Developer
Architecture
The CurNext site path from field nodes to cloud - five layers with one job each: L1 sense, L2 floor aggregate, L3 power, L4 building uplink, L5 decide.
This is the product architecture reference for operators and developers. Security zone detail lives on the Security page.
- 01 · SenseL1Field nodes
- 02 · AggregateL2CN-FG
- 03 · PowerL3CN-UPS
- 04 · BridgeL4CN-BC
- 05 · DecideL5CurNext cloud
Layers L1-L5
Each layer has one job. Power does not interpret measurements. Floor gateways do not face the public internet. The building controller is the security boundary for uplink and signed field OTA.
- 1
L1 · Sense
Field nodes
L1 - Field sensors
Devices install on the work itself - curing slabs, drying walls, indoor air, leaks, structure, or plant systems. They capture the conditions that drive schedule and quality decisions.
- SKUs: CN-CC, CN-WD, CN-IAQ, CN-LEAK, CN-SHM, CN-MEP
- Unique device identity and secure-element key material
- Tamper-proof design and displacement detection
- LoRaWAN Class A (EU868) for battery wireless nodes where applicable
- 2
L2 · Aggregate
CN-FG
L2 - Floor gateway
Each floor concentrates device traffic at one collection point so a level stays organized as the project scales across wings and zones.
- Trust anchor for air-link verification (MIC, counters, join)
- Floor VLAN only - no cloud-facing interface
- OTA only from CN-BC
- 3
L3 · Power
CN-UPS
L3 - Site power
Dedicated power keeps floor and building hardware online through outages. This layer supplies power only - it does not interpret measurements or carry a data plane on the management VLAN.
- Power continuity for L2 / L4 during grid loss
- No telemetry interpretation
- No public data plane on the management path
- 4
L4 · Bridge
CN-BC
L4 - Building controller
The building unit is the secure link from the site network to CurNext. It maintains a protected path off the jobsite, terminates field OTA orchestration, and speaks to the private cloud broker path.
- WireGuard client at the building security boundary
- MQTT over TLS with mutual TLS to the private broker
- Signed OTA jobs for L1 / L2 targets
- Encrypted store-and-forward when the uplink is down
- 5
L5 · Decide
CurNext cloud
L5 - CurNext cloud
The platform turns site data into readiness status, alerts, and next actions - in the web dashboard and mobile app - with an audit trail for clients and compliance.
- Project dashboards, alerts, BIM-mapped readiness
- REST API, SDKs, Market Place, firmware catalog
- Invite-only access, RBAC, privileged MFA
Data path
Measurements move up the stack. Decisions and signed operations come back through CurNext.
L1 → L2
LoRaWAN air link
L2 → L4
Floor / building Ethernet VLAN
L3 → L2 / L4
PoE / site power only
L4 → L5
WireGuard + MQTT / TLS
L5 → Buyers
HTTPS REST · dash · mobile
Deploy anywhere with internet
This L1-L5 structure is self-contained on site: field nodes talk LoRaWAN only to CurNext floor gateways (CN-FG), and the building controller (CN-BC) reaches CurNext cloud over ordinary internet. That means a project can be deployed anywhere on earth with internet connectivity. It does not depend on a country-specific public LoRaWAN network operator - unlike systems that only work where such a national or carrier LoRaWAN network already exists.
Design rules
One job per layer
Power does not interpret measurements. Floor gateways do not face the public internet. The building controller is the security boundary for uplink and signed field OTA.
Same path for every surface
Curing, drying, air, leak, structure, and MEP share L2-L5. Only the L1 product line changes.
Decisions and evidence
L5 is where teams act - readiness, alerts, and an audit trail - not raw sensor dumps alone.
Internet, not a national LoRaWAN net
Site radio stays private (L1↔L2). Cloud reach uses CN-BC over internet - so coverage is not limited to countries with a public LoRaWAN network.