Cybersecurity system for protecting user data in mesh networks using adaptive encrypted data forwarding

Abstract

A cybersecurity system for protecting payload data in mesh networks by means of adaptive encrypted data forwarding, wherein the system comprises: a plurality of network nodes, each network node comprising a communication interface configured to establish wireless communication links with one or more neighboring network nodes; a memory configured to store node identification data, cryptographic key data, payload protection parameters, network topology information, communication link information, and security status information; a processor communicatively connected to the communication interface and the memory; a payload processing unit with a packet interface configured to receive a data payload associated with a source network node and a destination network node;an encryption unit consisting of a cryptographic processing circuit configured to produce encrypted payloads by applying a selected encryption operation to the payloads using the cryptographic key data associated with the payloads; a route evaluation unit consisting of the processor configured to identify a multitude of candidate communication paths between the source network node and the destination network node based on network topology information and communication link information;a security assessment unit consisting of the processor configured to determine a security state for each candidate communication path based on at least one of the following information: node authentication information, communication link integrity information, detected packet change information, node behavior information, cryptographic protection information, or communication anomaly information associated with network nodes forming the respective candidate communication paths;a route selection unit configured to select an encrypted data route from the multitude of eligible communication paths by processing the security condition together with at least one communication parameter that includes the availability of the communication link, the transmission delay, the packet delivery state, the network congestion, or the processing capacity of the node; a forwarding control unit configured to generate protected forwarding information that includes an identifier of the next node and encrypted routing information associated with the selected encrypted data route;and a transmission control unit configured such that the communication interface sends the encrypted payload and the protected forwarding information to a selected next network node, the processor further being configured to repeatedly update the security state and communication parameters during the transmission of the encrypted payload and, as soon as a change is detected that satisfies a route adaptation condition, selects a different candidate communication path and causes subsequent encrypted payload to be sent via the other candidate communication path while maintaining the cryptographic protection of the payload.