R Abejón

H Saidani

A Deratani

C Richard

J Sánchez-Marcano
email: jose.sanchez-marcano@umontpellier.fr

CONCENTRATION OF 1,3-DIMETHYL-2-IMIDAZOLIDINONE IN AQUEOUS SOLUTIONS BY SWEEPING GAS MEMBRANE DISTILLATION

Keywords: sweeping gas membrane distillation, 1, 3-dimethyl-2-imidazolidinone, solvent dehydration, hollow-fiber membrane, multi-objective optimization

Sweeping Gas Membrane Distillation (SGMD) is a useful option for dehydration of aqueous solvent solutions. This study investigated the technical viability and competitiveness of the use of SGMD to concentrate aqueous solutions of 1,3dimethyl-2-imidazolidinone (DMI), a dipolar aprotic solvent. The concentration from 30% to 50% of aqueous DMI solutions was attained in a bench installation with Liqui-Cel SuperPhobic® hollow-fiber membranes. The selected membranes resulted in low vapor flux (below 0.15 kg/h•m 2 ) but were also effective for minimization of DMI losses through the membranes, since these losses were maintained below 1% of the evaporated water flux. This fact implied that more than 99.2% of the DMI fed to the system was recovered in the produced concentrated solution. The influence of temperatures and flowrates of the feed and sweep gas streams was analyzed to develop simple empirical models that represented the vapor permeation and DMI losses through the hollow-fiber membranes. The proposed models were successfully applied to the scaling-up of the process with a preliminary multi-objective optimization of the process based on the simultaneous minimization of the total membrane area, the heat requirement and the air consumption. Maximal feed temperature and air flowrate (and the corresponding high operation costs) were optimal conditions, but the excessive membrane area required implied an uncompetitive alternative for direct industrial application.

Introduction

Membrane Distillation (MD) is a thermally driven process, in which only vapor molecules are transported through porous hydrophobic membranes. The liquid feed to be treated by MD must be in direct contact with one side of the membrane, but without wetting the membrane to avoid the entrance inside the dry pores. [START_REF] El-Bourawi | A framework for better understanding membrane distillation separation process[END_REF] This hydrophobic nature of the membrane prevents the mass transfer in liquid phase and creates a vapor-liquid interface at the pore entrance (Figure 1). In this interface, the volatile compounds in the liquid feed evaporate and diffuse across the membrane pores. On the opposite side of the membrane, the vapor is condensed or removed, depending of the configuration of the MD system. The benefits of MD compared to distillation or other separation processes based on membranes must be highlighted: [START_REF] Lawson | Membrane distillation[END_REF] complete theoretical rejection of ions, macromolecules, colloids, cells, and other non-volatiles; lower operating temperatures than conventional distillation; lower operating pressures than conventional pressure-driven membrane separation processes; reduced chemical interaction between membrane and process solutions; less demanding membrane mechanical property requirements; and reduced footprint spaces compared to conventional distillation processes.

The driving force at the origin of the mass transfer through the membrane is a partial pressure gradient, but this gradient can be induced and maintained by different mechanisms, which define the configuration of the MD system. In the case of Sweeping Gas Membrane Distillation (SGMD), a cold inert gas sweeps the permeate side of the membrane and removes the vapor molecules, which condensate outside the membrane module (Figure 2). SGMD presents some specific advantages when compared to other MD configurations, like relatively low heat loss by conduction through the membrane, low resistance to mass transfer in the gas phase, and a high driving force for transmembrane transport due to the continuous removal of vapor from the permeate side of the membrane. The membranes are key elements for an effective implementation of SGMD systems.

Hydrophobic mesoporous -macroporous membranes (pore diameters between 10 nm and 0.5 μm) made of polymeric materials such as polypropylene, polyethylene, polytetrafluoroethylene or polyvinylidenefluoride are generally selected for this application. As previously commented, the hydrophobic character is crucial to avoid the penetration of the aqueous phase through the membrane's porosity. This characteristic can be estimated indirectly from the determination of the intrusion pressure. The general influence of other structural characteristics of the membrane on the performance of SGMD processes is shown in Table 1.

Table 1. Influence of the membrane characteristics on the evaporative flux. Three important parameters of the membrane have direct influence on the evaporative flux: the thickness of the membrane, the porosity and the size of the pores. First of all, it is clear that the membrane resistance to mass transfer is proportional to the membrane thickness, so the thicker the membrane, the lower the flux. Moreover, it should be noted that the higher the porosity, the higher the flux. Indeed, a membrane having a high porosity offers a greater exchange surface area to the mass transfer and improved diffusivity. [START_REF] Karanikola | Sweeping gas membrane distillation: Numerical simulation of mass and heat transfer in a hollow fiber membrane module[END_REF] Similarly, the evaporative flux increases with the pore diameter of the membrane. However, in order to avoid penetration of liquid into the membrane, the pore diameter should not be too large. An optimum pore diameter value must therefore be determined for each SGMD application for a good compromise between performance and operation.

Membrane characteristics

The influence of several operating variables on the SGMD processes has been previously investigated. [START_REF] La Espriella | Operating conditions influence on VMD and SGMD for ethanol recovery from aqueous solutions[END_REF][START_REF] Shirazi | Sweeping Gas Membrane Distillation (SGMD) as an alternative for integration of bioethanol processing: study on a commercial membrane and operating parameters[END_REF] The temperatures of the feed and sweeping phases have been identified as the most relevant process conditions; in particular, the temperature difference between the two phases must be taken into consideration. Indeed, SGMD is a thermal process governed by the gradient of partial pressure induced by the difference of temperature on both sides of the membrane. Therefore, the greater the temperature difference between the two phases, the higher the evaporation flux. In addition, the flow velocities of the phases can have an effect on the performance, but it depends on the specific cases. [START_REF] Karanikola | Sweeping gas membrane distillation: Numerical simulation of mass and heat transfer in a hollow fiber membrane module[END_REF][START_REF] Cojocaru | Sweeping gas membrane distillation of sucrose aqueous solutions: Response surface modeling and optimization[END_REF][START_REF] Khayet | Modeling and optimization of sweeping gas membrane distillation[END_REF] Desalination has been the most investigated application of MD. This hybrid technology can be employed for the removal of salts and other undesired compounds from a saline water solution to produce freshwater, with quality enough for human consumption, agriculture or industrial uses. [START_REF] Nakoa | A research on water desalination using membrane distillation[END_REF] Consequently, the development of improved membrane for this particular application emerges as a very relevant hot topic of research. [START_REF] Lu | Novel PVDF membranes comprising n-butylamine functionalized graphene oxide for direct contact membrane distillation[END_REF][START_REF] Munirasu | Intrinsically superhydrophobic PVDF membrane by phase inversion for membrane distillation[END_REF] Nevertheless, MD has been successfully implemented in other applications. For example, references of the employment of MD for the dehydration of different solutions, such as aloe vera juice [START_REF] Dershmukh | Dehydration of aloe vera juice by membrane distillation[END_REF] or aqueous solutions of glycerol [START_REF] Madhumala | Recovery of hydrochloric acid and glycerol from aqueous solutions in chloralkali and chemical process industries by membrane distillation technique[END_REF] or diethylene glycol, [START_REF] Chen | Dehydration of diethylene glycol using a vacuum membrane distillation process[END_REF] can be found in bibliography. More specifically, SGMD has been applied for the recovery of volatile chemicals like aroma compounds, [START_REF] Bagger-Jørgensen | Recovery of volatile fruit juice aroma compounds by membrane technology: Sweeping gas versus vacuum membrane distillation[END_REF] but examples of its application to dehydration of glycerol [START_REF] Shirazi | Concentration of glycerol from dilute glycerol wastewater using sweeping gas membrane distillation[END_REF] and triethylene glycol [START_REF] Duyen | Feasibility of sweeping gas membrane distillation on concentrating triethylene glycol from waste streams[END_REF] have been published as well.

Taking into account this available information, the main aim of this work is the analysis of the potential of SGMD for concentration of aqueous solutions of 1,3-dimethyl-2-imidazolidinone (DMI). This chemical is a dipolar aprotic solvent with characteristics between THF and HMPA, suitable for many types of organic reactions, especially organometallic reactions. [START_REF] Leahy | 1,3-Dimethyl-2-imidazolidinone[END_REF][START_REF] Seki | Mesoporous silicacatalysed continuous chemical fixation of CO2 with N,N'-dimethylethylenediamine in supercritical CO2: the efficient synthesis of 1,3-dimethyl-2-imidazolidinone[END_REF][START_REF] Zhao | Zinc-mediated highly regioselective prenylation of imines with prenyl bromide[END_REF][START_REF] Kitamura | Synthesis of 1,2-bis(trimethylsilyl)benzene derivatives from 1,2-dichlorobenzenes using a hybrid metal Mg/CuCl in the presence of LiCl in 1,3dimethyl-2-imidazolidinone[END_REF][START_REF] Li | Conversion of sawdust into 5hydroxymethylfurfural by using 1,3-dimethyl-2-imidazolidinone as the solvent, Iran[END_REF][START_REF] Hou | Separation of polysaccharides from rice husk and wheat bran using solvent system consisting of BMIMOAc and DMI[END_REF][START_REF] Qian | Synthesis of ethanol via reaction of dimethyl ether with CO 2 and H 2[END_REF][START_REF] Tian | Hydrogen bonding improved atom transfer radical polymerization of methyl methacrylate with a glycerol/1,3-dimethyl-2-imidazolidinone green system[END_REF][START_REF] Xie | Efficient and reproducible CH 3 NH 3 PbI 3 perovskite layer prepared using a binary solvent containing a cyclic urea additive[END_REF] Moreover, DMI is used in the manufacture of polymers, as well as in the industry of detergents, dyestuffs, and electronic materials. The recycling of this solvent from aqueous solutions without significant losses is very important for the sustainability of industrial processes. In this work, the concentration from 30% to 50% of aqueous DMI solutions was investigated, paying attention to the main variables of the process: temperatures and flowrates of the feed and sweep gas streams. From these experimental data, simple empirical models were developed to simulate the performance of the installation and calculate the vapor permeation and the DMI losses through the membranes. These empirical models can imply relevant simplification when compared with more complex models developed to represent the performance of SGMD.

Finally, the preliminary scaling-up of the process was covered under different multi-objective optimization frameworks.

Experimental

2.1. Chemicals DMI (99.9% of purity) was supplied by Kermel. Ultrapure water (>18.0 M•cm resistivity) was obtained by a Milli-Q Element (Millipore).

Membrane selection

The selection of a membrane for concentration by SGMD is strictly related to the intended application, as it depends on the nature of the solution to be concentrated. Among the SGMD membranes available on the market, the Liqui-Cel SuperPhobic ® membrane (provided by Alting

France) appears to be the most suitable, since it is made of polypropylene, an inert polymer stable in contact with DMI. The membrane is hydrophobic and intended for applications with solutions characterized by surface tension values between 20 and 40 dyne/cm (in the case of DMI, its value is 40 dyne/cm). The membrane is commercially available as tubular modules of hollow fibers, in several different geometries. The module Liqui-Cel SuperPhobic® X50 was selected and the characteristics of its fibers can be consulted in Table 3. The total membrane area of the module was 1.2 m 2 .

Experimental installation

On the basis of the characteristics of the module described in the previous section, a SGMD bench installation was designed (Figure 3). Due to the nature of the solution to be concentrated, all the equipment employed in the bench installation was made of stainless steel in order to be compatible with DMI.

As shown in Figure 3, the counter current configuration was selected. DMI solution was stored in a 6-liter stainless steel tank (5). During the operation, the volume inside the tank was controlled by a level sensor ( 12) (Immersion piezo-resistive pressure, KELLER 46X). The temperature of the solution was self-regulated by a heat exchanger consisting of a dipping coil (stainless steel), connected to a circulating cryo-thermostat (11). The solution circulation to the module was provided by a gear pump (1) (MICROPUMP M520513), equipped with a speed controller (20 to 600 L/h). The flow rate was measured by a flow meter (2) with a micro-oval counter (OVAL LSN45 LO). The solution passed through the module (6) outside the fibers and was recirculated back to the feed tank after leaving the module. The temperature and pressure were measured at the inlet and outlet of the module by a piezo-resistive pressure transmitter (0-5 bar) and a thermocouple (4), respectively. These same sensors were also installed at the inlet and outlet of the dry air compartment, being this flow of air circulated in countercurrent inside the fibers. The relative humidity of air (% RH) was measured at the inlet and outlet of the module by a humidity transmitter (7) (Delta OHM HD2007) equipped with a remote sensor.

Before entering the module, the air from the compressor (10) (7% RH) passed through a desiccant cartridge (9). The airflow was measured by a rotameter (8), in the range 4 to 80 L/min (Brooks GT-1000). The airflow was regulated by means of the V6 control valve. Depending on the position of the valves V1 to V4, the flows of the solution and the air can be done either in closed loop (without passing through the module) or in open loop (passing through the module). This makes it possible to stabilize the operating parameters (temperature, pressure, HR ...) before starting the concentration step. The V5 valve allows the tank to be drained. Each sensor was connected to a digital display to view the value in real time. The displays were assembled in a box that also provides power to the entire system.

Experimental procedures

After the installation and testing of all the capabilities of the bench installation, the characterization of the system performance was carried out by determining its productivity in terms of evaporative flow through the membrane. These initial experiments were carried out by circulating ultrapure water in countercurrent with dry air (1.7% < RH <5.0%). The resulting productivity was determined under different conditions by varying several parameters (water stream temperature and flowrate, air stream temperature and flowrate …), to characterize the most relevant operation conditions. Each time a parameter was varied, the rest of parameters were kept constant to analysis the influence of each variable individually. The evaporative flow was calculated from the difference in the measured relative humidity in the air stream before and after its pass through the module.

In the case of the concentration of DMI solutions, the experimental procedure was similar to that described for the tests with ultrapure water, with enough stabilization time to attain steady-state conditions. Based on the results of the analysis of the system with water, the operation conditions were chosen to obtain a high yield in terms of evaporative flow and, consequently, a high concentration rate of the DMI solution. The implementation of a valid method for the determination of the DMI concentration was essential for monitoring the performance of the concentration process of the aqueous solution. Moreover, any loss of DMI across the membrane during the concentration process must be identified and quantified. The concentration of DMI solutions was measured by refractometry (the evolution of the refractometer signal as a function of the DMI concentration for a range from 40 to 3000 ppm was lineal). Therefore, the proposed assay method was validated with a detection limit of 40 ppm.

Results and discussion

Pure water permeation

Determination of the stabilization time

The determination of the time required to attain steady-state conditions was the first task to be completed. This dynamic experiment consisted in the register of evaporative flow of water through the membrane for fixed values for all the other parameters (Table 4). The water vapor flux measured increases (+5.6%) during the first two hours of operation reaching 0.09 kg/h•m². Then the evaporation flow after this time until 5 hours of operation did not show additional increases, as the values of the evaporative flow obtained were ranged within a margin of error of 3%, which could be attributable to the measurement error of the humidity sensors. According to these results, the stabilization time was estimated to be 2 hours.

In the following experiments, each measurement point corresponds to the flow value determined after a stabilization time of 2 hours.

Analysis of the influence of the water and air temperatures

The SGMD is a thermal process governed by a partial pressure gradient as driving force. This gradient is induced by the temperature difference between both compartments separated by the membrane. Therefore, the greater is the temperature difference between the two phases, the greater is the evaporative flow. This fact justifies the analysis of the influence of the temperature of the water and air streams entering the membrane module.

Since the maximum operating temperature tolerated by the membrane module was 70°C, the variation of the evaporative flow as a function of the water temperature was investigated in the range from 20°C to 67°C (Figure 4). The operation conditions of these tests are equivalent to the ones summarized in the Table 4, but with variation of the temperature of the streams. As it can be observed in Figure 4, the evaporative flow increased with increasing water temperature according to an exponential law under constant air temperature (21ºC). For example, a flux rise of 365% was recorded between 40°C and 67°C. This evolution is directly linked to the increase of water vapor pressure as a function of the water temperature which corresponds to the water vapor enhancement described by Antoine equation. [START_REF] Hengl | Membrane contactor with hydrophobic metallic membranes: 2. Study of operating parameters in membrane evaporation[END_REF] Although the bench installation was not designed to control the temperature of the air stream, the system was prepared to allow the measurement of the evaporative flow at two different inlet air temperatures (21°C and 26°C). Under constant water temperature conditions (60ºC), the decrease of the air temperature increased the temperature difference between the water and the air, thus increasing the evaporative flow. The variation in air temperature should be considered as important as that of the water temperature, since a decrease in the air temperature from 26 to 21ºC increased the evaporative flow by 36%.

Analysis of the influence of the water and air flowrates

According to Khayet, [START_REF] Khayet | Thermal boundary layers in sweeping gas membrane distillation processes[END_REF] the water flowrate at the inlet of the module has practically no effect on the evaporative flow. During the preliminary tests to characterize the bench unit, some experiments were carried out to confirm the insignificant incidence of the water flowrate in the system performance. The obtained results (no shown) confirmed this hypothesis and the same conclusion resulted from experiments with DMI solutions, where the influence of the solution flowrate on the separation process was negligible.

The analysis of the influence of the air flowrate on the evaporative flow revealed it strongly depended on other variables: the temperature of the water appeared as the most relevant operation condition. Therefore, the evaporative flow was determined as a function of the air flowrate at different water temperatures. These operation conditions are summarized in Table 5.

Table 5. Conditions of the experiments for the analysis of the influence of the water and air flowrates. Under the low water temperature conditions (temperatures below 40ºC), an evaporative flow saturation value was reached at 20 L/min. When the feed temperature was increased to 67°C., the saturation stage is shifted at higher air flow rates. Thus, an increase in evaporative flow is recorded with the air flow rate. The increase is 32% when the air flow rate increases from 25 to

Water inlet Air inlet

Concentration of DMI solutions 3.2.1. Analysis of the influence of the initial DMI concentration

The effect of the composition of the feed aqueous solution was studied by reporting the evolution of the evaporative flow as a function of the DMI concentration in the feed solution. The operating conditions of these tests are compiled in Table 6. The DMI concentration was varied in the range 0-33%, the increasing addition of DMI to the feed solution had no effect on the evaporative flow, as the flow maintained a constant value of 0.11 Kg/ h. m 2 .

Analysis of the losses of DMI by permeation through the membrane

During dehydration of an aqueous DMI solution by SGMD, only the water vapor is assumed to pass through the hydrophobic membrane. However, DMI can permeate through the membrane just by steam drag.

In order to detect and quantify any loss of DMI, the air at the outlet of the module was condensed in an immersion trap with liquid nitrogen. The condensate was recovered each 10 minutes, which made possible to have a sufficient quantity for the DMI quantification. Therefore, at the end of the experiment, the condensed evaporative flux is determined by weighing. This condensed evaporative flux corresponded to a fraction of the total evaporative flux, which was determined by calculation from the registered relative humidity values. Two different sets of experiments were carried out with changes in the DMI compositions, one with 10% and the other with 33%. The total losses of DMI depended on the concentration of the feed solution, since the higher losses corresponded to the more concentrated solution: while losses values of 0.120% were assessed for 10% DMI feed solution in the reservoir, the losses increased to 0.195% when 33% DMI feed solution was employed.

Achievement of concentrated DMI solutions

The final aim of the experimental tests consisted of the implementation of a concentration test according to a defined specification: attain an aqueous solution with 50% DMI concentration starting from a solution of approximately 30% DMI. The operation conditions for this concentration test are summarized in Table 7.

Table 7. Conditions of the concentration test to obtain concentrated (50%) DMI solution. The assessment of the amount of DMI that escaped from the module was possible. The DMI loss was expressed as the cumulative mass percentage of DMI in the total condensate mass.

Water inlet Air inlet

Figure 7 shows the evolution of DMI loss as a function of the DMI concentration in the tank, which increased according to an exponential law. It was observed that, at the end of the experimental test (DMI concentration equal to 50%), the cumulative loss was close to 0.55% (this is less than 6 mL per L of evaporated water). This result indicates the possibility to concentrate DMI solutions in spite the very low vapor permeation flux which is certainly low for an industrial process if we compare with classical values of membrane distillation processes for water desalination or concentration of salty solutions in literature (from 0.1 to 10 Kg/ h. m 2

).

However we have to take in consideration that there are not losses of solute in such processes of salty solutions distillation. On the contrary, in the case of the DMI concentration, a critical point concerns DMI losses. These losses are minimized by using a Liqui-Cel SuperPhobic® X50 module which contains hollow fibers with only 40% of porosity and 0.04 µm of mean pore size. These characteristics are responsible of both low vapor flux observed and low DMI losses.

Process modeling and scaled-up design

Once the technical viability of the process for concentration of aqueous solutions of DMI by SGMD was demonstrated, the preliminary design of a scaled-up installation was carried out.

Although highly robust two-dimensional theoretical models for SGMD simulation have been developed, [START_REF] Karanikola | Effects of membrane structure and operational variables on membrane distillation performance[END_REF][START_REF] Charfi | Numerical simulation and experimental studies on heat and mass transfer using sweeping gas membrane distillation[END_REF][START_REF] Plaza | Separation of butanol from ABE mixtures by sweep gas pervaporation using a supported gelled ionic liquid membrane: Analysis of transport phenomena and selectivity[END_REF][START_REF] Perfilov | A general predictive model for sweeping gas membrane distillation[END_REF] several authors have preferred the application of empirical models because of their higher simplicity.

8,9

In this work, an empirical model was proposed to describe the performance of the process as a function of the main operation variables: feed inlet temperature T, air flowrate V AIR and DMI concentration C DMI . The performance of the SGMD system was characterized by the assessment of the fluxes of the two components (water and DMI). On the one hand, the water flux F was calculated with the following equations:

𝐹 = 𝐹 𝑀𝐴𝑋 • 𝑒 𝑉 𝐴𝐼𝑅 𝑉 𝐸 -𝑒 - 𝑉 𝐴𝐼𝑅 𝑉 𝐸 𝑒 𝑉 𝐴𝐼𝑅 𝑉 𝐸 + 𝑒 - 𝑉 𝐴𝐼𝑅 𝑉 𝐸 (1)
𝐹 𝑀𝐴𝑋 = 𝐹 0 • 𝑒 𝛼•𝑇 (2)
𝑉 𝐸 = 𝑉 0 • 𝑒 𝛽•𝑇 (3)
where F MAX is the maximal F value that can be attained at one temperature, V E is the parameter that determines the V AIR influence on the F value (when V AIR equals V E the F value is 0.762•F MAX ), F 0 and V 0 and α and β are the corresponding baseline values and exponential parameters of the temperature dependence of the F MAX and V E values respectively. On the other hand, the DMI flux F DMI was calculated with the following equations:

𝐹 𝐷𝑀𝐼 = 𝐹 • 𝐿 𝐷𝑀𝐼 100 (4)
𝐿 𝐷𝑀𝐼 = 𝐿 0 • 𝑒 𝜔•𝐶 𝐷𝑀𝐼 (5)
Where L DMI represents the percentage of DMI losses through the membrane and L 0 and ω the baseline value and exponential parameter of the concentration dependence. The values of all the parameters required by the proposed model were obtained after minimization of the errors in the fitting of the experimental data and they are compiled in In order to have a simplified outlook to the multi-objective optimization of the installation, Pareto graphs were prepared. Pareto optimal solutions are solutions that cannot be improved in one objective function without deteriorating the performance in at least another objective. [START_REF] Abejón | economic evaluation and optimization of enzymatic membrane reactors for antibiotics degradation in wastewaters[END_REF] In this case, the epsilon constraint method was employed to obtain Pareto graphs that included the total membrane area compared to total air consumption or total heat requirements.

34,35

Figure 10. Influence of the total air requirement as sweeping gas on the total membrane area of the process.

Total air consumption was selected as the most adequate variable to take into account the costs due to the selected air flowrate value. The Pareto that resulted from the consideration of the simultaneous minimization of the total membrane and the air consumption is graphed in However, it is not the case of the feed temperature and the corresponding total heat requirement, which was calculated by considering the heat capacity of pure DMI (1.8 J/g•ºC)

and 60% efficacy in the heat exchanger. [START_REF] Fakheri | The shell and tube heat exchanger efficiency and its relation to effectiveness[END_REF]37 As it can be observed in Figure 11, the reduction of the heat requirement (by selection of lower feed temperature) implied great membrane area penalties. Therefore, the installation should be designed to work at maximal feed temperature.

Nevertheless, even under these optimal conditions, the resulted total membrane area is excessive. In these circumstances, the scaled-up process can not be considered competitive and additional further work will be required. These future tasks should consider the identification of more adequate membrane modules, maybe with increased vapor flux, although this should imply increased DMI losses. The design of more complex configurations, with in series stages to recover DMI from the sweep phase, should be taken into account.

Figure 11. Influence of the heat requirement to increase the feed temperature on the total membrane area of the process.

Conclusions

This work investigated the applicability of sweeping gas membrane distillation (SGMD) to concentrate by dehydration aqueous solutions of 1,3-dimethyl-2-imidazolidinone (DMI). An experimental bench installation equipped with Liqui-Cel SuperPhobic ® membranes was employed to analyze the influence of the main operation variables on the process performance.

This way, the temperature of the feed stream and the air flowrate were identified as the most relevant variables.

The installation was successfully employed to achieve the concentration of DMI solutions from 30 to 50% under batch conditions. The selected membranes were responsible for the low vapor flux observed but were also effective for minimization of DMI losses through the membranes, since these losses were maintained below 1% of the evaporated water flux. This fact implied that more than 99.2% of the DMI fed to the system was recovered in the produced concentrated solution.

Once the technical viability of the process was confirmed, simple empirical models were developed to simulate the performance of the SGMD process for DMI concentration. These models were applied to the design of a scaled-up installation able to concentrate 3400 kg/h of a 30% DMI solution under continuous operation. The analysis of the influence of the main operation variables was taken into consideration to have a preliminary multi-objective optimization of the system by simultaneous minimization of the total membrane area, the heat requirement and the air consumption. The simulations results shown that maximal feed temperature and air flowrate (and the corresponding high operation costs), as well as very high membrane area (9635 m 2 ) were necessary to reach the contradictory objectives of the process.

Under these conditions, the process seemed not competitive for an industrial application and it should be improved before a definitive costs analysis that could be very carefully compared with classical distillation process.

Ackowledments

2 Figure 1 .

 21 Figure 1. Schematic representation of the performance of membrane distillation.

Figure 2 .

 2 Figure 2. Configuration of a Sweeping Gas Membrane Distillation (SGMD) system.

Figure 3 .

 3 Figure 3. Scheme of the experimental SGMD bench installation.

Figure 4 .

 4 Figure 4. Variation of the evaporative flow as a function of the water temperature.

  the evaporative flow as a function of the air flow at different water temperatures is shown in Figure 5. As it can be observed in the figure, the evaporative flow was only slightly dependent on the air flowrate, except for the cases where the highest water temperatures were reached. Indeed, in the water temperature range between 20°C and 50° C, the evaporative flux was practically constant even if the air flowrate was increased from 20 to 34 L/min.

Figure 5 .

 5 Figure 5. Variation of the evaporative flow as a function of the air flowrate for different water temperatures.

  The evolution of the evaporative flux as a function of the time of the experiment was recorded (not shown). A slight variation of the flux (4.5% reduction from the initial to the final sample) was observed. From this hourly-determined register of the evaporative flux, the evolution throughout the experiment of the DMI concentration in the reservoir was calculated and compared with the taken samples (Figure6). The target concentration (50%) was reached after 9 hours of operation.

Figure 6 .

 6 Figure 6. Evolution of the DMI concentration in the feed tank through the time.

Figure 7 .

 7 Figure 7. Variation of the DMI losses as a function of the DMI concentration of the feed solution.

2 ,

 2 the preliminary design of a scaled-up installation was done, a complete sensibility analysis of the water flux through the membrane as a function of the feed temperature and the air flowrate was carried out (Figure8). As the figure shows, the influence of the feed temperature on the performance of the process was more important that the influence of the air flowrate. On the one hand, once certain air flowrate points were attained, values besides these limits resulted in a plateau area where was not possible to increase significantly the evaporation flux. On the other hand, the exponential influence of the feed temperature resulted in highly improved evaporation fluxes were the maximal considered temperature values were applied. The maximal evaporation flux value was 0.141 kg/h•m which corresponded to 70ºC and 80 L/min, but a value equal to 0.136 kg/h•m 2 was obtained with 70ºC and less than 60 L/min.

Figure 8 .

 8 Figure 8. Simulated evaporation flux of the system under different feed temperature and air flowrate conditions.

Figure 9 .

 9 Figure 9. Evolution of the total membrane area required in the installation under different feed temperature and air flowrate conditions.

Figure 10 .

 10 Figure 10. The results clearly demonstrated that air consumption values above 350 m 3 /min only decreased slightly the total membrane area, so air flowrate values below the maximal value analyzed in this work could be selected without excessive detriment in the process performance.

R.

  Abejón acknowledges the financial support from the Spanish Ministry of Economy and Competitiveness (MINECO) through CTQ2014-56820-JIN Project, co-financed by FEDER funds. KERMEL is acknowledged for the financial support of this research. exchanger using a multi-objective optimization genetic algorithm. Sustainability 7:of the influence of the air flowrate on the evaporated water flux (L/min) V 0 Baseline value of V E (L/min) α Exponential parameter of the temperature dependence of F MAX (the concentration dependence of L DMI (ºC-1)

Table 2

 2

summarizes the influence of the operation conditions on the evaporative flux in the SGMD processes.

Table 2 .

 2 Influence of the operation conditions on the evaporative flux.

	Operation conditions
	Feed side	Sweeping

side Temperature Flowrate Flow regime Temperature Flowrate Flow regime

	++++	+ +	/	--	+	/
	+ Positive effect
	-Negative effect
	/ Non-referenced effect

Table 3 .

 3 Characteristics of the hollow fibers in a Liqui-Cel SuperPhobic® X50 module.

	Material	Outer diameter (µm)	Inner diameter (µm)	Bubble point (psi)	Porosity (%)	Pore diameter (µm)
	Polypropylene	300	220	240	40	0,04

Table 4 .

 4 Conditions of the experiments for the assessment of the stabilization time.

	Water inlet Temperature Pression (°C) (bar)	Flowrate (L/min)	Temperature (°C)	Air inlet Pression (bar)	Flowrate (L/min)	HR (%)	Time (h)
	60	1.05	3	21	0.9	30	1.7	1 -5

Table 6 .

 6 Conditions of the experiments for the analysis of the influence of the initial DMI concentration.

	Water inlet Temperature Pression (°C) (bar)	Flowrate (L/min)	Temperature (°C)	Air inlet Pression (bar)	Flowrate (L/min)	HR (%)	C DMI (%)
	67	1.05	3	25	0.9	34	1.7	0 -33

Table 8 .

 8 The satisfactory fitting of the experimental data by the proposed model can be observed inFigures 4, 5 and 7.

Table 8 .

 8 Parameters of the developed SGMD model.

	Parameter	Unit		Value
	F 0	kg/h•m	2	0.0015
	V 0	L/min		0.7265
	L 0	%		0.0228


Abir Laraba

Jérôme François

Isabelle Chrisment

Rahman Shihabur

Raouf Chowdhury
email: sr2chowdhury|rboutaba@uwaterloo.ca

Boutaba

Defeating Protocol Abuse with P4: Application to Explicit Congestion Notification

Keywords: P4, Programmable data plane, Security, SDN, Monitoring, EFSM

In recent years, programmable data planes enabled by the protocol independent switch architecture (PISA) allowed the relocation of network functions closer to traffic flows and thereby the ability to react in real-time to network events. However, expressing complex and stateful network monitoring functions using state-of-the-art data plane programming languages such as P4 still remain challenging. In this context, we propose a method for modeling a stateful security monitoring function as an Extended Finite State Machine (EFSM) and express the EFSM using P4 language abstractions. We demonstrate the feasibility and benefit of our proposed approach in detecting and mitigating Explicit Congestion Notification (ECN) protocol abuse without any TCP protocol modification. Our evaluation shows that the proposed security monitoring function can restore 24.67% throughput loss caused by misbehaving TCP end-hosts while ensuring fair share of bandwidth among TCP flows.

I. INTRODUCTION

Software-Defined Networking (SDN) paradigm promotes high flexibility in network programming. SDN initial design aims at centralizing network intelligence in the control plane. This approach lacks persistent state in the data plane. Thus, network monitoring capabilities are rather limited and complex monitoring functions require the help of the remote controller [START_REF] Feamster | Why (and how) networks should run themselves[END_REF].

In recent years, significant effort has been dedicated for realizing a more intelligent data plane [START_REF] Bianchi | Openstate: Programming platform-independent stateful openflow applications inside the switch[END_REF]- [START_REF] Moshref | Flowlevel state transition as a new switch primitive for sdn[END_REF]. However, the proposed solutions are either hardware specific or remain limited by the originally stateless nature of the data plane specification. To alleviate these limitations, P4 [START_REF] Bosshart | P4: Programming protocol-independent packet processors[END_REF] took a clean slate approach for enabling data plane programmability. P4 enables programmers to define their own packet parsing logic, match-action pipeline for packet processing, and packet deparsing logic for a protocol independent programmable switch architecture (PISA) [START_REF] Bosshart | Forwarding metamorphosis: Fast programmable match-action processing in hardware for sdn[END_REF]. In contrast to the first generation of SDN, i.e., based on OpenFlow [START_REF] Mckeown | Openflow: Enabling innovation in campus networks[END_REF], P4 introduces the necessary abstraction for stateful processing in the dataplane. Stateful dataplane programming enabled by P4 has led to many applications such as traffic measurement [START_REF] Ghasemi | Dapper: Data plane performance diagnosis of tcp[END_REF], [START_REF] Turkovic | Fast network congestion detection and avoidance using p4[END_REF], load balancing [START_REF] Katta | Hula: Scalable load balancing using programmable data planes[END_REF], [START_REF] Miao | Silkroad: Making stateful layer-4 load balancing fast and cheap using switching asics[END_REF] and security enforcement [START_REF] Sivaraman | Heavy-hitter detection entirely in the data plane[END_REF]. However, the P4 language and PISA architecture sacrifice some flexibility in terms of supported operations to ensure packet processing programs can execute at line-rate. These limitations have spurred many workarounds and architecture design extensions in the literature [START_REF] Bifulco | A survey on the programmable data plane: Abstractions, architectures, and open problems[END_REF]. A notable example is P4CEP [START_REF] Kohler | P4CEP: towards in-network complex event processing[END_REF] proposed to ease the use of P4 by describing complex event processing functions using regular Finite-State Machines. In the same vein, we propose to use a general abstraction based on Extended Finite-State Machine (EFSM) for implementing a security monitoring function. We also present a technique to map it to a P4 based data plane. EFSMs achieve scalability by using variables and actions in addition to state transitions in a finite-state machine, in this way enabling complex operations while avoiding state-space explosion.

In order to demonstrate the effectiveness of our security monitoring function in the dataplane, we focus on detecting and reacting to Explicit Congestion Notification (ECN) protocol [START_REF] Ramakrishnan | The addition of explicit congestion notification (ecn) to ip[END_REF] abuse. ECN lies between IP and TCP layers and is used by the network switches to indicate possible congestion based on switch queue occupancy. A misbehaving TCP endhost can choose not to echo a set ECN bit back to the sender, giving the sender the illusion that there is no possibility of congestion in the network. Because of this misinformation many TCP based applications may suffer from this type of attack [START_REF] Ely | Robust congestion signaling[END_REF]- [START_REF] Jero | Automated attack discovery in tcp congestion control using a modelguided approach[END_REF]. Furthermore, we also experimentally demonstrate in Section IV that an attacker can obtain two-third share of the available bandwidth through such an attack.

By nature, TCP is an end-to-end protocol, which limits the capability of monitoring and reaction by intermediate nodes such as switches and routers. In [START_REF] Ely | Robust congestion signaling[END_REF], the authors propose to change the TCP specification to defend against TCP protocol abuse, which is very difficult from a practical standpoint. In contrast, our in-network ECN abuse detection and reaction approach neither requires change to the TCP protocol nor to the end-hosts. To the best of our knowledge, we are the first to propose an approach to mitigate ECN abuses directly within the network without modifying TCP.

Specifically, we make the following contributions:

• an EFSM abstraction to monitor and react to any protocol behavior. In particular, misbehaviors can be tracked in the data plane thanks to a method that maps an EFSM model to P4; • an EFSM-based model to detect misbehaving hosts abusing ECN protocol; • an implementation of our EFSM model with P4 following our proposed mapping method and its evaluation compared to a baseline scenario without ECN protocol abuse monitoring. The evaluation shows the benefit of our approach in ensuring a fair bandwidth share between TCP flows even in the presence of the attacker. The remainder of this paper is organized as follows. We introduce the necessary background and details of our EFSM abstraction and its mapping to P4 in Section II. Then, we describe ECN protocol abuse and the EFSM model to detect that misbehavior in Section III. We report our findings from the experimental evaluation in Section IV followed by a summary of related works in Section V. Finally, we conclude the paper with some future research directions in Section VI.

II. PROPOSED APPROACH A. Overview

Our approach for detecting and mitigating protocol misbehavior in the data plane is outlined in Figure 1. Our objective is to monitor network flows in real-time to identify protocol abuse. The first step in our approach is to transform a protocol specification into an Extended Finite State Machine (EFSM). The advantage of using EFSM over regular Finite-State Machine (FSM) is EFSM's ability to store persistent values in variables, thereby, limiting state explosion. For example, maintaining a counter in a FSM would require one state per counter value, whereas the same can be represented in an EFSM with one variable corresponding to the counter. Once the initial protocol specification is modelled as an EFSM, we extend that EFSM with misbehaviors. In this stage, the EFSM can be also compressed as normal states representing normal behaviors can be merged. We only consider intermediate normal states that are necessary to track before a misbehavior can occur. These first stages of abstracting the model of misbehaviors (i.e., protocol abuses) using EFSM are done manually based on available documentation. Once the EFSM of the protocol is defined and extended with misbehaving states, it is mapped to a P4 program using the language primitives. This stage of mapping the EFSM model to a P4 program is essential and is described in Section II-D.

Finally, when the compiled program is installed on a PISA target switch, all flows are tracked online by maintaining the current state of each connection and all the associated variables of the EFSM. When the EFSM model execution enters a state labelled as misbehavior, different actions can be triggered by the program but need to be defined a priori by the network operator such as dropping the packet, rerouting the packet, generating an alert, applying corrective actions, etc.

The proposed approach detects and mitigates protocol abuse in real-time without involving any distant controller. In the following sections, we present some background about the P4 data plane language, the state machine model and the process used to map an EFSM to the data plane primitives in detail.

B. P4 data plane programming

P4 is a language for expressing how packets are parsed, processed and deparsed by the data plane elements (switches). P4 allows each hardware vendor to provide a target-specific compiler, making the P4 programs portable across different targets. P4 follows a two-step compilation process. The first step generates an intermediate and hardware-independent representation which is compiled in the second step to a specific hardware target. This intermediate representation is designed to be generic enough to capture behavior on a large variety of targets, such as NetFPGA [START_REF] Ibanez | The p4->netfpga workflow for line-rate packet processing[END_REF].

P4 assumes an abstract forwarding model consisting of a programmable parser and a set of match-action tables, divided between an ingress and an egress control pipeline and a programmable deparser as defined in the P4-16 version of the language specification [START_REF]P4-16 Language Specification[END_REF]. The parser extracts the headers from the incoming packets. Each match-action table performs a lookup on a subset of header fields and applies the actions within each table. The deparser's goal is to reassemble packets after they have been processed. In our context, dedicated P4 actions will be defined for transitioning state in the EFSM and so require some states to persist in the data plane across packets. P4 provides three types of stateful objects: It is worth mentioning that in the latest P4 specification (P4-16), registers are supposed to be exposed by extern functions and are thus not anymore hardware-independent as in the previous specification [START_REF]P4-14 Language Specification[END_REF]. However, assuming registers as basic components to be provided by a hardware platform is reasonable. • Metadata: per-packet state which may not be derived from packet data. It allows carrying information across multiple P4 processing stages.

C. EFSM model

We adopt an EFSM model for modeling a target protocol. While there are some variations in the EFSM formalism [START_REF] Alagar | Specification of Software Systems[END_REF], [START_REF] Cheng | Automatic functional test generation using the extended finite state machine model[END_REF], in this paper we represent an EFSM by a 7-tuple (S, E, A, I, V, C, T ) where:

• S is the set of possible states. In our case, S consists of all the protocol states that need to be tracked for detecting misbehaviors.

• E is a finite set of events. An event is triggered by a particular content in the monitored packets such as the presence of a TCP flag in a TCP packet. • I is the set of initial states. In this paper, I represents those states of the protocol from where it is necessary to monitor subsequent states to detect misbehaviors. • V is the set of state variables that are accessible to every state. It is meant to read and write persistent information in an EFSM in addition to the states themselves. This is one of the main advantages of EFSM to avoid creating numerous states for variables. For example, tracking sequence numbers with a regular FSM would require one state for each of the 2 32 possible values. • A is a finite set of actions to be performed. For example, sending an alert or updating a variable v ∈ V . • C is the set of conditions. Each condition c ∈ C is composed of a combination of input events from E and numerical or logical condition on variables from V . This is another major advantage compared to regular FSM where transitions are defined on symbols only. With EFSM, more complex conditions can be described. • T is the set of transitions, where t ∈ T is defined as

s 1 , c → a, s 2 (s 1 ∈ S, s 2 ∈ S, c ∈ C, and a ∈ A).
It denotes a transition from state s 1 to s 2 when condition c is satisfied and results in the action a. For instance, when a misbheavior is detected, the transition from a normal state to a misbehavior state is triggered based on a particular condition (e.g., malformed packet). Besides, to change the system state, we can also send an alert to the administrator or correct the malformed packet as an action.

D. Mapping an EFSM model to P4 Program

Once a protocol specification is modeled as an EFSM for tracking misbehaviors, the model is mapped to a P4 program and the latter compiled to be executed on the data plane. Therefore, the 7-tuple (S, E, A, I, V, C, T ) has to be mapped to the P4 abstraction.

The P4 core primitives mentioned previously (Section II-B) allow us to implement the EFSM in the data plane by maintaining the EFSM states in the switch registers. To monitor network connections behavior in real-time, the data plane tracks and processes the different states and transitions.

1) Maintaining current states: An instance of the EFSM model is maintained for each monitored connection or flow. A flow is formally defined as a set of packets p i : f = {p 0 , p 1 , . . . , p n } sharing the same set of attributes. A unidirectional TCP/UDP flow is represented as (srcIp, dstIp, srcP ort, dstP ort, protocol), where srcIp, dstIp, srcP ort, dstP ort, protocol represent the source IP address, the destination IP address, the source port, the destination port and the transport protocol, respectively. While this is a regular definition of a flow, the format may be freely defined based on the packet headers extracted by the P4 parser. However, in some cases, packets grouped into flows do not match exactly the same selected headers but share some properties. A notable example is bidirectional TCP flows with inverted IP addresses and TCP ports. Grouping packets of a bidirectional TCP flow is needed to monitor the 3-way handshake initiation. One solution to this problem proposed in the literature is If (dstIP > srcIP), hash the former order (dstIps,srcIp, dstPort, srcPort, protocol) otherwise hash the reverse order (srcIp, dstIp, srcPort, dstPort, protocol) [START_REF] Ghasemi | Dapper: Data plane performance diagnosis of tcp[END_REF]. Thanks to this comparison the value of the IP address in the 5-tuple always remains the same whether it is the source or destination address. The same applies to the TCP ports.

Once flow keys are extracted from a packet, we compute a hash function to associate a packet to a flow. The current EFSM state of each flow is mapped to an entry in a register array R = {r0, r1, . . . , rn}, where n is the maximum number of flows to be monitored. These values are accessed and modified by three specific actions:

• state-lookup to query the state register corresponding to the hash of a flow 5-tuple and save it in a metadata. • state-update an action to update the state metadata.

• state-write to write back the new updated state (metadata) in the register. These functions are leveraged in the transition system defined in Section II-D3.

2) Events detection E and mapping variables from V : Events in E are derived directly from the ingress packets. Conditional tests are performed on matching header fields on particular values. Depending on the detected event, variables from V are updated. We distinguish two types of variables according to their nature leading to different representations in P4. First, some variables are persistent across the states of the system and are by definition the EFSM variables, i.e. belonging to V . For example, when tracking a TCP connection sequence numbers, we need to maintain the last seen sequence number. They are per-flow (i.e., per EFSMinstance) variables. For this type of variables, we use registers to store and modify the values of the variables during state transitions. The second type of variables concerns variables which are used only in conditions in C and actions in A of a single transition. As transitions are triggered by event and conditions, this second type of variables is qualified as perpacket metadata. Metadata based variables are associated with the processing of each packet and used temporarily to carry packet related information between the pipeline stages. They are deleted when the processing is completed. For example, they can be used to carry the result of a hash, result of an arithmatic operation, or the value read from a register. For example, the Time-To-Live (TTL) value of a forwarded packet in an L3-switch is solely based on its initial value that is decreased by one. If the forwarding is modelled as a single transition in an EFSM model, the TTL variable does not need to be persistent across states.

3) Mapping of the transition system: The transition system expresses the different transitions (T ) and their components: actions (A), conditions (C), events (E) and variables (V ). Except for events derived from ingress packets and variables defined a priori, actions, transitions and conditions are implicitly defined within P4 actions. Indeed, the current state of a given EFSM evolves according to conditions on events and variables defined in the ingress control of the P4 processing pipeline. It is important to note the difference between EFSM actions and P4 actions. P4 actions are functional code to perform various operations including conditional tests (modelled as conditions in EFSM). More precisely, each c ∈ C is a conditional expression composed of operands to express logical or numerical calculations (e.g., addition, AND, OR, etc.) and comparisons (e.g., less-than, equal, etc.). The set of operations are performed on the stored variables or on the parsed packets header fields. We denote the list of actions with A = {a 0 , a 1 , ..., a n }. Actions are split into two categories. The first category of actions (A1 ∈ A = {f orward, drop...}) determine packet forwarding behavior. The second category A2 represents arithmetic and logic operations to update the variables in V (in P4 metadata or registers) or packet headers. Moreover, to maintain the instance of the EFSM up-to-date, the defined P4 actions rely on particular state maintenance functions described before, i.e., {state -lookup, state -update, state -write}. They are used to check and update the current state according to the defined transitions and incoming packets. Therefore, from a P4 perspective, EFSM states (S) and other variables (V ) stored in registers are handled similarly.

4) Hashing and hardware constraints: The limited hardware resources pose a challenge when offloading some processing to the data plane as highlighted in [START_REF] Miao | Silkroad: Making stateful layer-4 load balancing fast and cheap using switching asics[END_REF] [8], especially to track per-flow state. Similar to these works, we address this challenge by maintaining the hash of 5-tuple of each flow rather than the 5-tuple to reduce the width of flow keys in hardware. To handle hash collisions a hash-chaining method similar to [START_REF] Ghasemi | Dapper: Data plane performance diagnosis of tcp[END_REF], [START_REF] Miao | Silkroad: Making stateful layer-4 load balancing fast and cheap using switching asics[END_REF], which maintains a linked set of values with different keys in the same hash table index can be used.

P4 is designed to support a wide-range of hardware targets. However, one possible question is how the hardware could support the deployment of the P4 externs such as registers that are necessary to maintain the persistent state. Although P4 externs are target-specific, registers are widely-used and expected to be supported by most hardware or software target platforms. For example, in [START_REF] Wang | P4fpga: A rapid prototyping framework for p4[END_REF], authors propose a P4 compiler for various FPGA hardware including stateful objects.

III. APPLICATION TO ECN

In this section, we demonstrate the viability of our proposed approach to detect and mitigate misbehaving end-hosts abusing the ECN protocol.

A. ECN background

TCP end-hosts typically use end-to-end congestion signals such as packet loss or round-trip-time for adjusting their congestion windows. ECN was proposed as a mechanism for network devices to send congestion signals to end-hosts [START_REF] Alizadeh | Data center tcp (dctcp)[END_REF]. Accordingly, a switch experiencing congestion explicitly notifies an end-host to reduce its congestion window. The ECN RFC [START_REF] Ramakrishnan | The addition of explicit congestion notification (ecn) to ip[END_REF] defines the following codepoints and fields for both IP and TCP protocols:

• Congestion Experienced (CE) and ECN-capable Transport (ECT) codepoints for the DSCP field of IP header. • ECN-Echo (ECE) and Congestion Window Reduced (CWR) flags in the TCP header. However, the design of ECN introduces the possibility of having misbehaving end-hosts in the network, i.e., endhosts that do not fully conform to the protocol specification. We illustrate such misbehavior (messages in red) along with the expected normal behavior (messages in blue) of ECN enabled TCP end-host in Figure 2. During the TCP threeway handshake phase (not shown in the Figure ), TCP endhosts negotiate the use of ECN. Following the TCP three-way handshake, the ECN protocol behaves as follows:

• A congested switch detects an ECN-capable TCP connection (ECT set in IP header) and marks the corresponding packet with CE ((1) in Figure 2); • After receiving a packet with CE, the receiver becomes aware of the congestion and informs the sender by setting the ECE flag in the TCP header ((2) in Figure 2); • Once the sender receives a packet with the ECE flag set, it reacts by reducing its congestion window. Then, the sender sets the CWR flag to inform the receiver ((3) in Figure 1), which in turn stops sending congestion notification by unsetting ECE ((4) in Figure 2). ECN RFC defines a possible misbehavior of an end-host announcing itself as ECN-capable but ignoring congestion notification from the switch [START_REF] Ramakrishnan | The addition of explicit congestion notification (ecn) to ip[END_REF]. As shown in Figure 2, once a switch notifies about congestion, the receiving host can misbehave by not echoing back the congestion information to the sender, i.e., set the ECE flag to 0 ((2') in Figure 2). As a result, the sender does not reduce the congestion window ((3') in Figure 2). Another possibility is when the receiver keeps sending packets with ECE set ((4') in Figure 2) even after the sender has already reduced its congestion window. Both of these misbehaviors are represented in Figure 2. In addition, the sender can ignore the notification sent back from the receiver ((2) in Figure 2) by not reducing the congestion window ((3') in Figure 2).

Misbehaving flows can severely degrade network performance. This is why the RFC recommends that such flows must be identified and handled. We do so in this paper by leveraging data plane programmability to embed in-network ECN misbehavior detection and mitigation. Based on these definitions, we illustrate the EFSM corresponding to Figure 2 in Figure 3. For transition between two states, the condition and actions correspond to the labels on the arrows. When a congestion is detected, the switch sets the CE flag to 1 and forwards the packet, i.e., takes two actions: f orward ∈ A and (CE ← 1) ∈ A. When the receiver acts according to the ECN specification, the switch should receive back a message with ECE set, trigerring the event ECE = 1 ∈ E. At this stage, the EFSM state is updated to notif ied and the emitter (or sender) reduces its congestion window. The event CW R = 1 should then be observed and the EFSM should transition to win_reduction state. The EFSM is then updated until reaching the final state notif ication_stopped. In Figure 2, there are three possible events that can trigger a transition to the misbehaving state:

1) When the receiver voluntarily ignores the explicit congestion signal from the switch. In that case, the current state of the EFSM is congestion and the event is ECE = 0, i.e. the receiver does not forward the congestion notification. 2) When the congestion notification has been echoed back to the sender, i.e., state notif ied, but the sender does not reduce its congestion window as observed by the event CW R = 0; 3) When the receiver does not stop notifying the congestion (event ECE = 1) whereas the sender has already reduced its congestion window (state win_reduction). Once a misbehavior is detected the EFSM remains in its state. When a TCP connection is terminated, the associated EFSM is not updated anymore. Although it is out of the scope of this paper, detecting the end of a TCP connection may rely on different mechanisms such as through FIN and RST flags.

When a misbehavior is detected, the packet can be simply dropped. However, we also introduce corrective actions in our approach when possible. The switch cannot effectively verify that the sender has reduced its congestion window. As a result, it is not possible to deduce from the switch if the CWR flag must be really set to one in the second misbehaving case, hence, we drop the packet. However, for the first and third cases, the receiver must react according to the congestion signal (with either CE = 1 or CW R = 1). Therefore, the misbehavior can be corrected by setting or unsetting ECE for the first and third misbehaving cases, respectively, i.e. (ECE ← 1) and (ECE ← 0) are in the action list A.

Since ECE is a TCP flag, altering its value requires updating the checksum. Alternatively, without corrective ac-tions, the packet can be always dropped when a transition to the misbheaving state occurs. Therefore, the full list of actions seen in Figure 3

is A = {ECE ← 1, ECE ← 0, update_chk, CE ← 1, drop}.

C. Mapping ECN EFSM to P4

The EFSM model of the ECN protocol is mapped to a P4 program according to the method described in section II-C. We store the current state of a connection in a register and all other variables in P4 metadata since they do not need to persist across packets. Variables other than the current state are as follows:

• congestion, as already introduced, indicates if the switch is experiencing congestion. This variable is derived from the occupancy level of the switch queues.

• intermediate variables to process the different headers fields, flags and checksum. We perform update_chk action in the egress pipeline. However, instead of performing a costly full calculation of the checksum, we use an incremental procedure [START_REF] Mallory | Incremental updating of the internet checksum[END_REF]. The checksum is incrementally updated using a simple arithmetic function without recalculating the checksum for fields of the packet that have not changed as follows:

HC = HC-∼ m -m
Where :

• HC: old checksum in the TCP header,

• HC : new checksum in the TCP header, • m: old value of a 16-bit field including the former TCP value field (ECE or CW R in our context), • m : new value of a 16-bit field including the modified TCP value field (ECE or CW R in our context), ∼ x : the one's complement of x

IV. EVALUATION

All experiments were performed using P4-Bmv2 software switch [START_REF]P4 Language Consortium[END_REF] with mininet [START_REF] Handigol | Reproducible network experiments using container-based emulation[END_REF] and p4app [START_REF]p4app[END_REF]. The P4 programs were implemented using the P4 specification version P4-16 [START_REF]P4-16 Language Specification[END_REF]. Our evaluation aims at assessing if ECN misbehaviors are appropriately detected and mitigated, and evaluating the overhead introduced by our P4 implementation. Mininet does not allow us to assess performance in realistic conditions in terms of absolute values of the achieved performance. Therefore, a baseline scenario for comparison purposes is used in the different experiments. 1) Bandwidth share and throughput evaluation: To evaluate the impact of the use or misuse of ECN, we measure the throughput of TCP flows to assess if the bandwidth is correctly shared even during congestion. We rely on the topology presented in Figure 4. It is composed of one switch and four hosts (h1, h2, h3, h4). By default, all hosts are ECNcapable and the link latency is set to 1ms. To demonstrate the impact of a misbehaving host during network congestion, we limit the output queue rate (by default to 2000 packets/sec). Previous work on ECN recommends assuming congestion once 65 packets are queued in the switch in case of a 10 Gbits/s network [START_REF] Bai | Enabling ecn in multi-service multi-queue data centers[END_REF]. With our setup using mininet, the maximal throughput observed is around 40 Mbits/s, therefore a 3 packets threshold in the queue is considered as congestion and so will trigger the event congestion to leave the init state of the EFSM. We simulate a misbehaving TCP receiver at h1.

We generate TCP flows using iperf between h1 and h2, and from h3 and h4 to h1 and h3, respectively (h1 and h3 are iperf servers). We tweaked h1 to act as a misbehaving host by not echoing congestion information ((2') in Figure 2), i.e. not setting the TCP ECE flag. h1-h2 and h3-h4 flows are thus qualified as misbehaving and normal, respectively.

In Figure 5, we present the throughput of the normal flow (h3-h4) and the misbehaving flow (h1-h2) side-by-side from the following scenarios:

• noMisbehaving-forward: the baseline scenario where all hosts follow ECN specification and the switch forwards packets without modification (neither detection nor reaction activated) • Misbehaving-noReaction: h1 misbehaves but the switch continues to forward packets (neither detection nor reaction activated). • Misbehaving-ECEreaction: similar to the previous case but the switch implements misbehavior detection and applies corrective measures limited to the first type of misbehavior. The switch implements partially the EFSM of Figure 3 with S = {init, congestion, misbehaving}. • Misbehaving-fullReaction: the switch implements the full EFSM we proposed in Figure 3 while h1 continues to be a misbehaving host.

In Figure 5, the boxplots represent 10 simulation runs of 60 seconds each. In the case of no misbehaving hosts (noMisbehaving-forward), a fair bandwidth share is observed, each flow getting around 21 Mbps. In contrast, the misbehaving flow h1-h2 consumes most of the available bandwidth at the expense of the flow h3-h4 when our switch is not programmed to detect and react to misbehaviors (Misbehaving-noReaction). More precisely, the misbehaving flow reaches an average of 22 Mbps while there is only 11.3 Mbps left for the normal flow (66% vs. 34% share). In fact, the normal flow (h3-h4) responds to the congestion signal and reduces its transmission rate, leaving more queue space to the misbehaving flow which gains more share of the bandwidth. However, effective throughput is still limited by the sender capacity and thus the increase of the misbehaving flow is lower When we turn on misbehavior detection and mitigation in the switch (Misbehaving-ECEreaction), Figure 5 shows that our solution properly redistributes the bandwidth and ensures almost equal share between the two flows. In fact, the normal flow regains 24.67% of the throughput loss caused by the misbehaving flow. However, there is a throughput degradation compared to the baseline scenario due to the verification and mitigation process performed by the P4 program. Similarly, when the full EFSM is instantiated (Misbehaving-fullReaction), an equal share is also observed, however, the performance is degraded around 10 Mbits/s per flow. The normal flow's throughput becomes even lower than that in the Misbehaving-noReaction case. Therefore, we recommend a partial implementation of the EFSM against misbehaving ECN hosts limited to when the congestion information is not echoed back (ECE = 0). It saves switch resources and avoids wasteful reaction to a bad CWR flag. As can be seen from Figure 3 and described in Section III-B, it is impossible for the switch to apply an appropriate correction for the latter case (only the TCP end-host can effectively reduce its congestion window).

In Figure 6, the normal flow's throughput is measured while varying the output queue rate. For low values below 500 packets/second, the throughput is independent of the type of scenario, i.e., with or without reaction, with or without misbehaving flows. This is because the queue rate is too low to allow the misbehaving flow to really gain some share of the bandwidth. Then, the bandwidth share rapidly becomes imbalanced between flows when the switch only forwards packets without detection and correction. When the recommended corrective actions are applied, regain in throughput is possible for up to a certain queue rate. After this threshold, the queue rate allows naturally to reduce congestion without additional overhead in contrast with our solution, so there is little benefit of our approach. Consequently, before deploying such solution, its adequacy to network conditions must be verified. 2) Switch processing time evaluation: In this experiment, our goal is to evaluate the runtime overhead per packet. We consider different switch configurations for this experiment:

• L3: parsing is limited up to the IP header.

• L4: L3 + TCP header parsing.

• ECE-v: the state machine is partially implemented to model the normal behavior; states S are restricted to {init, congestion, notif ied} in Figure 3. • ECE-v-r: the state machine is partially implemented to monitor and react to the first misbehavior type, ((2') in figure 2); S is restricted to {init, congestion, notif ied, misbehaving}. • full-v: the full state machine is implemented except for the corrective actions and checksum recalculation. • full-v-r: similar to full-v but including the reaction against the first-type of misbehavior ((2') in Figure 2) by setting ECE to 1 and including checksum recalculation.

We deploy a simple topology with a single switch and two hosts (server and client). We generate 1000, 5000 and 10000 flows between the hosts and report the processing time per packet in Figure 7. The median value is 2.7 ms, 2.7 ms, 3.5 ms, 3.7 ms, 4.6 ms and 5 ms for L3, L4, ECE-v, ECE-vr, full-v and full-v-r scenarios, respectively. Parsing TCP does not add a significant cost compared to IP parsing. As expected, the more complex the EFSM, the higher the overhead, which is consistent with the results in Figure 5. It is worth noting that corrective actions incur less overhead than monitoring using a more complex EFSM when comparing the increase between ECE-v and ECE-v-r and between full-v and full-v-r. Finally, as can be seen from Figure 7, our approach is scalable with respect to the number of flows to monitor in parallel.

A. Discussion on memory overhead

The implementation of our solution on programmable hardware raises the issue of memory constraint. In our approach, the P4 program needs to keep one register entry for each flow's current state, which will require a register array large enough to track all the active TCP connections. Metadata fields that carry information between tables consume a negligible amount of bits [START_REF] Bosshart | Forwarding metamorphosis: Fast programmable match-action processing in hardware for sdn[END_REF]. Each entry in the state register has 32 bits for the flow key hash and 32 bits for the value (current state). The state registers can be implemented with TCAM or hash-based memory. State-of-the-art programmable hardware provide sufficiently large memory to accommodate state registers capable of holding 10s of thousands of active TCP connections. For example, P4FPGA [START_REF] Wang | P4fpga: A rapid prototyping framework for p4[END_REF] can implement up to a 288 bits key for TCAM or hash-based memory and can fit up to 93K entries.

V. RELATED WORKS SDN has brought new capabilities for network monitoring. Initially, control plane-based monitoring enabled by OpenFlow [START_REF] Mckeown | Openflow: Enabling innovation in campus networks[END_REF] was proposed where switches report monitoring information such as counters to a remote controller. In this paradigm, the controller directly controls the monitoring frequency and the granularity of flow rules to monitor. This created the opportunity for dynamically controlling such parameters based on monitoring needs [START_REF] Jose | Online measurement of large traffic aggregates on commodity switches[END_REF]. For instance, the work in [START_REF] Chowdhury | Payless: A low cost network monitoring framework for software defined networks[END_REF] proposes to adapt reporting frequency based on the variability of past observations. Another area explored under SDN monitoring is the use of sketches to capture more sophisticated information from network traffic beyond the already built-in counters [START_REF] Yu | Software defined traffic measurement with opensketch[END_REF]. One common trait in all of these solutions is that they are stateless and allow to retrieve general statistics about flows but do not allow to track more complex protocol behaviors. To do so, it is possible to mirror packets to middleboxes that can employ further processing to reconstruct the protocol state machines [START_REF] Zhu | Packet-level telemetry in large datacenter networks[END_REF].

In contrast to the above stateless solutions, we propose in-network monitoring of protocol state-machines. There has been some research in the direction of extending OpenFlow with stateful processing capabilities. For example, OFX [START_REF] Sonchack | Enabling practical software-defined networking security applications with ofx[END_REF] extends OpenFlow with an external agent running on the switch with stateful monitoring capabilities. Oko [START_REF] Chaignon | Oko: Extending open vswitch with stateful filters[END_REF] proposes to extend OpenFlow capabilities with extended Berkley Packet Filter (eBPF) for stateful processing [START_REF] Chaignon | Oko: Extending open vswitch with stateful filters[END_REF]. However, Oko is exclusively limited to Linux-based software switches. In contrast, our solution can be deployed in any data plane device along the packet processing pipeline.

The recently emerging PISA architecture and the accompanying P4 programming language has inspired many research works in stateful dataplane processing. For instance, stateful load balancing in the data plane has been proposed and implemented using P4 [START_REF] Miao | Silkroad: Making stateful layer-4 load balancing fast and cheap using switching asics[END_REF]. TCP connection diagnostic in the data plane has been proposed in Dapper [START_REF] Ghasemi | Dapper: Data plane performance diagnosis of tcp[END_REF]. Authors in [START_REF] Turkovic | Fast network congestion detection and avoidance using p4[END_REF] propose a solution to track queuing delays and react in data plane by rerouting flows. A typical use case explored using data plane programming is DDoS detection such as those presented in [START_REF] Lapolli | Offloading real-time ddos attack detection to programmable data planes[END_REF] and [START_REF] Zhang | Poseidon: Mitigating volumetric ddos attacks with programmable switches[END_REF]. Authors in [START_REF] Kang | Automated attack discovery in data plane systems[END_REF] made the first step toward mitigating attack targeted to switch programs. They proposed mechanisms to analyze the expected behavior of a P4 program and discover malicious traffic patterns that would cause it to misbehave. Recently, some research effort has been dedicated to performing complex calculations in the data plane such as logarithms, which are not supported by default [START_REF] Ding | Estimating logarithmic and exponential functions to track network traffic entropy in p4[END_REF].

To the best of our knowledge, we are the first to address the ECN misbehaving problem without requiring a TCP protocol modification [START_REF] Ely | Robust congestion signaling[END_REF]. Furthermore, we provide a general abstraction based on an EFSM and its mapping to P4. A closely related work is OpenState [START_REF] Bianchi | Openstate: Programming platform-independent stateful openflow applications inside the switch[END_REF], however, it is limited to regular FSM and variables representing stateful information cannot be stored. SDPA [START_REF] Sun | Sdpa: Toward a stateful data plane in software-defined networking[END_REF] is also an OpenFlow extension to support stateful packet processing in the data plane. The authors introduce a new component to manage the state machine at the switch. While they propose a hardwarespecific implementation (on FPGA), our solution relies on P4 for supporting different hardware platforms. A hybrid system coupling the data plane and the control plane to maintain a state machine has been proposed in [START_REF] Moshref | Flowlevel state transition as a new switch primitive for sdn[END_REF].

The abstraction proposed in this paper shares the basic principals with FlowBlaze [START_REF] Pontarelli | Flowblaze: Stateful packet processing in hardware[END_REF] by modelling EFSM in the data-plane. However, FlowBlaze proposes to extend the RMT models with dedicated tables for EFSM and a language similar to P4 for utilizing those tables. Therefore, FlowBlaze can be considered as a parallel endeavour to P4. In contrast, we rely on P4 for its generality and its higher adoption in commercial switches.

VI. CONCLUSION

In this paper, we proposed an EFSM abstraction for monitoring protocol abuse and reacting appropriately when such abuse is identified. We also proposed a method for mapping an EFSM model representing a protocol state-machine to network data plane primitives using P4. We demonstrated the feasibility of our proposal through the ECN protocol use case in which we guarantee an equal bandwidth share even in the presence of misbehaving end-hosts. We conclude that an EFSM model can be partially implemented to mitigate selected misbehaviors without incurring overhead. As future work, we plan to further explore the attack space and end-host misbehaviors targeting other protocols.

Fig. 1 .

 1 Fig. 1. Approach overview

Fig. 2 .

 2 Fig. 2. ECN (normal behavior in blue, misbehavior in red, ellipses represent EFSM state updates)

Fig. 3 .

 3 Fig. 3. ECN state machine with misbehavior detection and correction

Fig. 4 .

 4 Fig. 4. Experimental topology used in mininet

Fig. 5 .

 5 Fig. 5. Bandwidth share for a queue rate of 2000 packets/sec

Fig. 6 .Fig. 7 .

 67 Fig. 6. Responsive h3-h4 flow throughput depending on the output queue rate

ACKNOWLEDGEMENT

This work was partly supported by the FrenchPIA project Lorraine Université d'Excellence, reference ANR-15-IDEX-04-LUE.