Mobile Store-and-Forward Without Cellular Backhaul

Mechanism

The mechanism comprises four cooperating stages: ingestion, custodial buffering, transit, and contact-triggered egress. At ingestion, a mobile node within radio range of an originating sensor or peer receives a credentialed observation, validates the originator's signature and the message's structural admissibility under the local policy, and accepts the segment for carriage. Acceptance is itself a credentialed action: the mobile node binds a carriage attestation to the segment, recording the carrier's identity, the time of acceptance, and the position at which acceptance occurred. The carriage attestation is appended to — never substituted for — the originator's credential.

Custodial buffering treats the outgoing queue as a typed store rather than a generic byte buffer. Each enqueued segment is indexed by originator authority, by destination scope (which receivers are eligible to admit it), by temporal scope (the window during which the observation remains semantically valid), and by FEC group. Segments belonging to the same logical message are kept linked through their FEC parity references so that, if the carrier transits past a partial set of receivers, partial delivery does not destroy the ability of a later, fuller delivery to reconstruct the message. The buffer is bounded; eviction policy prefers segments whose temporal scope has expired or whose destination scope is no longer reachable from the carrier's projected trajectory.

Transit is the phase during which the carrier is out of contact with both originator and intended receivers. During transit, the node performs no re-origination — it does not re-sign payload as its own, does not strip prior credentials, and does not collapse hop history. The payload is treated as cargo. The only mutation permitted is the addition of further carriage attestations if the carrier hands off to another mobile node mid-transit (a vehicle handing payload to a drone, or a drone handing payload to a fixed roadside unit), each handoff appending a further credentialed hop record.

Contact-triggered egress activates when the carrier's radio detects an eligible receiver and a structural negotiation establishes that the receiver's admissibility policy can evaluate the originator's credential. The carrier transmits the buffered segments together with their accreted hop history. The receiver does not trust the carrier; it validates the originator's signature, walks the hop record to confirm structural continuity (each carriage attestation cryptographically chained to the prior), reassembles segments under their FEC group, and admits the message under the same admissibility evaluator it would apply to a live transmission. Successful admission produces an acknowledgement that propagates back along the carriage chain, allowing the carrier to release the segment from its buffer.

The integrity guarantee is structural: a receiver admits a payload if and only if the originator's credential validates, the hop history is internally consistent, and the FEC reassembly succeeds within the declared parameters. Tampered segments fail FEC, stripped credentials fail signature verification, and forged hop records fail chain validation. The architecture does not need to assume a trusted carrier — it produces equivalence between live transmission and store-and-forward delivery as a property of the credential evaluation, not of the transport.

Operating Parameters

Buffer capacity is configured per-node as a function of available non-volatile storage and expected disconnection duration. A vehicular node with hundreds of gigabytes of solid-state storage may carry a multi-day backlog; a battery-constrained pedestrian handset may carry only minutes of payload before eviction begins. The eviction policy is configurable by scope: scopes that require strict delivery may pin payload until expiry, while best-effort scopes may permit aggressive eviction under storage pressure.

Temporal-scope windows are declared by the originator at the time the observation is signed. A traffic-incident observation may carry a five-minute scope; a road-condition observation may carry a multi-hour scope; a structural-survey observation may carry a multi-day scope. The carrier evaluates remaining temporal scope at each opportunity to forward, dropping segments whose scope has expired before contact rather than transmitting stale data that would be rejected at the receiver.

FEC parameters — the segment size, the parity ratio, and the reassembly threshold — are set per-message by the originator and travel with the segment metadata. Higher parity ratios increase the probability that a partial delivery (e.g., a brief drive-by contact) yields a reassemblable message, at the cost of bandwidth. Deployments in geographies with short, intermittent contact windows configure higher parity ratios than deployments with long contact windows.

Hop-record depth is configurable per scope. A scope that requires full carriage provenance (defense, regulated supply chain) records every carriage attestation; a scope that prioritizes payload size over forensic depth (best-effort civilian telemetry) may collapse intermediate carriage attestations into a single bonded summary, retaining only the originator and final-carrier credentials. Both modes preserve admissibility — only the depth of forensic reconstruction varies.

Contact-detection cadence balances battery against forward latency. A node that scans aggressively forwards payload sooner but consumes power; a node that scans sparsely conserves power but extends latency. Cadence is typically tied to the carrier's velocity and projected trajectory: a stationary carrier can scan rarely, while a high-velocity carrier scans often to avoid passing through a contact opportunity without detecting it.

Alternative Embodiments

One embodiment carries payload in vehicular fleet operation: delivery vans, taxis, transit buses, and long-haul trucks running conforming radios accumulate credentialed observations from roadside sensors, traffic-incident reports, and peer vehicles, then forward them as their routes pass through anchor coverage. The fleet itself becomes the propagation substrate; no dedicated mesh infrastructure is required along the corridor.

A second embodiment uses unmanned aerial vehicles as long-range carriers between disconnected ground meshes. A drone overflying a remote agricultural sensor cluster collects credentialed observations and carries them back to a ground station whose admissibility policy admits the originating sensors. Maritime variants substitute autonomous surface vessels or buoy-tethered relays for the drone.

A third embodiment runs on pedestrian-carried smartphones in dense-urban environments where municipal mesh coverage is partial. The handset carries observations between coverage cells, contributing to citywide propagation as a side effect of normal pedestrian movement. The handset's contribution is credentialed by the user's enrollment, and the user's privacy is preserved because the handset acts as carrier rather than originator.

A fourth embodiment is the expeditionary defense variant, in which dismounted units, ground vehicles, and tactical UAVs each carry payload between forward positions and rear-area anchors. The lack of cellular or satellite backhaul in contested geographies is precisely the case the architecture is designed to address; admissibility is preserved through coalition credential cross-recognition.

A fifth embodiment composes mobile store-and-forward with planned cross-mesh reconciliation: a region intentionally disconnected for security or regulatory reasons accumulates outgoing observations on mobile carriers, and the carriers transit the boundary at scheduled times to deliver and receive payload under the gateway authority's policy. Disconnection becomes a configurable property rather than a deployment failure.

Composition With Adjacent Primitives

Mobile store-and-forward composes with the credential layer that governs live transmission. There is no second protocol for stored payload — the same originator signatures, scope declarations, temporal bounds, and admissibility evaluators that govern in-the-moment messages also govern carried messages. A receiver does not branch on transport mode; it evaluates the credential, and the credential is invariant under carriage.

It composes with FEC-bounded segmentation. Because each segment is independently credentialed and the FEC group is declared at origination, partial deliveries from successive carriers can be combined at a receiver without coordination among the carriers. Two vehicles passing the same fixed receiver hours apart can each contribute parity to the same logical message, and reassembly succeeds when the threshold is met.

It composes with proximity-aware routing in the adaptive index: when a mobile carrier comes into contact with multiple eligible receivers simultaneously, the carrier selects forward targets based on the composite of network proximity and the receiver's trust score within the relevant scope. Carriage does not bypass governance; it routes payload through the same governance lattice as live traffic.

It composes with cross-mesh reconciliation: when a region reconnects after intentional disconnection, the queued payload accumulated by mobile carriers feeds the reconciliation channel. Carriers therefore do not need separate handling for "stored" versus "queued" payload — both flow through the same admissibility evaluator at the gateway.

It composes with lineage-bound observations such as multilateration: a position estimate computed during disconnected operation, signed with its contributing range observations, can be carried back to the consuming authority and admitted on the strength of its lineage rather than on the strength of any continuous network presence during computation.

Prior-Art Distinction

Delay-tolerant networking (DTN) as standardized in RFC 4838 and the Bundle Protocol (RFC 5050 / RFC 9171) provides custodial transfer of bundles between nodes through intermittent connectivity, but it does not bind admissibility to originator credential in the manner disclosed here. In conventional DTN, a custodian's acceptance of a bundle is a transport guarantee; the application-layer trust model is left to the user. The disclosed architecture binds admissibility into the protocol layer itself, so a receiver's decision to act on a delivered payload is the same decision regardless of whether the payload arrived live or through a chain of custodians.

Disruption-tolerant mesh systems used in expeditionary defense (e.g., variants of MANET and tactical-data-link store-and-forward) typically assume a homogeneous trust domain and a single signing authority. The disclosed architecture supports heterogeneous credentials, cross-authority admission via credential cross-recognition, and per-scope policy variation, allowing one mobile substrate to serve multiple authorities concurrently without collapsing their trust boundaries.

Mobile-app store-and-forward used in messaging applications (e.g., mesh-messenger products that relay payload between handsets out of cellular coverage) provide payload carriage but conventionally re-encrypt and re-authenticate at each hop, breaking the originator credential. The disclosed architecture preserves the originator credential across an arbitrary chain of carriers, so a receiver can evaluate the originator's authority directly.

Vehicular ad-hoc networks (VANETs) and V2X messaging support short-range peer transmission with credentialing, but conventional designs scope credentials to the immediate transmission rather than to a multi-hop, multi-day carriage. Extending the credential's lifetime and cross-carrier durability to match the mobility profile of the carrier — rather than the radio horizon of the originator — is the structural distinction.

Cellular-backhaul-dependent IoT and smart-infrastructure architectures are not store-and-forward at all; they assume continuous connectivity. The disclosed architecture removes that assumption while preserving the operational equivalence of admitted payload, which conventional architectures cannot do because they tie admissibility to the connection state rather than to the credential.

Disclosure Scope

U.S. Provisional Application 64/050,895 discloses the architecture by which mobile nodes accumulate credentialed payload during disconnection, transport it under credentialed carriage attestations, and forward it at contact such that receivers admit on the originator's authority rather than the carrier's role. The disclosure encompasses the structural integration of carriage attestation with originator credential, the FEC-bounded segmentation that preserves reassembly across partial deliveries, the per-scope eviction and temporal-bound policy, the configurable hop-record depth, and the composition with admissibility evaluation as a single uniform mechanism for live and stored payload.

The disclosed scope contemplates implementation across vehicular, aerial, maritime, pedestrian, and tactical mobile substrates, and across civilian, commercial, regulated, and defense operating contexts. It contemplates carriers operating singly and in chained handoff, and it contemplates receivers that admit payload on the strength of credential evaluation alone without any side-channel attestation of the carrier's role. Implementations falling within this scope, regardless of radio choice, vehicle class, or operating geography, are within the disclosure.