## 3 Proposed Architecture
### SDN-Enabled Architecture for IIoT  
Figure 1 shows our proposed SDN-enabled IIoT architecture. In order to handle IIoT challenges and enable IT/OT convergence, our proposed SDN architecture is composed of three main structures: the SDN controller, SDN switch and IIoT services, and end user applications. These structures are spread on four layers, those being the machine layer, the operation technology layer, the information technology layer, and the application layer:  
1. _Machine Layer:_ The bottom layer encompasses the manufacturing machines and is usually equipped with heterogeneous sensor networks. In particular, this layer does not contain any SDN equipment due to strict security requirements. Therefore, this layer generates a vast amount of data that shall be transmitted to the application layer (cloud) in real time, and the network bandwidth and real-time requirements may change depending on the different applications (the SDN controller can change the network behavior dynamically). Moreover, this layer should maintain an elevated level of security in fields where there may be dangerous situations for workers near the machines when automatic actuation is in progress. 2. _Operation Technology Layer:_ This layer involves components interacting directly with the physical machines and extracting data from them. Security in these first two levels is a key requirement, because a malicious intruder can compromise the whole operativity of production in addition to the possibility of causing extensive damage to people and the machinery. Moreover, this layer can host submodules that provide computation resources to analyze distributed IIoT data and enable the integration of SDN equipment (i.e., switches) to improve management performances. The IIoT services can include data analysis, computing, and acting as a broker. The IIoT devices are generally limited computation resources. This is why the deployment of a local data analysis service is better in terms of latency. In addition, we propose using an OpenFlow switch in this layer to connect it to the controller (i.e., IT layer). Therefore, the OT layer will be controlled and managed by the SDN controller, which makes the architecture more flexible and scalable. Finally, due to security reasons and time constraints, this level was immediately above the machine layer, and furthermore, we decided to not place SDN controllers in this layer. 3. _Information Technology Layer:_ This layer does not directly involve workers and machinery, so it is possible to have more relaxed requirements compared with the OT. Here, the SDN controllers are the glue that realizes the interaction between the machine layer and the application layer. In particular, the SDN controller represents the network control plane, and therefore, we propose the use of a distributed SDN controller that provides scalability for IIoT networks at scale. On the one hand, this layer directly manages the physical devices such as the IIoT devices via several interfaces and protocols (e.g., the southbound interface) and adapts their behavior according to the application requirements. On the other hand, this layer provides information to the application layer through the northbound interface and API. In the context of Industry 4.0, the SDN can customize the services provided according to the application requirements (e.g., data transmission rate and real time constraint). 4. _Application Layer:_ This layer provides a set of APIs that can be used to design end user applications, such as shop floor monitoring, predictive maintenance, and also providing an abstraction of data generated by the shop floors. Finally, we claim that organizing the architecture in layers is a key requirement to provide the right security policy in each layer. Places that directly involve workers and machinery must ensure maximum security. On the contrary, the upper layers should have lighter security policies to allow users to provide applications and services.