/

/

One reference architecture under every deployment: the layers of a site, the protocol functions this platform relies on, and the evidence that travels with every observation.

Areas · 5 Technologies · 61 Industries · 5

At a glance

Monitoring, incident response and governance

In Security and trust, the monitoring, incident response and governance layer holds incident response, security monitoring and logging and coordinated vulnerability disclosure, each drawn against the standard it follows. Preparing, detecting, containing, recovering and learning, tied to risk management. Central collection and correlation of device, network and application events.

Die probleem

Every node proves what it is

This page shows how Security and trust is put together, layer by layer, from the instrument to the record. Hardware-rooted identity and attestation at every join, PKI, secure boot and signed updates, segmentation between nodes, tenants and sites, operational-technology and wireless security, monitoring and response, and the move to post-quantum keys, planned before it is forced.

Components

• Pole-mounted edge gateway node
• Fixed gas detectors on a drift wall
• Particulate monitoring station and sensor node
• Overhead line sensor on a distribution span
• Private LTE mast on a solar skid
• “AI tower in a box”
• Hardware security module, 1U, in an edge rack
• Data hall row pair with cold-aisle containment

Interfaces

Instrumente

SDI-12 · RS-485 / Modbus RTU · 4–20 mA

Radio

Ethernet · LTE-M / NB-IoT · LoRaWAN

Time and position

GNSS 1PPS

Security

TPM 2.0

Publishing

MQTT

Where it works

• Zero trust and network security
• PKI, secure boot and updates
• Keys, cryptography and post-quantum migration

In the story below

1. The system, part by part
2. Assembly
3. Installation
4. Deployment
5. Connections
6. Operation
7. Failure and recovery
8. Scale and federation
9. What you get

Scenes · 13

Next steps

1. Security and trust · Architecture

   Every node proves what it is

   This page shows how Security and trust is put together, layer by layer, from the instrument to the record. Hardware-rooted identity and attestation at every join, PKI, secure boot and signed updates, segmentation between nodes, tenants and sites, operational-technology and wireless security, monitoring and response, and the move to post-quantum keys, planned before it is forced.

2. Architecture · Security, identity and trust

   Monitoring, incident response and governance

   In Security and trust, the monitoring, incident response and governance layer holds incident response, security monitoring and logging and coordinated vulnerability disclosure, each drawn against the standard it follows. Preparing, detecting, containing, recovering and learning, tied to risk management. Central collection and correlation of device, network and application events.

3. Architecture · Security, identity and trust

   Zero trust and network security

   In Security and trust, the zero trust and network security layer holds zero trust architecture, workload identity and port-based access and link encryption, each drawn against the standard it follows. No implicit trust from network location; each request authenticated, authorised and logged.

4. Architecture · Security, identity and trust

   Device identity and attestation

   In Security and trust, the device identity and attestation layer holds Trusted Platform Module, DICE layered identity and secure device identifiers, each drawn against the standard it follows. A hardware root of trust that holds keys, measures boot and signs attestation evidence.

5. Architecture · Security, identity and trust

   PKI, secure boot and updates

   In Security and trust, the PKI, secure boot and updates layer holds certificate profiles, automated certificate enrolment and revocation and status checking, each drawn against the standard it follows. X.509 certificate and revocation list profiles used across devices and services.

6. Architecture · Security, identity and trust

   Privacy and data protection

   In Security and trust, the privacy and data protection layer holds canadian privacy law, international privacy law and privacy information management, each drawn against the standard it follows. Federal and provincial rules for personal information collected by sites and services.

7. Architecture · Security, identity and trust

   OT security and software supply chain

   In Security and trust, the OT security and software supply chain layer holds industrial security programmes, system and component security levels and secure development lifecycle, each drawn against the standard it follows. Security management system for asset owners of control and monitoring systems.

8. Architecture · Security, identity and trust

   Keys, cryptography and post-quantum migration

   In Security and trust, the keys, cryptography and post-quantum migration layer holds key management lifecycle, hardware security modules and key management interfaces, each drawn against the standard it follows. Generation, distribution, rotation, backup and destruction of keys. Validated modules that hold root and signing keys.

9. Operations

   Every node watched, every incident closed

   Nothing on a network for Security and trust runs unwatched: the console shows each node’s state, plan and evidence. An incident for Security and trust begins with an alert that carries its data and a runbook, and ends only when the operator has recorded the cause and verified the fix.

10. Bywerkings

    Updates in rings, with rollback

    Software for Security and trust is released in rings, so a fault shows on one canary site long before it could reach the whole fleet. A ring for Security and trust goes ahead only on health and data completeness, and a failed gate rolls each node back without anyone travelling to site.

11. Architecture · Security, identity and trust

    5G and wireless security

    In Security and trust, the 5G and wireless security layer holds 5G system security, network product security assurance and open RAN security, each drawn against the standard it follows. Authentication, key hierarchy, subscriber privacy and network domain security for 5G.

12. What you get

    Open where it can be, contracted where it must be

    What is open for Security and trust is free: the protocol, the methods and the open data can be used and built on by anyone. What must be contracted for Security and trust, sites, fleets, managed operations and data tiers, Nexus Observatory Inc. delivers at a price per site and per fleet, with service levels in numbers.

13. Next step

    Security and trust, planned with you

    Tell us which layers of Security and trust you already run and which you want us to design and deliver. An engineer replies with a survey proposal, a design and a scope for Security and trust, and the plan grows from one site to the network you need.

    Plan a deploymentOpen the Field Deployment StudioSee Security and trust

More presentations

See it from every side.

Each opens as a full-screen presentation: deeper pages on the same subject, explainers, stories, guided tours of the places, network scenes and the observatories that came before.

In depth

Explainers

Stories

Places and networks

Heritage observatories

Interactive tools

01Reference architecture

From one instrument to the grid.

Every deployment is drawn on the same six layers. A typed contract sits at every boundary, so parts from different makers fit together.

1. 01InstrumentThe sensor or radio that makes the measurement, with its calibration.
2. 02NodeThe device that hosts instruments: identity, time, power and storage.
3. 03SiteNodes in one place, on one mast or in one shelter, with their links.
4. 04CellSites that share a backhaul, a power plan and an operator.
5. 05ClusterCells run as one service, with one fleet plan and one evidence trail.
6. 06GridClusters that federate across owners through the open protocol.

The protocol functions this platform relies on most.

02Trust and evidence

Every observation carries its proof.

What a buyer, a regulator or a partner grid can check, on every site we build.

03Read further

The open specification behind it.

04Op hierdie werf

Where to go next.

Bring us the site.

We bring the survey, the design and the crew. The form names who receives your details.