---
title: "Architecture: Security and trust | Nexus Observatory"
description: "Reference architecture of the Security and trust platform: six layers, the protocol functions it relies on and the evidence behind every observation."
url: https://observatory.global/security-trust/architecture/
publisher: Nexus Observatory Inc.
updated: 2026-11-07
---

[Nexus Observatory](https://observatory.global/)

/

[Security and trust](https://observatory.global/security-trust/)

/

**Architecture** 

# How security and trust is built.

One reference architecture under every deployment: the layers of a site, the protocol functions this platform relies on, and the evidence that travels with every observation.

[Plan with us](https://observatory.global/security-trust/contact/deployment/)

[Industries](https://observatory.global/security-trust/industries/)

Areas · **5** Technologies · **61** Industries · **5** 

At a glance

## Monitoring, incident response and governance

In Security and trust, the monitoring, incident response and governance layer holds incident response, security monitoring and logging and coordinated vulnerability disclosure, each drawn against the standard it follows. Preparing, detecting, containing, recovering and learning, tied to risk management. Central collection and correlation of device, network and application events.

The problem

### Every node proves what it is

This page shows how Security and trust is put together, layer by layer, from the instrument to the record. Hardware-rooted identity and attestation at every join, PKI, secure boot and signed updates, segmentation between nodes, tenants and sites, operational-technology and wireless security, monitoring and response, and the move to post-quantum keys, planned before it is forced.

Components

- Pole-mounted edge gateway node
- Fixed gas detectors on a drift wall
- Particulate monitoring station and sensor node
- Overhead line sensor on a distribution span
- Private LTE mast on a solar skid
- "AI tower in a box"
- Hardware security module, 1U, in an edge rack
- Data hall row pair with cold-aisle containment

Interfaces

**Instruments**: SDI-12 · RS-485 / Modbus RTU · 4–20 mA
**Radio**: Ethernet · LTE-M / NB-IoT · LoRaWAN
**Time and position**: GNSS 1PPS
**Security**: TPM 2.0
**Publishing**: MQTT

Where it works

- Zero trust and network security
- PKI, secure boot and updates
- Keys, cryptography and post-quantum migration

In the story below

1. The system, part by part
2. Assembly
3. Installation
4. Deployment
5. Connections
6. Operation
7. Failure and recovery
8. Scale and federation
9. What you get

Scenes · 13

Next steps

[Plan a deployment](https://observatory.global/security-trust/contact/deployment/)

[Open the Field Deployment Studio](https://observatory.global/studio/)

[See Security and trust](https://observatory.global/security-trust/)

1. Security and trust · Architecture Every node proves what it is This page shows how Security and trust is put together, layer by layer, from the instrument to the record. Hardware-rooted identity and attestation at every join, PKI, secure boot and signed updates, segmentation between nodes, tenants and sites, operational-technology and wireless security, monitoring and response, and the move to post-quantum keys, planned before it is forced.
2. Architecture · Security, identity and trust Monitoring, incident response and governance In Security and trust, the monitoring, incident response and governance layer holds incident response, security monitoring and logging and coordinated vulnerability disclosure, each drawn against the standard it follows. Preparing, detecting, containing, recovering and learning, tied to risk management. Central collection and correlation of device, network and application events.
3. Architecture · Security, identity and trust Zero trust and network security In Security and trust, the zero trust and network security layer holds zero trust architecture, workload identity and port-based access and link encryption, each drawn against the standard it follows. No implicit trust from network location; each request authenticated, authorised and logged.
4. Architecture · Security, identity and trust Device identity and attestation In Security and trust, the device identity and attestation layer holds Trusted Platform Module, DICE layered identity and secure device identifiers, each drawn against the standard it follows. A hardware root of trust that holds keys, measures boot and signs attestation evidence.
5. Architecture · Security, identity and trust PKI, secure boot and updates In Security and trust, the PKI, secure boot and updates layer holds certificate profiles, automated certificate enrolment and revocation and status checking, each drawn against the standard it follows. X.509 certificate and revocation list profiles used across devices and services.
6. Architecture · Security, identity and trust Privacy and data protection In Security and trust, the privacy and data protection layer holds canadian privacy law, international privacy law and privacy information management, each drawn against the standard it follows. Federal and provincial rules for personal information collected by sites and services.
7. Architecture · Security, identity and trust OT security and software supply chain In Security and trust, the OT security and software supply chain layer holds industrial security programmes, system and component security levels and secure development lifecycle, each drawn against the standard it follows. Security management system for asset owners of control and monitoring systems.
8. Architecture · Security, identity and trust Keys, cryptography and post-quantum migration In Security and trust, the keys, cryptography and post-quantum migration layer holds key management lifecycle, hardware security modules and key management interfaces, each drawn against the standard it follows. Generation, distribution, rotation, backup and destruction of keys. Validated modules that hold root and signing keys.
9. Operations Every node watched, every incident closed Nothing on a network for Security and trust runs unwatched: the console shows each node's state, plan and evidence. An incident for Security and trust begins with an alert that carries its data and a runbook, and ends only when the operator has recorded the cause and verified the fix.
10. Updates Updates in rings, with rollback Software for Security and trust is released in rings, so a fault shows on one canary site long before it could reach the whole fleet. A ring for Security and trust goes ahead only on health and data completeness, and a failed gate rolls each node back without anyone travelling to site.
11. Architecture · Security, identity and trust 5G and wireless security In Security and trust, the 5G and wireless security layer holds 5G system security, network product security assurance and open RAN security, each drawn against the standard it follows. Authentication, key hierarchy, subscriber privacy and network domain security for 5G.
12. What you get Open where it can be, contracted where it must be What is open for Security and trust is free: the protocol, the methods and the open data can be used and built on by anyone. What must be contracted for Security and trust, sites, fleets, managed operations and data tiers, Nexus Observatory Inc. delivers at a price per site and per fleet, with service levels in numbers.
13. Next step Security and trust, planned with you Tell us which layers of Security and trust you already run and which you want us to design and deliver. An engineer replies with a survey proposal, a design and a scope for Security and trust, and the plan grows from one site to the network you need. [Plan a deployment](https://observatory.global/security-trust/contact/deployment/) [Open the Field Deployment Studio](https://observatory.global/studio/) [See Security and trust](https://observatory.global/security-trust/)

More presentations

## See it from every side.

Each opens as a full-screen presentation: deeper pages on the same subject, explainers, stories, guided tours of the places, network scenes and the observatories that came before.

[All presentations](https://observatory.global/presentations/)

### In depth

[Use case **Utility grid-edge private LTE and wildfire weather**](https://observatory.global/use-cases/utility-grid-edge/)

[ISIC section · ISIC F **Construction**](https://observatory.global/industries/f-construction/)

[ISIC section · ISIC B **Mining and quarrying**](https://observatory.global/industries/b-mining-and-quarrying/)

[Sector **Industrial**](https://observatory.global/sectors/industrial/)

### Explainers

[Explainer · Industrial **Industrial** Blast vibration at the pit, fire weather at the grid edge, methane at the fenceline and tailings movement from GNSS.](https://observatory.global/industries/infrastructure/explainer/)

[Platform **Security and trust** Every unattended node is an entry point](https://observatory.global/security-trust/)

[Platform **Sensors & instruments** A number without its story](https://observatory.global/sensors/)

### Stories

[Story · Private 5G and AI-RAN **Private 5G with the inference in the radio** A private cellular network gives a site its own coverage, its own security and its own priorities. AI-RAN adds a second idea: the accelerators that run the…](https://observatory.global/stories/private-5g-ai-ran/)

[Story · Timing and PNT **Time as infrastructure** A 5G cell must hold its phase within 3 µs of its neighbours, ±1.5 µs of a common reference; a synchrophasor’s one per cent vector error leaves room for only…](https://observatory.global/stories/timing-pnt/)

[Story · Post-quantum cryptography **Cryptography that outlasts the quantum computer** Data signed today may need to be trusted in 2040. Post-quantum standards were first published in August 2024, and governments have set dates for leaving…](https://observatory.global/stories/pqc-migration/)

### Places and networks

[Guided tour · Guided 3D tour **Transmission corridor** Lattice towers carry a line across open country; conductor sensors report temperature and sag, and the substation edge brings them into the grid operator’s systems.](https://observatory.global/environments/transmission-corridor/)

[Guided tour · Guided 3D tour **Open-pit mine** GNSS slope monitors on the benches, a blast seismograph at the boundary and a private cell for the fleet, around a benched pit cut into the ground.](https://observatory.global/environments/open-pit-mine/)

[Network scene · Private 5G · Mining **Private 5G in an open-pit mine** A private network for haul trucks, drills and slope radar: a mast on the rim, a cell in the pit, the core at the plant, and coverage computed over the benches themselves.](https://observatory.global/environments/networks/private5g-mine/)

### Heritage observatories

[Heritage observatory · United States · 1961 **World-Wide Standardized Seismograph Network** In the early 1960s the United States put identical seismographs, calibrated the same way, in more than a hundred places around the world and published the records on film for…](https://observatory.global/observatories/wwssn/)

[Heritage observatory · United States · 1994 **International GNSS Service** A voluntary federation of some two hundred agencies and universities that operate a global network of GNSS receivers and share the results, from which the precise orbits and…](https://observatory.global/observatories/igs-gnss-service/)

### Interactive tools

[Interactive tool · Configure a station **Station Builder** Configure a station part by part in 3D, check the rules as you go and request a quote for the assembly.](https://observatory.global/studio/builder/)

**01** Reference architecture

## From one instrument to the grid.

Every deployment is drawn on the same six layers. A typed contract sits at every boundary, so parts from different makers fit together.

1. **01** **Instrument** The sensor or radio that makes the measurement, with its calibration.
2. **02** **Node** The device that hosts instruments: identity, time, power and storage.
3. **03** **Site** Nodes in one place, on one mast or in one shelter, with their links.
4. **04** **Cell** Sites that share a backhaul, a power plan and an operator.
5. **05** **Cluster** Cells run as one service, with one fleet plan and one evidence trail.
6. **06** **Grid** Clusters that federate across owners through the open protocol.

[**01** **Join** Identity, attestation quote, signed policy.](https://observatory.global/protocol/functions/)

[**02** **Admit** Admitted for a stated scope, nothing wider.](https://observatory.global/protocol/functions/)

[**03** **Describe** What, where, how and by whom, with calibration.](https://observatory.global/protocol/functions/)

[**04** **Time** One clock across the grid, with its error bound.](https://observatory.global/protocol/functions/)

[**05** **Observe** Every value with quality and provenance.](https://observatory.global/protocol/functions/)

[**06** **Qualify** Tested against the specification, state on record.](https://observatory.global/protocol/functions/)

[**07** **Federate** Signed exchange across grids and trust domains.](https://observatory.global/protocol/functions/)

[**08** **Orchestrate** Software and configuration by signed plan.](https://observatory.global/protocol/functions/)

[**09** **Correct** A correction marks what depends on it and publishes a new version.](https://observatory.global/protocol/functions/)

[**10** **Exchange** Products reach people and applications through versioned interfaces.](https://observatory.global/protocol/functions/)

[**11** **Prove** Signed proof receipts that an independent verifier can check.](https://observatory.global/protocol/functions/)

[**12** **Exit and decommission** An open exit path, and a record that closes.](https://observatory.global/protocol/functions/)

The protocol functions this platform relies on most.

**02** Trust and evidence

## Every observation carries its proof.

What a buyer, a regulator or a partner grid can check, on every site we build.

Evidence

### Identity and attestation

Hardware-rooted identity, with a quote checked at every join.

Evidence

### Segmentation

Least privilege between nodes, tenants and sites.

Evidence

### Time integrity

Every clock monitored, every holdover logged.

Evidence

### Evidence bundles

What was done, by whom, with what result.

Evidence

### Qualification state

Each device and release, with the tests behind it.

Evidence

### Signed plans

Software and configuration change only by a signed plan.

**03** Read further

## The open specification behind it.

[Observatory Protocol Specification Functions, state machines, objects and flows. Read →](https://observatory.global/protocol/specification/)

[Observatory Protocol Reference designs Nodes and sites drawn to the protocol. Read →](https://observatory.global/protocol/reference-designs/)

[Observatory Protocol Conformance Run the suite against an implementation. Read →](https://observatory.global/protocol/conformance/)

**04** On this site

## Where to go next.

[Security and trust Areas Every area, with its systems and standards. Open →](https://observatory.global/security-trust/areas/)

[Security and trust Technologies The layered map of what we build with. Open →](https://observatory.global/security-trust/technologies/)

[Security and trust Industries The industry sites built on this platform. Open →](https://observatory.global/security-trust/industries/)

[Security and trust Resources Explainer, stories, specification and forms. Open →](https://observatory.global/security-trust/resources/)

## Bring us the site.

We bring the survey, the design and the crew. The form names who receives your details.

[Plan a deployment](https://observatory.global/security-trust/contact/deployment/)

[Contact](https://observatory.global/security-trust/contact/)

[Nexus Observatory](https://observatory.global/) **Security and trust** . Every node proves what it is. [Talk to us](https://observatory.global/contact/)

Security and trust

- [Overview](https://observatory.global/security-trust/)
- [Areas](https://observatory.global/security-trust/areas/)
- [Technologies](https://observatory.global/security-trust/technologies/)
- [Architecture](https://observatory.global/security-trust/architecture/)
- [Industries](https://observatory.global/security-trust/industries/)
- [Resources](https://observatory.global/security-trust/resources/)
- [Contact](https://observatory.global/security-trust/contact/)

Platforms

- [Protocol & Grid](https://observatory.global/grid-services/)
- [Software](https://observatory.global/software/)
- [Hardware & power](https://observatory.global/hardware/)
- [Sensors & instruments](https://observatory.global/sensors/)
- [Connectivity](https://observatory.global/connectivity/)
- [Edge compute & AI](https://observatory.global/edge-ai/)
- [Earth observation & GeoAI](https://observatory.global/earth-observation/)
- [Space and satellite systems](https://observatory.global/space/)
- [Positioning, navigation and timing](https://observatory.global/pnt/)
- [Security and trust](https://observatory.global/security-trust/)
- [Digital twins and simulation](https://observatory.global/digital-twins/)
- [Data & licensing](https://observatory.global/data-products/)
- [Field services](https://observatory.global/field-services/)
- [Design and integration](https://observatory.global/integration/)
- [Test and qualification](https://observatory.global/qualification/)
- [Operations centre](https://observatory.global/operations/)
- [Training and enablement](https://observatory.global/training/)
- [Frontier labs](https://observatory.global/labs/)

Solutions

- [Early warning](https://observatory.global/use-cases/street-flood/)
- [Wildfire and fire weather](https://observatory.global/use-cases/wildfire-camera/)
- [Environmental compliance](https://observatory.global/use-cases/methane-fenceline/)
- [Asset monitoring](https://observatory.global/industries/infrastructure/)
- [Private networks](https://observatory.global/connectivity/private-5g/)
- [Remote power and sites](https://observatory.global/use-cases/remote-microgrid/)
- [Climate and resilience](https://observatory.global/industries/climate/)
- [Site twins](https://observatory.global/digital-twins/)
- [Data licensing](https://observatory.global/data-products/)

Industries

- [Public safety](https://observatory.global/industries/public-safety/)
- [Government](https://observatory.global/industries/government/)
- [Cities](https://observatory.global/industries/cities/)
- [Civil resilience](https://observatory.global/industries/resilience/)
- [Communities](https://observatory.global/industries/communities/)
- [Humanitarian](https://observatory.global/industries/humanitarian/)
- [Climate](https://observatory.global/industries/climate/)
- [Water](https://observatory.global/industries/water/)
- [Nature](https://observatory.global/industries/nature/)
- [Oceans](https://observatory.global/industries/oceans/)
- [Agriculture](https://observatory.global/industries/agriculture/)
- [Energy](https://observatory.global/industries/energy/)
- [Telecom](https://observatory.global/industries/telecom/)
- [Transport](https://observatory.global/industries/transport/)
- [Infrastructure](https://observatory.global/industries/infrastructure/)
- [Mining](https://observatory.global/industries/mining/)
- [Industry](https://observatory.global/industries/industry/)
- [Research](https://observatory.global/industries/research/)
- [Education](https://observatory.global/industries/education/)
- [Health](https://observatory.global/industries/health/)
- [Insurance and finance](https://observatory.global/industries/insurance/)
- [Events](https://observatory.global/industries/events/)

Products

- [Field Deployment Studio](https://observatory.global/studio/)
- [Station Builder](https://observatory.global/studio/builder/)
- [Field services](https://observatory.global/field-services/)
- [Data products](https://observatory.global/data-products/)
- [APIs and SDKs](https://observatory.global/protocol/developers/)
- [Edge runtime and fleet](https://observatory.global/software/)
- [Hardware catalogue](https://observatory.global/hardware/)
- [Reference designs](https://observatory.global/protocol/reference-designs/)

Resources

- [Learn](https://observatory.global/learn/)
- [Stories](https://observatory.global/stories/)
- [Presentations](https://observatory.global/presentations/)
- [Environments](https://observatory.global/environments/)
- [Network scenes](https://observatory.global/environments/networks/)
- [Observatories atlas](https://observatory.global/observatories/)
- [Earth and maps](https://observatory.global/earth/)
- [Technologies](https://observatory.global/technologies/)
- [Countries](https://observatory.global/countries/)
- [Spectrum](https://observatory.global/spectrum/)
- [Observatory Protocol](https://observatory.global/protocol/)
- [Specification](https://observatory.global/protocol/specification/)
- [Conformance](https://observatory.global/protocol/conformance/)
- [Open source](https://observatory.global/open/)
- [Data credits](https://observatory.global/credits/)

Company

- [About](https://observatory.global/about/)
- [Open governance](https://observatory.global/consortium/)
- [Security and trust](https://observatory.global/security/)
- [Careers](https://observatory.global/contact/careers/)
- [Press](https://observatory.global/contact/press/)
- [Contact sales](https://observatory.global/contact/)
- [Privacy requests](https://observatory.global/privacy-request/)

© 2026 Nexus Observatory Inc.

[Security and trust](https://observatory.global/security/)

[Privacy choices](https://observatory.global/privacy-choices/)

[Accessibility](https://observatory.global/legal/accessibility/)

[Privacy](https://observatory.global/legal/privacy/)

[Terms](https://observatory.global/legal/terms/)

[Status](https://status.observatory.global/)

[Help translate](https://observatory.global/translate/)