CROSSLINK / SECURE MESH OVERLAY
CrosLink is a managed mesh overlay network built on QNyx, Xaoc Industries’ purpose-built secure transport protocol. It brings node identity, encrypted connectivity, and network operations into one coherent architecture.
Post-quantum cryptography inspired by CNSA 2.0. A control plane designed to coordinate—not terminate—your protected data paths.
CrosLink is under active development. Cryptographic design references are not a claim of CNSA certification or product validation.
Nodes are enrolled and authenticated through cryptographic identity.
Management coordinates the mesh; protected traffic follows its data path.
QNyx provides authenticated, encrypted transport with post-quantum design.
QCore presents network state, changes, and operational feedback.
ARCHITECTURE
CrosLink is not a single tunnel endpoint with a dashboard attached. It is a system in which the transport, coordination service, and operator interface each have a defined role.
Secure transport at the node
QNyx runs at the network edge. It establishes authenticated peer sessions, protects traffic in transit, and connects the overlay to the host’s network stack.
Message relay and coordination
QCtrl provides a rendezvous channel between the operator’s controller and deployed nodes. It relays protected management messages without serving as the network’s traffic gateway.
Fleet controller and operator UI
QCore gives network administrators a place to define desired connectivity, issue authenticated changes, and review status and events across the deployment.
Trust boundary: the coordination service is not intended to hold the keys to protected application traffic. QNyx endpoints enforce their own cryptographic session and configuration trust.
NODE LIFECYCLE
The lifecycle is designed to make node trust explicit and operational changes auditable—without asking every administrator to manage cryptographic primitives by hand.
A node creates or loads its cryptographic identity locally. The public identity is used to recognize the participant; private key material remains under endpoint control.
The node and QCore find one another through QCtrl. The relay provides a coordination path, while the parties establish a protected management relationship.
Configuration updates are authenticated against trusted controller identity and checked before they are accepted. A node does not treat arbitrary relay content as an instruction.
The node reconciles the accepted configuration with its local tunnel and routing state. Changes are applied at the endpoint, where the network interfaces and peer sessions live.
Nodes provide health and status information to the controller. Session refresh, reconnection, and lifecycle handling support ongoing operation as conditions change.
DATA PLANE / CONCEPTUAL FLOW
The protected data path is endpoint-to-endpoint. QCtrl helps coordinate the network, but it is not positioned between the communicating systems as a traffic inspection or decryption service.
Traffic selected for the overlay enters the node’s protected networking path. Network intent determines which destinations are carried by the mesh.
QNyx applies peer-session protection before traffic crosses the underlying network. The transport is designed to avoid exposing application content in transit.
The receiving QNyx endpoint validates and opens protected traffic, then passes accepted packets back into the destination network stack.
This is a conceptual architecture illustration, not a packet-format specification. It intentionally omits protocol framing, key schedule details, internal concurrency, and implementation-specific behavior.
CRYPTOGRAPHIC DESIGN
QNyx uses a cryptographic architecture inspired by the CNSA 2.0 algorithm direction. The intent is to combine modern key establishment, strong identity, and authenticated data protection into a protocol built for secure networking.
Post-quantum key establishment for creating shared session material between authenticated participants.
Post-quantum digital signatures used to support cryptographic identity and authenticated management.
Authenticated encryption designed to protect the confidentiality and integrity of tunneled traffic.
Cryptographic hashing used as part of the protocol’s security design.
Secure deployment also depends on identity custody, trusted configuration, endpoint security, operational policy, and correct integration. CrosLink is designed to make those responsibilities visible rather than hiding them behind a single “connect” button.
“CNSA 2.0-inspired” describes algorithm selection and design direction. It does not imply NSA approval, CNSA certification, FIPS validation, or a third-party security assessment.
OPERATIONS FOR TECHNICAL TEAMS
Administrators define connectivity and policy at the controller. Nodes validate and apply their own assigned configuration rather than depending on a central gateway to forward every packet.
Cryptographic identity and configuration trust are checked by the endpoint. The coordination service is not treated as an authority simply because it can relay a message.
QCore surfaces device health, peer state, live traffic rates, activity, and configuration outcomes so operators can see what the network is doing—and where attention is needed.
Connection management, session refresh, restart, and reconnect actions are available as part of the node lifecycle, helping operators respond to transient conditions.
QCORE / OPERATOR EXPERIENCE
QCore turns the mesh into an operational view: see which devices are online, how peers connect, which links are up, and which nodes need attention. Select a device to inspect its overview, configuration, and daemon logs.
TRANSPORT FOUNDATION
CrosLink is built on QNyx, a userspace secure transport engineered in Rust. The protocol is designed to deliver practical throughput without requiring a custom kernel module.
In a 10 Gbps test environment, QNyx recorded 5.16 Gbps receiver throughput in a 10-second iperf3 run. The supplied same-environment WireGuard-go userspace result was 3.93 Gbps.
Read the QNyx benchmark context ↗Reported results from a specific test setup; not a universal throughput guarantee. Benchmark methodology and host/network conditions matter.
CTO QUESTIONS
A few direct answers for teams evaluating a new secure overlay.
CrosLink is a managed mesh overlay network. QNyx supplies the secure transport underneath; CrosLink brings together node management, coordination, and overlay connectivity. The exact deployment topology depends on the network design.
No. QCtrl is a coordination relay for protected management exchanges. CrosLink’s protected application data path is handled by QNyx nodes and their peer sessions.
The architecture is designed so management payloads are protected between the controller and node. QCtrl facilitates delivery but is not intended to be the authority that interprets or applies configuration.
It refers to the post-quantum algorithm direction informing QNyx’s cryptographic suite. It is not a claim of CNSA compliance, government endorsement, or certification.
CrosLink is under active development. Xaoc Industries is engaging with technically qualified organizations interested in architecture discussions, pilots, and early evaluation.
This overview describes the system’s lifecycle, trust boundaries, and cryptographic roles. It does not publish source code, wire-format details, internal key derivation, low-level packet handling, or implementation-specific operational mechanics.
EARLY TECHNICAL CONVERSATIONS
If you are evaluating secure connectivity for distributed infrastructure, edge environments, or systems that need a different trust model, we would welcome a technical discussion.
