A method of wireless communication performed by a receiving wireless device, comprising: receiving, from a transmitting wireless device, a set of one or more security keys used to communicate with each of a plurality of relay UEs arranged along a data routing path; receiving a data packet associated with an indication of a first message authentication code and a second message authentication code; determining, based at least in part on a first security key used to communicate with the transmitting wireless device, that the first message authentication code was generated at least in part by the transmitting wireless device, the transmitting wireless device comprising a network access device; determining, based at least in part on a second security key used to communicate with a relay user equipment "UE" configured to relay data from the transmitting wireless device to the receiving wireless device via the data routing path, that the second message authentication code was generated at least in part by the relay UE, wherein the plurality of relay UEs include the relay UE; determining that the indication of the first message authentication code was generated at least in part by a second relay UE; and processing the data packet as received from the transmitting wireless device based at least in part on the determinations that the first message authentication code was generated at least in part by the transmitting wireless device and the second message authentication code was generated at least in part by the relay UE, wherein the determination that the indication of the first MAC was generated at least in part by the second relay UE is based at least in part on: a combination of a first counter value that was written in an enhanced Packet Data Convergence Protocol "ePDCP" header of the data packet by the network access device and a flow identifier that was written in the ePDCP header of the data packet by the network access device, a combination of the first counter value and a locally-stored UE identifier associated with a data radio bearer "DRB" over which the data packet is received by or transmitted from the second relay UE, or a second counter value written in the ePDCP header of the data packet by the second relay UE; and wherein the receiving wireless device comprises a UE. receiving, from a transmitting wireless device, a set of one or more security keys used to communicate with each of a plurality of relay UEs arranged along a data routing path; receiving a data packet associated with an indication of a first message authentication code and a second message authentication code; determining, based at least in part on a first security key used to communicate with the transmitting wireless device, that the first message authentication code was generated at least in part by the transmitting wireless device, the transmitting wireless device comprising a network access device; determining, based at least in part on a second security key used to communicate with a relay user equipment "UE" configured to relay data from the transmitting wireless device to the receiving wireless device via the data routing path, that the second message authentication code was generated at least in part by the relay UE, wherein the plurality of relay UEs include the relay UE; determining that the indication of the first message authentication code was generated at least in part by a second relay UE; and processing the data packet as received from the transmitting wireless device based at least in part on the determinations that the first message authentication code was generated at least in part by the transmitting wireless device and the second message authentication code was generated at least in part by the relay UE, wherein the determination that the indication of the first MAC was generated at least in part by the second relay UE is based at least in part on: a combination of a first counter value that was written in an enhanced Packet Data Convergence Protocol "ePDCP" header of the data packet by the network access device and a flow identifier that was written in the ePDCP header of the data packet by the network access device, a combination of the first counter value and a locally-stored UE identifier associated with a data radio bearer "DRB" over which the data packet is received by or transmitted from the second relay UE, or a second counter value written in the ePDCP header of the data packet by the second relay UE; and wherein the receiving wireless device comprises a UE.