## 3 Models and Design Goals  
### System Model and Assumptions  
According to [13], the layered control plane is thought to be more realistic in practical applications. Based on that, our system is composed of the following: the Global Controller (GC), many Local Controllers (LCs), many OpenFlow Switches (OF-Switches), Base Stations (BSs), Access Points (APs) and online learning devices (OLDs). GC and LCs are responsible for dealing with collected information and making optimal decisions. The others make up the data plane, which is mainly for transport packages and collecting road information. Figure 1 depicts the system model.  
Figure 1: The system model.  
**GC:** This is the main controller of the control plane. In traditional SDN systems, the controller is a logically centralized point that has extremely outstanding storage and computing capabilities. Typically, it directs switches to deliver and forward packages by building routing rules. In our system, the GC assumes the primary responsibility of generating system parameters, calculating the device's movement path and constructing route tables for OF-Switches. When there are accidents or emergencies happening, it also selects impacted devices and forms a temporary multicast group. It generates a multicast tree for this group to inform them of conditions in time.
2. **LCs:** These are distributed geographically and manage a specific small area. In our system, the LCs primarily serve the purpose of distributing the computation and storage loads of the GC. They can reduce realistic deployment costs as well. LCs set system parameters and communicate with OLDs. They can verify messages in their local areas and compute fine-grained navigation for OLDs. When there are road situations, they are also composed of multicast nodes to inform and direct OLDs in their areas.
3. **OF-Switches:** Different from conventional switches, OF-Switches are OpenFlow-enabled data switches that communicate with external controllers over the OpenFlow channel. The OpenFlow protocol offers separation of programming network devices and underlying hardware [44]. In our system, OF-Switches perform package lookup and forwarding according to flow tables installed on them.
4. **OLDs:** OLDs offer network access services via wireless communication capabilities, which have limited computing power and storage [45]. Also, tamper-proof equipment is embedded in each OLD that is robust and responsible for generating key cryptographical parameters and performing many encryption and decryption operations [46].
5. **BSs and APs:** OLDs obtain access to the Internet via various ways. Cellular networks like 5G network via BSs and city WiFi via APs are both supported by our system. For software-defined MIoT, to balance heterogeneous networks and allow OLDs in different networks to communicate is much easier compared with conventional networks. * The GC is absolutely trusted and will not suffer any compromise. It has ample computing power and storage space. * LCs are trustworthy, but in cases in which they are compromised, we do not provide them capabilities of trace OLDs' real identities. LCs have sufficient computing and storage space. * The parameters and data stored in OLDs are not available for others.