## 3 System Model
### Communication Channels
#### 4.3.1 Connection Directly  
This section will describe the direct connection mode for unreachable nodes. As shown in Figure 11, in the previous steps, node \(u_{A}\) has been contacted by node \(u_{B}\) through a route lookup in the overlay network, but needs to transfer messages through the reachable node to which it is connected and can only perform simple message transfer. The yellow arrows in the upper plane indicate data transmission in the virtual plane and the yellow arrows in the lower plane indicates data transmission between routers in the physical bearer network. The next step is to make the two unreachable nodes connect directly with the help of this reachable node, as shown in Figure 12. As the unreachable node does not have an IP address and port for active access to the public network, all messages are forwarded by the reachable node before the connection is obtained. These messages are also authenticated and encrypted by the method previously described, thus ensuring security in transmission. Specifically, when nodes \(u_{A}\) and \(u_{B}\) establish a direct connection, they obtain their mapped IP address and port number in the public network by actively sending packets out. If the other node opens this port for it in its previous NAT or firewall device, then it can use the IP address and port number mapped in the public network to transmit packets directly to and from the unreachable node, thus completing the establishment of the communication channel. The detailed steps for establishing a communication channel between unreachable nodes \(u_{A}\) and \(u_{B}\) are as follows. Figure 11: Direct connection packet flow diagram for unreachable nodes \(u_{A}\) and \(u_{B}\) in the overlay and underlay planes. 1. First, assume that node \(u_{A}\) has already determined that node \(u_{B}\) is unreachable by the method described previously, and has found a reachable node \(r\) that maintains a long connection with node \(u_{B}\), and has already established an encrypted transmission channel. When the \(u_{A}\) node and the \(u_{B}\) node have the intention to establish a communication channel, an initialisation message to help establish the connection is sent to the reachable node \(r\). 2. The reachable node \(r\) receives the message and finds the long connection session of node \(u_{B}\) in its own table of unreachable nodes, and sends to node \(u_{B}\) a message about the wish of node \(u_{A}\) to connect and an already open UDP port. 3. The \(u_{B}\) node receives the message and sends a UDP packet to the open port of the reachable node \(r\) and informs the reachable node \(r\) via a long connection. 4. The reachable node \(r\) receives the UDP packet and records the IP address and port number of the source of the packet. This is the IP address and port number that the \(u_{B}\) node maps to the public network, and then sends this information to the \(u_{A}\) node along with an open UDP port of the reachable node \(r\). 5. After receiving the message, node \(u_{A}\) sends a UDP packet to the open port of reachable node \(r\) and informs reachable node \(r\) via a long connection. 6. Reachable node \(r\) receives a UDP packet and records the IP address and port number of the source of the packet. This is the IP address and port number that node \(u_{A}\) maps to the public network and then sends this information to node \(u_{B}\). 7. The \(u_{B}\) node receives it and sends a UDP packet to the IP address and port number that the \(u_{A}\) node injects into the public network. Obviously this packet will not be received by \(u_{A}\) because the NAT device or firewall prior to node \(u_{A}\) does not have this address mapped. However, the NAT device or firewall prior to node \(u_{B}\) has created a mapping for this IP address to the port. After sending the UDP packet a message is sent to the reachable node that the transmission has been completed. 8. Reachable node \(r\) receives this message and forwards it to node \(u_{A}\).