenic (As) associated with such mining. A field survey was undertaken in two Pb-Zn mining-impacted paddy fields in Guangdong Province, China to assess As accumulation and translocation, as well as other factors influencing As in twelve commonly grown rice cultivars. The results showed that grain As concentrations in all the surveyed rice failed national food standards, irrespective of As speciation. Among the 12 rice cultivars, “SY-89” and “DY-162” had the least As in rice grain. No significant difference for As concentration in grain was observed between the rice grown in the two areas that differed significantly for soil As levels, suggesting that the amount of As contamination in the soil is not necessarily the overriding factor controlling the As content in the rice grain. The iron and manganese plaque on the root surface curtailed As accumulation in rice roots. Based on our results, the accumulation of As within rice plants was strongly associated with such soil properties such as silicon, phosphorus, organic matter, pH, and clay content. Understanding the factors and mechanisms controlling As uptake is important to develop mitigation measures that can reduce the amount of As accumulated in rice grains produced on contaminated soils. Arsenic (As) is a carcinogenic metalloid ubiquitous in the environment, and is obtained from natural and anthropogenic sources Rice is the staff of life for 3 billion people, predominantly in Asia Some studies have revealed that As concentrations in rice grains were associated with the As concentrations in irrigated groundwater and/or soil Arsenic is a natural component of Pb, Zn, Cu, and Au ores. Therefore, As is commonly found in soils in mine impacted regions at elevated levels, posing a risk to human and ecosystem health No specific permits were required for the described field studies. No specific permissions were required for these locations. We confirm that the location is not privately-owned or protected in any way. We confirm that the field studies did not involve endangered or protected species.2 and produces of 250,000 tons of waste rocks and 30,000 tons of tailings per year occupying respective 8,300 and 60,000 m2The present study was conducted in two mining regions in the northern part of Guangdong Province, China . This re2 per paddy field A total of 28 soil and 28 rice plant  samples were collected at maturity from 28 paddy fields within or adjacent to the two Pb-Zn mining areas, i.e., eight from Lechang and twenty from Renhua . The fieAfter harvesting, collected plants were washed thoroughly in tap water, followed by deionized water, before extracting the iron plaque from fresh root surfaces using dithionite-citrate- bicarbonate (DCB) as described by Liu et al. For soil digestion, 0.2 g soil samples were weighed into quartz glass tubes and 5 mL of 12.0 mol/L hydrochloric acid plus 5 mL of 15.2 mol/L nitric acid added, then left to stand overnight at room temperature before being digested on the block digester at 100°C for 1 h, then at 120°C for 1 h, and finally at 140°C for 4 h −1 Na3C6H5O7·2H2O, 0.125 mol·L−1 NaHCO3 and 0.5 g Na2S2O4) solution and determined by flame atomic absorption spectrophotometer (FAAS) (Hitachi Z-5300).Selected soil properties, including soil pH, organic matter (OM), available phosphorus (AP), available silicon (ASi), cation exchange capacity (CEC), electrical conductivity (EC), and iron and manganese oxides, were analyzed according to the standard methods recommended by the Soil Science Society of China Iron plaque on fresh root surface was digested by DCB. For root digestion, 3 g mixed root sample per paddy was weighed into quartz glass tubes (100 mL) and steeped in 30 mL of DCB solution for 1 hr at 25°C before being transferred into quartz glass tubes (100 mL). The root surface As, Fe, and Mn digested by DCB were measured by AFS and FAAS respectively.p/Cs, where Cp is the concentration of As in straw or grain and Cs is the concentration of As in corresponding soil or straw.Transfer factors (TFs) were determined using the expression Ctraw/Soil TFs) = Straw As concentrations/Soil As concentrations.Straw/soil transfer factors (Srain/Soil TFs) = Grain As concentrations/Soil As concentrations.Grain/soil transfer factors (Grain/Straw TFs) = Grain As concentrations/Straw As concentrations.Grain/straw transfer factors , based on the correlation matrix, was carried out with XLStat-Pro 7.5.2 software, used as a Microsoft Excel plug-in. A probability level of p<0.05 was considered as significant difference.−1 with an average of 30.4 mg·kg−1 in Pb-Zn across the two mining areas in our survey (−1−1) −1) −1) −1) Soil characteristics are presented in r survey . Althoug−1  for agricultural soil in accordance with the Chinese Environmental Quality Standard for Soils −1 may be harmful to exposed organisms −1 poses a severe risk to the pregnant women and their offspring −1 As, two of which were over 100 mg·kg−1 As in this survey, indicating severe As contamination in soils around the Lechang Pb-Zn mine.Mean As concentrations in soils collected from Renhua were 10.2 mg·kg−1 , similarf Renhua . All eig−1  −1, n = 22) −1, n = 95) −1, n = 33) −1, exceeding Chinese maximum contaminant levels (MCLs) of 0.15 mg·kg−1, irrespective of As speciation −1 for As concentration in rice grain −1) The overall mean total concentration of grain As was 0.26 mg·kg−1 , which i−1)  . When dao Renhua . Althoug−1) and Renhua (48.6 mg·kg−1) were similar, which is in stark contrast to the 10-fold differences for the corresponding DCB-extracted As and soil As levels observed in this survey  based on total As concentrations were highly variable between and/or within Renhua and Lechang locations  were 0.012–0.057 for Renhua, and 0.0020–0.0047 for Lechang. There was an over 7-fold difference in mean Grain/Soil TFs between Renhua and Lechang respectively, probably related to the significant difference of soil As between the two locations  ranged from 0.038 to 0.11, averaging 0.076, which was a little higher compared to the As Grain/Straw TFs in rice surveyed in Guangdong rain/Straw TFs were not apparent between locations ; environmental conditions and modification of the soil in the rhizosphere; these factors interact to influence As speciation in the soil 2O3 level respectively between Lechang and Renhua Click here for additional data file.


A secure temporal credential-based authenticated key agreement scheme for Wireless Sensor Networks (WSNs) enables a user, a sensor node and a gateway node to realize mutual authentication using temporal credentials. The user and the sensor node then negotiate a common secret key with the help of the gateway node, and establish a secure and authenticated channel using this common secret key. To increase efficiency, recent temporal credential-based authenticated key agreement schemes for WSNs have been designed to involve few computational operations, such as hash and exclusive-or operations. However, these schemes cannot protect the privacy of users and withstand possible attacks. This work develops a novel temporal credential-based authenticated key agreement scheme for WSNs using extended chaotic maps, in which operations are more efficient than modular exponential computations and scalar multiplications on an elliptic curve. The proposed scheme not only provides higher security and efficiency than related schemes, but also resolves their weaknesses. GWN)—and has registration, login, authentication and key agreement, and password change phases. In the registration phase, users and sensor nodes register their secret keys to the GWN. Then the GWN issues one temporal credential to each user and sensor node for authentication. In the login, authentication and key agreement phases, the user, the sensor node and GWN authenticate each other using these temporal credentials. Additionally, the user and the each sensor node negotiate a common secret key with the help of GWN to establish a secure and authentication channel in the WSN. Finally, the password change phase enables users to update their passwords for increased security  and answers the oracle queries according to the proposed scheme. Σ thus can correctly return the Test queries. Additionally, the random variables in G0 is replaced by another random variables in G1. Then we have that G0 and G1 is equivalent, and thus:2: This game simulates all oracles as in previous game except that all rules are computed using a triple  from a random distribution (uT(x) mod p, vT(x) mod p, wT(x) mod p), instead of an extended chaotic map-based Diffie-Hellman triple. Let a challenger Aecdh try to violate the indistinguishability of the extended chaotic map-based Diffie-Hellman problem; and an adversary Aake be constructed to break the session key security. Aecdh returns the real session key sk (if c = 1) or a random string (otherwise) to Aake by flipping an unbiased coin c ∈ {0,1}. Then Aake wins the game if its output bit c' equals c. Aecmdh is asked Send, Corrupt or Test queries, and returns the responses by using a previous experiment except for  that it had received as input. If Aake outputs c, then Aecmdh outputs 1; otherwise, Aecmdh outputs 0. If  is a real extended chaotic map-based Diffie-Hellman triple, then Aecmdh runs Aake in G1 and thus the probability of the event that Aecmdh outputs 1 equals the probability of E1. If  is a random triple, Aecmdh runs Aake in G2 and thus the probability of the event that Aecdh outputs 1 equals the probability of E2. Therefore, we have:Game Gc and all sessions keys are random and independent, we haveSince the coin bit By combining Equations (5)–(8) and using Lemma 1, we have:Then the proof is concluded.The following theorem shows that the proposed scheme has MA security if the used hash function is secure and the proposed scheme has AKE security:Theorem 2.Pake denote the advantage that an adversary breaks the AKE security of the proposed scheme, and AdvPma denote the advantage that an adversary violates the mutual authentication of the proposed scheme. Then:Let Advwithin time t" and t" ≤ t' + (seq+ hq)⋅relayt + 2⋅τ, h denotes the numbers of the Hash queries; trelay denotes the time to relay a query; l denotes the security parameter and the parameters qse, t' and τ are defined as in Theorems 1.where qProof of Theorem 2. The start game Gma0 is the real attack against the proposed scheme and the final game Gma2 concludes that the adversary has a negligible advantage to break MA security of the proposed scheme. The challenger A1 attempts to break AKE security of the proposed scheme and the adversary Ama is constructed to break MA security of the proposed scheme. The adversary Ama wins this game if he successfully fakes the authenticator:Game Gma0: This game corresponds to the real attack. By definition, we have:Game Gma1: This game simulates all oracles as in previous game except for using a table list H to simulate Hash queries involving iU and GWN, and involving GWN and jS. Then, games Gma0 and Gma1 are undistinguishable except collisions of H-table in Gma1. By using the birthday paradox and Lemma 1, we have:ma makes hqHash queries involving iU and GWN, and involving GWN and jS. Game Gma2: This game simulates all oracles as in previous game except for replacing the session key sk with a random number. Then, Ama is used for building an adversary A1 against the AKE security of the proposed scheme. Next, A1 arranges the parameters, simulates the proposed scheme and replies the oracle queries made by Ama by using following scenarios.—Send or Hash queries involving iU and GWN, and involving GWN and jS, A1 replies the results by executing the proposed scheme.When receiving —Hash queries involving iU and jS, A1 replies corresponding authenticators to Ama by making the same queries to the oracle Hash involving iU and jS.When receiving —Test queries, A1 replies these queries by using the coin bit c that it has previously selected and the computed session keys.When receiving 1 outputs 1 when the authenticator is obtained by the real session key equals the probability of the event that Ama correctly guesses the hidden bit c in game Gma1. Similarly, the probability that A1 outputs 1 when the authenticator obtained by a random string equals the probability that Ama correctly guesses the hidden bit c in game Gma2. Thus, by Lemma 1, we have:Therefore, the probability of the event that ASince no information on the authenticator is leaked to the adversary, we haveCombining Equations (9)–(12) and using Lemma 1, we haveThen the proof is concluded.Theorem 3.The proposed scheme protects the privacy of users.Proof of Theorem 3. The proposed scheme protects user iU’s identity iID using the temporary secret key K1 of the user and the gateway node, and enables any two request messages M1 = {iDID, X2, X3, t3} and M1' = {i'DID, X2', X3', t3'} from user iU to be independent and difficult to distinguish from each other, where K1 = Tu(GPK) mod p, DIDi = iID ⨁ K1, X2 = Tu(x) mod p, X3 = h(iID║K1║iTCR║t3), u is a random number and t3 is a timestamp; and K1' = Tu'(GPK) mod p, DIDi' = iID ⨁ K1', X2' = Tu'(x) mod p, X3' = h(iID║K1'║iTCR║t3'), u' is a random number and t3' is a timestamp. The proposed scheme provides user anonymity and data unlinkability, and thus exhibits untrackability [kability . AccordiTheorem 4.The proposed scheme withstands privileged insider attacks.Proof of Theorem 4. In the registration phase, the user sends iREG rather than  to GWN, where iREG = UGK ⨁ (preiID║iID║h(iID║iPW║ri), iU’s identity iID and password iPW are protected by a random number ir. Therefore, the privileged insider fails to obtain  and iREG, and fails correctly to compute TCRi = D1 ⨁ h(iID║iPW║ri) (or h(GMNK||iID||iE)), so the proposed scheme withstands the privileged insider attack.Theorem 5.The proposed scheme withstands impersonation attacks.Proof of Theorem 5. An adversary who tries to impersonate iU fails to compute TCRi = D1 ⨁ h(iID║iPW║ri) and X3 = h(iID║K1║iTCR║t3), and cannot send out the correct request messages M1 = {iDID, X2, X3, t3} in the login and authentication phase without the correct iID, iPW and  in iU’s smart card, where t3 is the timestamp. A failed login is detected by the GWN in Step 2 of the login and authentication phase, so the proposed scheme withstands impersonation attacks.Theorem 6.The proposed scheme withstands off-line password guessing attacks.Proof of Theorem 6. In the proposed scheme, since reveal messages M1 = {iDID, X2, X3, t3}, M2 = {GDID, X2, Y4, t4}, M3 = {Z1, Z2, Z3, t5} and M4 = {jSID, Z1, Z3, t5} do not provide information about users’ passwords iPW, an adversary cannot confirm the accuracy of the passwords that have been guessed from M1, M2, M3 and M4, where DIDi = iID ⨁ K1, K1 = Tu(GPK) mod p, X2 = Tu(x) mod p, X3 = h(iID║K1║iTCR║t3) and iTCR = h(GMNK||iID||iE); GDID = i'ID ⨁ K2, K2 = h(jQ║t4) and Y4 = h(jQ║i'ID║X2║t4); and Z1 = Tv(x) mod p, Z2 = h(K2'║i"ID║jSID║t5), Z3 = h(sk║i"ID║jSID║t5) and sk = Tv(X2) mod p. Thus, off-line password guessing attacks are ineffective against the proposed scheme. Theorem 7.The proposed scheme withstands on-line password guessing attacks.Proof of Theorem 7. Again, the revealed messages M1, M2, M3 and M4 do not provide information about a user’s password iPW. Accordingly, an attacker has difficulty in guessing the password in an on-line transaction, and the scheme thus resists undetectable on-line password guessing attacks.Theorem 8.The proposed scheme withstands stolen verifier attacks.Proof of Theorem 8. In the proposed scheme, the GWN keeps (h(iID), iE) in the verifier table for each user iU. An adversary who steals the GWN’s verifier table and copies (h(iID), iE) still fails to compute iTCR = D1 ⨁ h(iID║iPW║ri), DIDi = iID ⨁ K1 and X3 = h(iID║K1║iTCR║t3) without knowledge of user iU’s iID, iPW, ri and D1, where u is a random number, K1 = Tu(GPK) mod p, X2 = Tu(x) mod p and t3 is the timestamp. The adversary fails to send out M1 = {iDID, X2, X3, t3} in Step 1, and a failed login is detected by the GWN. Therefore, the proposed scheme resists stolen verifier attacks.Theorem 9.The proposed scheme withstands lost smartcard attacks.Proof of Theorem 9. An adversary who steals user iU’s smartcard and copies the message , x, p, h(.), ri) still fails to compute iTCR = D1 ⨁ h(iID║iPW║ri) and X3 = h(iID║K1║iTCR║t3), where t3 is the timestamp, and so cannot send out the correct messages M1 = {iDID, X2, X3, t3} in Step 1 of the login and authentication phase without the correct iID and iPW. The GWN will detect a failed login Step 2 of the login and authentication phase, so the proposed scheme withstands lost smartcard attacks.Theorem 10.The proposed scheme withstands many-logged-in-users attacks.Proof of Theorem 10. Assume that iU’s login information , x, p, h(.), ri) is leaked to more than one non-registered user. The GWN also maintains a status-bit field and a last login field in its verifier table to prevent simultaneous duplicate logins. Therefore, the proposed scheme withstands many-logged-in-users attacks.et al. [et al. [et al. [et al. [hT is the execution time for a one-way hash operation; cT is the execution time for a Chebyshev chaotic map operation, and eT is the execution time for a scalar multiplication operation on an elliptic curve.et al. , Xue et  [et al. , Li et a [et al.  and Kim  [et al. , where TiU, sensor node jS and the gateway node GWN. The scheme of Yeh et al., [cT approximates hT, where hT is obtained by using the hash functions SHA-1 and MD5 [The first comparison made concerns the computational cost for user  et al.,  employs  et al., ,9,35, wh and MD5 ,37,38, tet al., Xue et al., Li et al. and Kim et al. all fail to protect users’ privacy. Additionally, the scheme of Yeh et al. fails to withstand password guessing, lost smart card and many-logged-in-users attacks. The scheme of Xue et al. fails to withstand privileged insider, password guessing, stolen verifier, lost smart card and many-logged-in-users attacks. The scheme of Li et al. fails to withstand impersonation and stolen verifier attacks. Only the proposed scheme withstands all possible attacks and protects privacy. Thus, the proposed scheme provides greater functionality; exhibits more favorable security-related properties, and has a lower computational cost than the other schemes.et al., which enables an adversary to impersonate legitimate users, to perform a stolen verifier attack to calculate all used session keys and transmitted secrets of users and sensor nodes, and to reveal users’ identities. A new temporal credential-based authenticated key agreement scheme that uses chaotic maps is developed for WSNs. The proposed scheme protects each user’s identity using a temporary secret key; conceals each user’s private parameters, and reduces the number of redundant parameters concerning the user’s identity and password in the verifier table of the GWN. Therefore, the proposed scheme does not have any of the weaknesses of previous schemes. Additionally, session key security is based on the extended chaotic maps-based Diffie-Hellman problem, and the proposed scheme thus exhibits perfect forward secrecy and known-key security. The proposed scheme not only eliminates the weaknesses of previous approaches, but also increases security and efficiency.This study addresses the weaknesses of the temporal credential-based authenticated key agreement scheme developed by Li


In grapevine, fruit abscission is known to occur within the first two to three weeks after flowering, but the reason why some berries in a cluster persist and others abscise is not yet understood. Ethylene sensitivity modulates abscission in several fruit species, based on a mechanism where continuous polar auxin transport across the pedicel results in a decrease in ethylene perception, which prevents abscission. In grapevine, flowering takes about four to seven days in a single cluster, thus while some flowers are developing into berries, others are just starting to open. So, in this work it was assessed whether uneven flowering accounted for differences in berry abscission dependent on polar auxin transport and ethylene-related gene expression. For this, flowers that opened in a cluster were tagged daily, which allowed to separately analyze berries, regarding their ability to persist. It was found that berries derived from flowers that opened the day that flowering started – named as “first berries” – had lower abscission rate than berries derived from flowers that opened during the following days – named as “late berries”. Use of radiolabeled auxin showed that “first berries” had higher polar auxin transport, correlated with lower ethylene content and lower ethylene-related transcript abundance than “late berries”. When “first berries” were treated with a polar auxin transport inhibitor they showed higher ethylene-related transcript abundance and were more prone to abscise than control berries. This study provides new insights on fruit abscission control. Our results indicate that polar auxin transport sustains the ability of “first berries” to persist in the cluster during grapevine abscission and also suggest that this could be associated with changes in ethylene-related gene expression. Survival within a community depends on several genetic and environmental factors that define which organisms will be able to maintain their reproductive cycle, while others stop their development. Within a single organism, this notion may also be applied to determined cells or tissues that are predestined to survive. What does determine this successful status, is an interesting question not always easy to solve. In plants, it is possible to consider some naturally occurring processes as selection mechanisms. For instance, many fruit species that produce abundant flowers are not able to support the growth of all fruits, and some of them are selected to continue their growth, with fruit abscission the selection mechanism involved. Fruit abscission, described as the physiological drop of fruitlets, allows to define how many fruits will persist, ensuring an adequate destination of photosynthates, water and ions. In fact, plants bearing a heavy fruit load per cluster show higher fruit abscission rates compared to plants with a small number of fruits Solanum lycopersicum) fruitlets in response to auxin depletion by flower removal is reversed by the application of indole-3-acetic acid (IAA) to the cut surface of the pedicel Malus domestica L.) fruitlets correlates with an increase in the transcript abundance of genes associated with ethylene perception and biosynthesis In plants, a set of hormones is responsible for the execution of specific responses. Since multiple and complex processes must be regulated, combinatorial interactions between hormones are required Abscission depends on many environmental and internal cues. Among internal cues, interaction between fruitlets is especially important, since it determines that some fruits – “dominant fruits” – develop earlier and have lower abscission rate compared to the other fruits – “dominated fruits” – and also exert a negative effect on them, which are more prone to abscise Vitis vinifera L.) berries are non-climacteric fleshy fruits disposed in a cluster of several dozens of berries Grapevine  and ETHYLENE-RESPONSE-SENSOR1 (ERS1), respectively, was significantly higher in “last berries” than in “first berries”, while transcript abundance of the putative ethylene receptor VvETR2, which is similar to Arabidopsis ETHYLENE-RESPONSE-FACTOR2 (ETR2), did not change significantly between “first berries” and “last berries” , was significantly higher in “last berries” than in “first berries”  and ETHYLENE-RESPONSIVE-FACTOR12 (ERF12), respectively, that could be involved in the transcription control of ethylene responsive genes, were found to be significantly higher in “last berries” than in “first berries”  synthases, and VvACO3, coding for an ACC oxidase, were found to be expressed at 12 DAF. The transcript levels of VvACS1 and VvACS3, similar to Arabidopsis 1-AMINOCYCLOPROPANE-1-CARBOXYLATE SYNTHASES (ACSs), were significantly higher in “last berries” than in “first berries”. On the other hand, VvACS and VvACO3, similar to Arabidopis 1-AMINOCYCLOPROPANE-1-CARBOXYLATE OXIDASEs (ACOs), transcript abundance did not change significantly between first and last formed berries  and apple  fruits, there are differences in the response to 1-MCP, a strong antagonist of ethylene for receptor binding sites. While this compound delays ripening in apple, it has a limited effect on slowing ripening in peach. Interestingly, these differences were correlated with different expression patterns of ETR1, ERS1 and CTR1 genes, which were unaffected by 1-MCP treatment in peach, while they were down-regulated in apple ETR1, ERS1 and CTR1 gene expression in apple, which are putative negative regulators. In contrast, the limited effect of 1-MCP on ripening in peach might explain why the expression of these genes does not change significantly. Nevertheless, more investigation is needed in order to unravel the connection between the expression of these genes and the sensitivity to ethylene, considering that there are several factors involved in its regulation. Finally, there was an increase in the transcript abundance of the putative transcription factors, VvEIN3 and VvERF12 in “last berries” compared to “first berries” , which correlates with their abscission rate i. e. few days after pollination, “first berries” have high polar auxin transport and low ethylene sensitivity, while the rest of the flowers and berries have low polar auxin transport and hence are sensitive to ethylene produced by themselves and by “first berries”  were selected from an experimental field located in the Curacaví Valley, Chile , during the 2012/2013 growing season. The field trial did not require special permission and field studies did not involve endangered or protected species.Grapevine plants  in a lanoline/vaseline (1∶3) mix and six clusters treated with control solution (lanoline/vaseline (1∶3) mix). Treatments with NPA were performed at 14 days after flowering (DAF) and berries were collected 2 days post treatment (DPT), at 16 DAF. In all cases the entire berry, including its pedicel, was covered with a thin layer of lanoline/vaseline (1∶3) mix.i. e. day 1, correspond to “berry category one (1)” named as “first berries”; berries derived from flowers that opened the second, third and fourth day of flowering, correspond to berry categories two (2), three (3) and four (4) respectively, named as “late berries”. Berries belonging to category 4 are also named as “last berries”, since a negligible number of flowers opened the days that followed day 4.In order to differentiate first and late formed berries according to the flowering order, a flower tagging system was adapted from For berry sampling three biological replicates were used, where a biological replicate is composed of a pool of berries. For polar auxin transport and berry volume estimation, 6 berries per cluster were selected. For RNA extraction and ethylene measurements 0.5 g of berries per cluster were used. For abscission rate estimation, berries tagged with same color within a cluster were registered. Sampling was performed at the same hour of the day (between 10 am and 2 pm).Berry volume was assessed at 10 and 14 DAF for each of the four berry categories. For berry volume estimation, the transversal and longitudinal diameters  were measured using a caliper. Next, average diameters were used for berry volume estimation according to the For berry abscission estimation at 12 DAF, berry number per category within each cluster was registered by counting the same color threads that were tied to the pedicels. Berry number register was performed at 8 and 12 DAF, with berry number at 8 DAF set as 100%. Then, relative abscission percentage (%) was estimated according to Berry n° corresponds to the same color tagged berries registered within a cluster. Two technical replicates and three biological replicates were used. To estimate berry abscission % in NPA experiment, berry number within each cluster was registered at 14 and 16 DAF in NPA-treated and control berries. Where 3H]IAA, specific activity 50.55 TBq mmol−1, concentration 1 mCi mL−1, American Radiolabeled Chemicals Inc.) was diluted 1∶10 times in pure ethanol, to a final [5-3H]IAA concentration of 4 µM. Polar auxin transport experiment was adapted from 3H]IAA drop. Then, each berry was put with its basal side in contact with a receiver agar disc (1.5% (w/v) agar-agar (Merk), 0.2% (w/v) MES (Sigma-Aldrich), in a final volume of 300 µL at pH 5.5) placed on a 24 well tissue culture plate (Sigma Aldrich). After adding a 0.2 µL drop of [5-3H]IAA into the hole at the apical surface of each berry, the plate was covered and berries were incubated for 8 hours at 22°C. A humid paper towel was fixed to the cover, in order to avoid dehydration. After incubation, agar discs and berries were homogenized in 2 mL of 80% methanol and kept at 4°C with overnight agitation. The accumulated radioactivity in the receiver agar discs was determined by radioactive scintillation counting of disintegrations per minute (DPM) in a liquid scintillation analyzer (Beckman Ls6500), using a vial containing 3 mL of OptiPhase HiSafe 3 (Perkin-Elmer), as liquid scintillation cocktail. Results were expressed as percentage (%) of polar auxin transport and were corrected by volume and contact surface in order to cancel size differences, according to the Tritium-labeled Indole-3-acetic acid  mix, was added in planta 24 hours prior to the auxin transport experiment. Acropetal and NPA controls were around 30% and 50% of basipetal transport, respectively (unpublished observations), similar to previously reported in Arabidopsis seedlings Where Immediately after sampling, berries were enclosed in 2 mL tubes with screw lids, one tube per replicate. Tubes were maintained at 22°C for three hours and then heated at 100°C for 90 min in order to release remaining ethylene out of the berries Total RNA was extracted from 0.5 g of a pool of seven to ten berries selected from a bunch. Extraction was performed using a modified CTAB-Spermidine extraction method, as previously described VvGPDH gene  VvUBI1 gene  GOI) and the geometric mean of the expression of the housekeeping genes, VvGPDH and VvUBI1, was generated according to the Real time RT-qPCR was performed using a MX3000P detection system (Stratagene), as previously described VvGPDH and VvUBI1 in categories 1 and 4 and in NPA and control treatments are given in Where E corresponds to each primer amplification efficiency value. Ct values, relative quantities and normalized relative quantities for VvETR1 , VvETR2 , VvCTR1 , VvERS2  and VvEIN3  were obtained from VvERF12  were designed using Primer3plus VvACO3 , VvACS , VvACS1 , VvACS3  were designed using Primer-BLAST tool available on NCBI webpage. Amplicon size was <200 pb. PCR products were excised from an agarose gel, purified using Qiaex II (Qiagen) and sequenced. Primers sequences are listed in VvUBI1 and VvGPDH relative transcript abundance was 103 times the relative transcript abundance of VvETR1, VvETR2, VvERS1, VvEIN3 and VvERF12; 106 times that of VvCTR1, VvACS1 and VvACS3, and 102 times that of VvACO3 and VvACS.RT-qPCR primer sequences for For berry volume, abscission percentage, polar auxin transport, ethylene content and transcript abundance measurements, three biological replicates were used. Tukey's media comparison analyses were performed in order to compare different conditions. For all the analyses, statistical significance was assessed using p value <0.05.Table S1VvUBI1 and VvGPDH genes.RT-qPCR Ct values for (PDF)Click here for additional data file.