## 3 Design Overview
### Gateway Design and Reordering Process  
The gateway not only performs differentiated protocol conversion but also provides centralized management for the IP-ICN hybrid multipath transmission system. This edge-based solution reduces the internal network management burden and enhances the scalability of the system's functions. Figure 2 illustrates the functional module design and data processing workflow of the gateway. At the ingress gateway, data flows from the IP network undergo access authentication to define the range of ICN services, data, or devices that the user can access, ensuring the security of the hybrid network system. To improve the Quality of Experience (QoE) for different users, the gateway further classifies legitimate traffic to optimize network resource allocation. Based on the traffic classification results, differentiated path selection is provided. For instance, low-latency paths are provided for real-time applications (e.g., video conferencing or streaming), higher bandwidth is allocated for large-scale data transfers (such as large file downloads), and enhanced privacy protection services are offered for applications requiring higher security (such as encrypted communication and enterprise data transmission). The classification module generates the corresponding service EID, which is inserted into the ICN packet generated in protocol conversion module, enabling precise service delivery according to different needs. At the egress gateway, packets first pass through the reordering module, correcting the disorder  
Figure 1: Gateway-based IP-ICN hybrid multipath transmission system. caused by multipath transmission to ensure that content is delivered completely and correctly. The reordered packets then undergo ICN-to-IP protocol conversion and finally pass through the traffic shaping module for smooth transmission, meeting the requirements of the IP terminal. The reordering process is implemented based on the buffer at the gateway node. The gateway maintains a mapping table where the 'Flow ID' serves as the key and the 'Expected Packet Sequence Number' as the value. Incoming packets are first checked against this table to determine whether they have arrived in sequence or out of order. Packets arriving in sequence proceed directly to forwarding, while out-of-order packets are placed in the buffer for reordering. The buffer operates in one of two modes, depending on resource availability, 'admissive state' or'restrictive state'. In the 'admissive state', buffer resources are sufficient to accept all out-of-order packets unconditionally. In the'restrictive state', where resources are constrained, the buffer must perform replacement operations, evicting packets to make room for newly arrived ones. Evicted packets are immediately forwarded to the IP terminals. Within the buffer, we implement the basic reordering functionality using a Red-Black Tree structure. A Red-Black Tree is an efficient self-balancing binary search tree that supports insertion, deletion, and lookup operations in O(logN) time complexity. Its ability to handle these operations efficiently makes it particularly suitable for reordering buffers, which require frequent updates and searches. In the buffer, packets are distinguished by their Flow ID and organized in sequence, with each flow maintaining its own Red-Black Tree keyed by packet sequence numbers. Out-of-order packets entering the buffer are inserted into the corresponding flow's Red-Black Tree. When the element with the smallest sequence number in the tree matches the expected sequence number, all in-sequence packets for that flow are forwarded. After being processed by the reordering module at the gateway node, most packets are forwarded to the IP terminals in-sequence and then delivered to upper-layer applications. Figure 2: Gateway functional module design and data processing workflow. It is important to note that the gateway's reordering service operates on a best-effort basis.