--- title: "Security and trust platform | Nexus Observatory" description: "Security and trust: every node proving what it is before it joins, keys held apart. Every device and site proves who it is." url: https://observatory.global/security-trust/ publisher: Nexus Observatory Inc. updated: 2026-11-07 --- Security and trust: every node proving what it is before it joins, keys held apart. The loop, step by step: 1. Every device and site proves who it is. 2. The chain from source to console stands ready. 3. A station presents its device identity. 4. Each reading is stamped with time and place. 5. The security module signs the claim. 6. The attestation crosses the radio link. 7. Relays carry the packets without reading them. 8. Signatures are checked before any model runs. 9. The verifier checks it against policy. 10. The edge releases confirmed results only. 11. The edge accepts the station into the grid. 12. The console shows the evidence with the alert. 13. Its readings are trusted from this moment. 14. Sensors check that the response worked. 15. The whole chain is archived for audit. 16. Everything settles back to idle. 01 / 16 Every device and site proves who it is Nexus Observatory / **Security and trust** # Every node proves what it is. Hardware-rooted identity and attestation at every join, PKI, secure boot and signed updates, segmentation between nodes, tenants and sites, operational-technology and wireless security, monitoring and response, and the move to post-quantum keys, planned before it is forced. [Plan with us](https://observatory.global/contact/) Reference architecture [The open protocol](https://observatory.global/protocol/) At a glance ## Every node proves what it is Security and trust delivers hardware-rooted identity and attestation at every join, PKI, secure boot and signed updates, segmentation between nodes, tenants and sites, OT and wireless security, monitoring and response, and a planned move to post-quantum keys. Security is part of how the system works, not a product added afterwards, and it is visible in every record. The problem ### Every unattended node is an entry point Field devices sit in public places, run for years and join networks that also carry control traffic. A single unverified node or unsigned update can reach far beyond the sensor it came with. Security has to be built into how every node joins, updates and reports, because nobody can guard unattended sites in person. Key facts **Practice**: IEC 62443 zones and conduits · zero trust **Roots of trust**: TPM 2.0 · secure boot · measured boot Components - Pole-mounted edge gateway node - Fixed gas detectors on a drift wall - Particulate monitoring station and sensor node - Overhead line sensor on a distribution span - Private LTE mast on a solar skid - "AI tower in a box" - Hardware security module, 1U, in an edge rack - Data hall row pair with cold-aisle containment Interfaces **Instruments**: SDI-12 · RS-485 / Modbus RTU · 4–20 mA **Radio**: Ethernet · LTE-M / NB-IoT · LoRaWAN **Time and position**: GNSS 1PPS **Security**: TPM 2.0 **Publishing**: MQTT Where it works - Least privilege between zones In the story below 1. The system, part by part 2. Assembly 3. Installation 4. Deployment 5. Connections 6. Operation 7. Failure and recovery 8. Scale and federation 9. What you get Scenes · 18 Next steps [Plan a deployment](https://observatory.global/security-trust/contact/deployment/) [Read our security approach](https://observatory.global/security/) [Talk to sales](https://observatory.global/contact/sales-enquiry/) [See OT and wireless security](https://observatory.global/security-trust/ot-and-wireless-security/) 1. The problem Every unattended node is an entry point Field devices sit in public places, run for years and join networks that also carry control traffic. A single unverified node or unsigned update can reach far beyond the sensor it came with. Security has to be built into how every node joins, updates and reports, because nobody can guard unattended sites in person. 2. What it does Every node proves what it is Security and trust delivers hardware-rooted identity and attestation at every join, PKI, secure boot and signed updates, segmentation between nodes, tenants and sites, OT and wireless security, monitoring and response, and a planned move to post-quantum keys. Security is part of how the system works, not a product added afterwards, and it is visible in every record. 3. Keys and PKI Issuance, rotation and post-quantum migration Keys are issued and held in hardware security modules, rotated on schedule and revoked on evidence. Migration to post-quantum algorithms is planned inventory first, so it is not forced in a hurry. Key events are recorded and auditable, and keys never leave the hardware that protects them. [See Keys and PKI](https://observatory.global/security-trust/keys-and-pki/) 4. The system One station, part by part Before anything is installed, the station is laid out as its parts: instrument, logger and edge compute, secure element, GNSS timing, radio, power, enclosure, wiring, earthing, mast and foundation. 5. Assembly Built and tested before it ships Each part is fitted to the pole and the enclosure, wired through surge protection to one earth, powered and bench-tested until it signs its first reading. 6. Installation Installed on site The crew arrives with the tested kit: foundation, mast raised and guyed, instruments mounted, cables run in conduit, the enclosure fitted out and the site commissioned. 7. Deployment Site after site, one design The same station goes in at every site on the plan, each commissioned against the same checklist, until the field is covered. 8. Wiring Signal, power and time, wired Inside one site the instrument’s signal pair runs to the logger, solar charges the battery that feeds the load, GNSS time reaches the clock and the logger hands its records to the radio. 9. Segmentation Least privilege between zones Observing networks and control systems are separate zones joined by defined conduits, following IEC 62443. Data crosses one way, read-only by default, through a gateway and a firewall with every rule recorded. Rules are written down, reviewed and tested, and every change to them is recorded with who approved it. PracticeIEC 62443 zones and conduits · zero trust [See Segmentation and zero trust](https://observatory.global/security-trust/segmentation-and-zero-trust/) 10. Connections Backhaul, time and power The relay carries every site to the edge over a point-to-point link, the grandmaster’s time reaches every clock, and each site keeps its power through the night. 11. Identity and attestation Quotes checked at every join Each node holds a key in a hardware root of trust. When it joins, it sends a signed quote of its boot chain and software; the network admits it only if the quote matches an approved state. A node whose quote does not match is quarantined and its keys withheld until it is restored to an approved state. Roots of trustTPM 2.0 · secure boot · measured boot [See Identity and attestation](https://observatory.global/security-trust/identity-and-attestation/) 12. Evidence Proof an auditor can check Admissions, key events, updates and incidents are kept as signed records. An auditor can verify them independently against published keys and the threat model. Evidence is designed to stand on its own, so trust in the system does not depend on trust in its operator. 13. Operations Security monitoring for observing sites A security view sits beside the fleet view: attestation state, certificate expiry, failed joins and rule changes, each with its record. Expiring certificates and failed joins are acted on before they become outages or openings for an attacker. Every alert links to the node, the event and the evidence. 14. Monitoring and response Detect, contain, recover Anomalies in behaviour, traffic or attestation raise an alert; the affected node is isolated, restored to a known state and readmitted only after attestation, with the evidence kept. Response playbooks are rehearsed, and every incident leaves a timeline that can be reviewed afterwards. [See Monitoring and response](https://observatory.global/security-trust/monitoring-and-response/) 15. Supply chain Signed updates, known contents Every release is signed and ships with a software bill of materials; nodes refuse unsigned code and report what they run, so a vulnerability can be matched to exactly the nodes that carry it. When a new vulnerability is published, the affected nodes are known within minutes, not after a manual survey. [See OT and wireless security](https://observatory.global/security-trust/ot-and-wireless-security/) 16. How it scales The same proof at every scale Attestation, keys and segmentation work the same for one site or thousands: policy is defined once and enforced at every join, every update and every boundary. New sites inherit the policy on day one, so growth never opens a gap in the defences. 17. What you get Assurance, monitoring and key operations The threat model for observing sites and the attestation profile in the protocol are open. Operational-technology assurance, security monitoring and key and PKI operations are contracted. Pricing follows the sites, the keys and the monitoring you choose, and the threat model stays yours. [Read our security approach](https://observatory.global/security/) [Talk to sales](https://observatory.global/contact/sales-enquiry/) 18. Next step Review your attack surface Tell us the sites, the networks and the systems they touch. We start with a threat model and an inventory of keys. The review ends with a prioritised list of fixes, the evidence behind each one and an owner for every action. [Plan a deployment](https://observatory.global/security-trust/contact/deployment/) [Read our security approach](https://observatory.global/security/) More presentations ## See it from every side. Each opens as a full-screen presentation: deeper pages on the same subject, explainers, stories, guided tours of the places, network scenes and the observatories that came before. [All presentations](https://observatory.global/presentations/) ### In depth [Use case **Utility grid-edge private LTE and wildfire weather**](https://observatory.global/use-cases/utility-grid-edge/) [ISIC section · ISIC B **Mining and quarrying**](https://observatory.global/industries/b-mining-and-quarrying/) [Sector **Industrial**](https://observatory.global/sectors/industrial/) [ISIC section · ISIC F **Construction**](https://observatory.global/industries/f-construction/) ### Explainers [Explainer · Industrial **Industrial** Blast vibration at the pit, fire weather at the grid edge, methane at the fenceline and tailings movement from GNSS.](https://observatory.global/industries/infrastructure/explainer/) ### Stories [Story · Private 5G and AI-RAN **Private 5G with the inference in the radio** A private cellular network gives a site its own coverage, its own security and its own priorities. AI-RAN adds a second idea: the accelerators that run the…](https://observatory.global/stories/private-5g-ai-ran/) [Story · Timing and PNT **Time as infrastructure** A 5G cell must hold its phase within 3 µs of its neighbours, ±1.5 µs of a common reference; a synchrophasor’s one per cent vector error leaves room for only…](https://observatory.global/stories/timing-pnt/) [Story · Post-quantum cryptography **Cryptography that outlasts the quantum computer** Data signed today may need to be trusted in 2040. Post-quantum standards were first published in August 2024, and governments have set dates for leaving…](https://observatory.global/stories/pqc-migration/) ### Places and networks [Guided tour · Guided 3D tour **Open-pit mine** GNSS slope monitors on the benches, a blast seismograph at the boundary and a private cell for the fleet, around a benched pit cut into the ground.](https://observatory.global/environments/open-pit-mine/) [Guided tour · Guided 3D tour **Transmission corridor** Lattice towers carry a line across open country; conductor sensors report temperature and sag, and the substation edge brings them into the grid operator’s systems.](https://observatory.global/environments/transmission-corridor/) [Network scene · Private 5G · Mining **Private 5G in an open-pit mine** A private network for haul trucks, drills and slope radar: a mast on the rim, a cell in the pit, the core at the plant, and coverage computed over the benches themselves.](https://observatory.global/environments/networks/private5g-mine/) ### Heritage observatories [Heritage observatory · United States · 1961 **World-Wide Standardized Seismograph Network** In the early 1960s the United States put identical seismographs, calibrated the same way, in more than a hundred places around the world and published the records on film for…](https://observatory.global/observatories/wwssn/) [Heritage observatory · United States · 1994 **International GNSS Service** A voluntary federation of some two hundred agencies and universities that operate a global network of GNSS receivers and share the results, from which the precise orbits and…](https://observatory.global/observatories/igs-gnss-service/) ### Interactive tools [Interactive tool · Plan a site **Field Deployment Studio** Terrain, devices, coverage, viewshed, power and the best spot for a station, then a deployment request with the plan attached.](https://observatory.global/studio/) **01** · What this platform covers ## Security and trust, area by area. Choose an area for its systems, standards, the industries it serves and how we deliver it. [01 Identity and attestation Hardware roots of trust, quotes checked at every join.](https://observatory.global/security-trust/identity-and-attestation/) [02 Keys and PKI Issuance, rotation and post-quantum migration.](https://observatory.global/security-trust/keys-and-pki/) [03 Segmentation and zero trust Least privilege between nodes, tenants and sites.](https://observatory.global/security-trust/segmentation-and-zero-trust/) [04 OT and wireless security Field networks, 5G and the software supply chain.](https://observatory.global/security-trust/ot-and-wireless-security/) [05 Monitoring and response Detect, contain, recover, with the evidence kept.](https://observatory.global/security-trust/monitoring-and-response/) **02** · Built on the open protocol ## One protocol under every platform. Marked: the functions this platform leans on hardest. The protocol itself is open, so what you build here runs anywhere the protocol runs. 01 JOIN 02 ADMIT 03 DESCRIBE 04 TIME 05 OBSERVE 06 QUALIFY 07 FEDERATE 08 ORCHESTRATE **03** · Open and enterprise ## Open by default. Enterprise by contract. The open layer lives on the main site, free to use and build on. Enterprise services are delivered under contract by Nexus Observatory Inc. Open, on the main site - Threat model for observing sites - Attestation profile in the protocol Enterprise, on this site - Operational-technology assurance - Security monitoring for observing sites - Key and PKI operations **04** · Industries served ## The industries that build on security and trust. Each industry has its own site: its use cases, its community and the enterprise path, with this platform among the systems behind it. [Industry **Civil resilience** Infrastructure that reports before it fails.](https://observatory.global/industries/resilience/) [Industry **Energy** The grid edge, observed.](https://observatory.global/industries/energy/) [Industry **Telecom** Towers that compute, sense and connect.](https://observatory.global/industries/telecom/) [Industry **Mining** The mine, measured from pit to tailings.](https://observatory.global/industries/mining/) [Industry **Industry** Plants and ports, sensed and connected.](https://observatory.global/industries/industry/) **05** · Every platform ## Every platform, one architecture. One platform for each technical area of our work, on the same protocol, the same data and the same design. [Protocol & Grid](https://observatory.global/grid-services/) [Software](https://observatory.global/software/) [Hardware & power](https://observatory.global/hardware/) [Sensors & instruments](https://observatory.global/sensors/) [Connectivity](https://observatory.global/connectivity/) [Edge compute & AI](https://observatory.global/edge-ai/) [Earth observation & GeoAI](https://observatory.global/earth-observation/) [Field services](https://observatory.global/field-services/) [Data & licensing](https://observatory.global/data-products/) [Space and satellite systems](https://observatory.global/space/) [Positioning, navigation and timing](https://observatory.global/pnt/) [Security and trust](https://observatory.global/security-trust/) [Digital twins and simulation](https://observatory.global/digital-twins/) [Design and integration](https://observatory.global/integration/) [Test and qualification](https://observatory.global/qualification/) [Operations centre](https://observatory.global/operations/) [Training and enablement](https://observatory.global/training/) [Frontier labs](https://observatory.global/labs/) ## Bring us the site. We bring the survey, the design and the crew. Nexus Observatory Inc. The form names who receives your details. [Talk to us](https://observatory.global/contact/) [Create account](https://observatory.global/register/) [Nexus Observatory](https://observatory.global/) **Security and trust** . Every node proves what it is. [Talk to us](https://observatory.global/contact/) Security and trust - [Overview](https://observatory.global/security-trust/) - [Areas](https://observatory.global/security-trust/areas/) - [Technologies](https://observatory.global/security-trust/technologies/) - [Architecture](https://observatory.global/security-trust/architecture/) - [Industries](https://observatory.global/security-trust/industries/) - [Resources](https://observatory.global/security-trust/resources/) - [Contact](https://observatory.global/security-trust/contact/) Platforms - [Protocol & Grid](https://observatory.global/grid-services/) - [Software](https://observatory.global/software/) - [Hardware & power](https://observatory.global/hardware/) - [Sensors & instruments](https://observatory.global/sensors/) - [Connectivity](https://observatory.global/connectivity/) - [Edge compute & AI](https://observatory.global/edge-ai/) - [Earth observation & GeoAI](https://observatory.global/earth-observation/) - [Space and satellite systems](https://observatory.global/space/) - [Positioning, navigation and timing](https://observatory.global/pnt/) - [Security and trust](https://observatory.global/security-trust/) - [Digital twins and simulation](https://observatory.global/digital-twins/) - [Data & licensing](https://observatory.global/data-products/) - [Field services](https://observatory.global/field-services/) - [Design and integration](https://observatory.global/integration/) - [Test and qualification](https://observatory.global/qualification/) - [Operations centre](https://observatory.global/operations/) - [Training and enablement](https://observatory.global/training/) - [Frontier labs](https://observatory.global/labs/) Solutions - [Early warning](https://observatory.global/use-cases/street-flood/) - [Wildfire and fire weather](https://observatory.global/use-cases/wildfire-camera/) - [Environmental compliance](https://observatory.global/use-cases/methane-fenceline/) - [Asset monitoring](https://observatory.global/industries/infrastructure/) - [Private networks](https://observatory.global/connectivity/private-5g/) - [Remote power and sites](https://observatory.global/use-cases/remote-microgrid/) - [Climate and resilience](https://observatory.global/industries/climate/) - [Site twins](https://observatory.global/digital-twins/) - [Data licensing](https://observatory.global/data-products/) Industries - [Public safety](https://observatory.global/industries/public-safety/) - [Government](https://observatory.global/industries/government/) - [Cities](https://observatory.global/industries/cities/) - [Civil resilience](https://observatory.global/industries/resilience/) - [Communities](https://observatory.global/industries/communities/) - [Humanitarian](https://observatory.global/industries/humanitarian/) - [Climate](https://observatory.global/industries/climate/) - [Water](https://observatory.global/industries/water/) - [Nature](https://observatory.global/industries/nature/) - [Oceans](https://observatory.global/industries/oceans/) - [Agriculture](https://observatory.global/industries/agriculture/) - [Energy](https://observatory.global/industries/energy/) - [Telecom](https://observatory.global/industries/telecom/) - [Transport](https://observatory.global/industries/transport/) - [Infrastructure](https://observatory.global/industries/infrastructure/) - [Mining](https://observatory.global/industries/mining/) - [Industry](https://observatory.global/industries/industry/) - [Research](https://observatory.global/industries/research/) - [Education](https://observatory.global/industries/education/) - [Health](https://observatory.global/industries/health/) - [Insurance and finance](https://observatory.global/industries/insurance/) - [Events](https://observatory.global/industries/events/) Products - [Field Deployment Studio](https://observatory.global/studio/) - [Station Builder](https://observatory.global/studio/builder/) - [Field services](https://observatory.global/field-services/) - [Data products](https://observatory.global/data-products/) - [APIs and SDKs](https://observatory.global/protocol/developers/) - [Edge runtime and fleet](https://observatory.global/software/) - [Hardware catalogue](https://observatory.global/hardware/) - [Reference designs](https://observatory.global/protocol/reference-designs/) Resources - [Learn](https://observatory.global/learn/) - [Stories](https://observatory.global/stories/) - [Presentations](https://observatory.global/presentations/) - [Environments](https://observatory.global/environments/) - [Network scenes](https://observatory.global/environments/networks/) - [Observatories atlas](https://observatory.global/observatories/) - [Earth and maps](https://observatory.global/earth/) - [Technologies](https://observatory.global/technologies/) - [Countries](https://observatory.global/countries/) - [Spectrum](https://observatory.global/spectrum/) - [Observatory Protocol](https://observatory.global/protocol/) - [Specification](https://observatory.global/protocol/specification/) - [Conformance](https://observatory.global/protocol/conformance/) - [Open source](https://observatory.global/open/) - [Data credits](https://observatory.global/credits/) Company - [About](https://observatory.global/about/) - [Open governance](https://observatory.global/consortium/) - [Security and trust](https://observatory.global/security/) - [Careers](https://observatory.global/contact/careers/) - [Press](https://observatory.global/contact/press/) - [Contact sales](https://observatory.global/contact/) - [Privacy requests](https://observatory.global/privacy-request/) © 2026 Nexus Observatory Inc. [Security and trust](https://observatory.global/security/) [Privacy choices](https://observatory.global/privacy-choices/) [Accessibility](https://observatory.global/legal/accessibility/) [Privacy](https://observatory.global/legal/privacy/) [Terms](https://observatory.global/legal/terms/) [Status](https://status.observatory.global/) [Help translate](https://observatory.global/translate/)