## 3 The Proposed Architecture
### Advanced Service Layer  
Finally, the upper layer of our architecture, named the advanced service layer including ML, BC data and cloud services, is composed of the ML algorithms, the BC structure and the IIoT business clouds services. The BC structure is equivalent to Hyperledger Fabric and is used to save the access control information related to all assets in the IIoT networks for new creation. A new block is created for a new device or a change of the owner device or any changes regarding asset authorization by the legitimate owner. Smart contract is defined as a finite number of statements with logical condition. Once the predefined conditions are fulfilled specified actions have to take place. In the literature, several works consider smart contract in an access control system for Internet service providing [36], IoT applications [37], and energy systems [38], respectively. Our system is based on a smart contract to ensure the users authentication process to sensors and to identify any malicious usage by reporting any violations into a database in the context of smart manufacturing. The advantage of the proposed solution, beside the usage of BCT, is the employment of an authentication mechanism that has a role to save all information and report any violations. Nonetheless, the solution applies a classical smart contract database and associated functions for authentication control (for example, canRead() and authenticated()) to report any violations that can be the object of a brute force or/and DDoS attack. The solution can be enhanced with an ML-based framework to prevent and detect a brute force attack and DDoS attack as well. A sample of a smart contract data structure for sensor access control is presented in Figure 4 in which a sensor structure is composed of _SensorID_ (defined through a Mac Address format), _OwnerID_ (defined as the identification of the owner), _AuthenticationPwd_ (i.e., the Hash of the user password is stored in the BC), _SensorStatus_ (defined as the status of the sensor with two values: active or not active), _SensorValue_ (used to save the last sensor value), _AuthorizedPerson_ (used to save the authorized persons to manipulate the sensor with a limit of 10), and the _CommandLocation_ structure used to detect a DDoS attack involving _CommandName_, _LocationForSameCommand_ and _CommandTimeStamp_. A first rule stating that once the same _CommandName_ is launched from three different locations (i.e., _LocationForSameCommand_) in a short period of time (according to _CommandTimeStamp_), then a DDoS attack is defined. A second rule statement is defined when three wrong consecutives _userwd_ in a short period of time specified in _CommandTimeStamp_ happens, which is then considered as a brute force attack. As depicted Figure 5, a smart contract code for the authentication process is exhibited to illustrate the condition for a successful authentication and a failed one. In the current work, BC is applied to save the relevant information for sensor access control in the IIoT context. Once the sensor access control information is saved in the BC, we guarantee the data confidentiality, integrity and traceability thanks to the BCT inherent features. On the other hand, ML is used to detect any attack from a traffic packet crossing the IIoT network based on the information stored in the BC to prevent any sensor access control violations. In order to understand the architecture design of the paper, we suppose a coming packet where a user is asking for an authentication on a sensor in the IIoT network. We suppose that we have a client/server application to authorize or deny sensor access.