A tunnel on every connection
When Box starts, it opens a separate tunnel to our hub over each of its connections: every built-in SIM, your broadband, even a Wi‑Fi uplink. Each tunnel is set up with the Box's own key, so the hub knows it is talking to your Box and nobody else's.
A tunnel only carries traffic once it is up and authorised. One that can't reach the hub is simply left out.