--- title: "Federation: Protocol & Grid | Nexus Observatory" description: "Federation, inside Protocol & Grid: zero trust architecture, workload identity, port-based access and link encryption, transport security and more." url: https://observatory.global/grid-services/federation/ publisher: Nexus Observatory Inc. updated: 2026-10-27 --- [Nexus Observatory](https://observatory.global/) / [Protocol & Grid](https://observatory.global/grid-services/) / **Federation** # Signed exchange across sites, owners and trust domains. Federation, inside Protocol & Grid: zero trust architecture, workload identity, port-based access and link encryption, transport security and more. Every item is traced to its specification, from NIST SP 800-207 to CISA Zero Trust Maturity Model 2.0, and runs on the open Observatory Protocol. [Plan with us](https://observatory.global/contact/) Architecture [The protocol](https://observatory.global/protocol/specification/) **Technologies**: 9 **At the frontier**: 0 **Protocol functions**: 5 of 8 **Industries served**: 6 Reference design, drawn to scale · drag to turn · hover a part **01** What it is ## Zero trust and network security. How every node proves what it is and what it runs, how links and keys are protected, how software is traced to its source, how personal data is minimised, and how incidents are found and handled. Each technology below carries what it is, what we do with it, and the standard it is drawn against. Security, identity and trust ### Zero trust architecture No implicit trust from network location; each request authenticated, authorised and logged. We design, integrate and operate. NIST SP 800-207 · CISA Zero Trust Maturity Model 2.0 Security, identity and trust ### Workload identity Short-lived, attested identities for services and agents rather than static secrets. We design and integrate. SPIFFE specification Security, identity and trust ### Port-based access and link encryption Authenticating devices on wired ports and encrypting Ethernet links. We design, integrate and deploy. IEEE 802.1X-2020 · IEEE 802.1AE (MACsec) Security, identity and trust ### Transport security Modern encrypted transport for APIs, telemetry and constrained links. We design and integrate. IETF RFC 8446 (TLS 1.3) · IETF RFC 9147 (DTLS 1.3) Security, identity and trust ### IPsec and site tunnels Encrypted tunnels between sites, gateways and the NOC. We design, integrate and operate. IETF RFC 4301 (IPsec) · IETF RFC 7296 (IKEv2) Security, identity and trust ### Zones, conduits and segmentation Grouping assets by risk and controlling every flow between groups. We design, integrate and operate. IEC 62443-3-2 (risk assessment, zones and conduits) Security, identity and trust ### GNSS interference and spoofing resilience Detecting jamming and spoofing and holding time and position during outages. We design, integrate and operate. US DHS Resilient PNT Conformance Framework · Galileo Open Service Navigation Message Authentication Security, identity and trust ### Certificate profiles X.509 certificate and revocation list profiles used across devices and services. We design. IETF RFC 5280 Security, identity and trust ### Automated certificate enrolment Issuing and renewing device and service certificates without manual steps. We design, integrate and operate. IETF RFC 7030 (EST) · IETF RFC 8555 (ACME) · IETF RFC 9483 (lightweight CMP profile) **02** Architecture ## Where it sits, and what it speaks. Federation draws on 1 domain and 8 layers of the spectrum; the highlighted layers carry this area. It speaks 5 of the protocol's 8 core functions. Device identity and attestation 8 PKI, secure boot and updates 7 Zero trust and network security 7 5G and wireless security 6 OT security and software supply chain 9 Privacy and data protection 7 Keys, cryptography and post-quantum migration 9 Monitoring, incident response and governance 8 01**Join** Identity, attestation quote, signed policy. 02**Admit** Admitted for a stated scope, nothing wider. 03**Describe** What, where, how and by whom, with calibration. 04**Time** One clock across the grid, with its error bound. 05**Observe** Every value with quality and provenance. 06**Qualify** Tested against the specification, state on record. 07**Federate** Signed exchange across grids and trust domains. 08**Orchestrate** Software and configuration by signed plan. **03** On the grid ## Every site joins one observing grid. The open networks on the grid today, over real relief and the geodesic cells we count them into. A site built here enrols into the same grid. **04** In the field ## Where this runs, sector by sector. 6 deployment scenarios from the sector research that rely on federation. [Government and public safety National GBON surface and upper-air networkWMO-grade stations reporting through WIS 2.0, funded through the systematic-observations financing pathway.](https://observatory.global/sectors/public-safety/) [Government and public safety Wildfire camera network and fire-weather stationsCamera towers with edge inference and co-located fire-weather stations, utility- or agency-funded.](https://observatory.global/sectors/public-safety/) [Government and public safety Urban street-flood sensor networkOpen-hardware depth sensors with open data and alerts to emergency management.](https://observatory.global/sectors/public-safety/) [Cities Hybrid air-quality networkReference analysers plus calibrated low-cost nodes; low-cost sensors alone do not meet regulatory requirements.](https://observatory.global/sectors/cities/) [Communities and rural Remote microgrid, sensing and connectivity bundleSolar-plus-storage telemetry with a weather station and a small cell in a diesel-reduction project.](https://observatory.global/sectors/communities/) [Communities and rural Interim public-safety broadband where no national network existsPrivate LTE or 5G for fire and medical services in territories without a national public-safety network.](https://observatory.global/sectors/communities/) **05** Open and enterprise ## Open by default. Enterprise by contract. The open counterpart lives on the main site for anyone to read and run. The enterprise service is designed, deployed and operated with you, under contract. Open, on the main site - Protocol specification - State machines and node roles - Conformance tool - Device class catalogue Enterprise, on this site - Private grid design and operation - Federation agreements - Provider qualification testing - Works-with programme **06** The rest of the line ## Protocol & Grid, area by area. [Protocol & Grid Private gridsYour nodes, your authority, the open specification.](https://observatory.global/grid-services/private-grids/) [Protocol & Grid QualificationDevices and releases tested against the protocol, state on record.](https://observatory.global/grid-services/qualification/) [Protocol & Grid Provider admissionManifest, rights and security review, then admitted for scope.](https://observatory.global/grid-services/provider-admission/) [Protocol & Grid OrchestrationSoftware and configuration by signed plan, with rollback.](https://observatory.global/grid-services/orchestration/) ## Bring us the site. Survey, design, deployment and operation for federation. The form names who receives your details. [Talk to us](https://observatory.global/contact/) [contact@observatory.global](mailto:contact@observatory.global?subject=Protocol%20%26%20Grid%3A%20Federation) [Nexus Observatory](https://observatory.global/)**Protocol & Grid** . Your grid, on the open protocol.[Talk to us](https://observatory.global/contact/) Protocol & Grid - [Private grids](https://observatory.global/grid-services/private-grids/) - [Federation](https://observatory.global/grid-services/federation/) - [Qualification](https://observatory.global/grid-services/qualification/) - [Provider admission](https://observatory.global/grid-services/provider-admission/) - [Orchestration](https://observatory.global/grid-services/orchestration/) Technologies - [Device identity and attestation](https://observatory.global/technologies/security/device-identity-and-attestation/) - [PKI, secure boot and updates](https://observatory.global/technologies/security/pki-secure-boot-and-updates/) Industries - [Public safety](https://observatory.global/sectors/public-safety/) - [Government](https://observatory.global/industries/) - [Civil resilience](https://observatory.global/industries/) - [Humanitarian](https://observatory.global/sectors/humanitarian/) - [Industry](https://observatory.global/industries/) - [Research](https://observatory.global/industries/) Service platforms - [Observatory Protocol](https://observatory.global/protocol/) - [Software](https://observatory.global/software/) - [Hardware & power](https://observatory.global/hardware/) - [Sensors & instruments](https://observatory.global/sensors/) - [Connectivity](https://observatory.global/connectivity/) - [Edge compute & AI](https://observatory.global/edge-ai/) - [Earth observation & GeoAI](https://observatory.global/earth-observation/) © 2026 Nexus Observatory Inc. [Privacy](https://observatory.global/legal/privacy/) [Terms](https://observatory.global/legal/terms/) [Accessibility](https://observatory.global/legal/accessibility/) [Cookie settings](https://observatory.global/privacy-choices/) [Data credits](https://observatory.global/credits/)