diff --git a/src/gps.proto b/src/gps.proto
new file mode 100644
index 00000000..a6c1cce7
--- /dev/null
+++ b/src/gps.proto
@@ -0,0 +1,25 @@
+syntax = "proto3";
+
+package helium;
+
+message wgs84_position {
+  // (deg) 1e-7 scale
+  sint32 latitude = 1;
+
+  // (deg) 1e-7 scale
+  sint32 longitude = 2;
+
+  // Height above ellipsoid (mm)
+  int32 height = 3;
+
+  // Horizontal accuracy estimate (mm)
+  uint32 hacc = 4;
+
+  // Vertical accuracy estimate (mm)
+  optional uint32 vacc = 5;
+}
+
+message gps_time {
+    // time of beacon was received by concentrator (nanoseconds since GPS Epoch) (can be used for TDOA)
+    uint64 gps_time = 1;
+}
\ No newline at end of file
diff --git a/src/lib.rs b/src/lib.rs
index d626b784..bff494f9 100755
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -10,7 +10,7 @@ pub use prost::{DecodeError, EncodeError, Message};
 pub mod services {
     use crate::{
         BlockchainRegionParamsV1, BlockchainTokenTypeV1, BlockchainTxn, DataRate, EntropyReportV1,
-        GatewayStakingMode, MapperAttach, Region, RoutingAddress,
+        GatewayStakingMode, MapperAttach, Region, RoutingAddress, GpsTime, Wgs84Position,
     };
 
     pub mod iot_config {
diff --git a/src/packet.proto b/src/packet.proto
index 3de054d0..57d23ee9 100644
--- a/src/packet.proto
+++ b/src/packet.proto
@@ -2,6 +2,9 @@ syntax = "proto3";
 
 package helium;
 
+import "data_rate.proto";
+import "gps.proto";
+
 message eui {
   uint64 deveui = 1;
   uint64 appeui = 2;
@@ -36,3 +39,33 @@ message packet {
   routing_information routing = 9;
   window rx2_window = 10;
 }
+
+message secure_packet_v1 {
+  // frequency in Hz
+  uint64 freq = 1;
+
+  data_rate datarate = 2;
+
+  // Signal to Noise radio (0.01dB)
+  int32 snr = 3;
+
+  // Received Signal Strength Indicator (1 dBm)
+  sint32 rssi = 4;
+
+  // Internal timestamp of "RX finished" event
+  uint32 tmst = 5;
+
+  // Globally Unique identifier of Concentrator Card
+  bytes card_id = 6;
+
+  // time of beacon was received by concentrator (nanoseconds since GPS Epoch) (can be used for TDOA)
+  gps_time gps_time = 7;
+
+  wgs84_position pos = 8;
+
+  // packet payload
+  bytes data = 9;
+
+  // signature of the RX pkt signed by Secure Concentrator Card
+  bytes sc_signature = 10;
+}
diff --git a/src/service/packet_router.proto b/src/service/packet_router.proto
index 5962b91c..617cae09 100644
--- a/src/service/packet_router.proto
+++ b/src/service/packet_router.proto
@@ -38,6 +38,40 @@ message packet_router_packet_up_v1 {
   bytes signature = 10;
 }
 
+message packet_router_packet_up_v2 {
+  // frequency in Hz
+  uint64 freq = 1;
+
+  data_rate datarate = 2;
+
+  // Signal to Noise radio (0.01dB)
+  sint32 snr = 3;
+
+  // Received Signal Strength Indicator (1 dBm)
+  sint32 rssi = 4;
+
+  // Internal timestamp of "RX finished" event
+  uint32 tmst = 5;
+
+  // Globally Unique identifier of Concentrator Card
+  bytes card_id = 6;
+
+  // time of beacon was received by concentrator (nanoseconds since GPS Epoch) (can be used for TDOA)
+  gps_time gps_time = 7;
+
+  wgs84_position pos = 8;
+
+  // packet payload
+  bytes data = 9;
+
+  // signature of the RX pkt signed by Secure Concentrator Card
+  bytes sc_signature = 10;
+
+  // signature from the gateway
+  bytes gw_signature = 11;
+
+}
+
 message packet_router_register_v1 {
   uint64 timestamp = 1;
   bytes gateway = 2;
diff --git a/src/service/poc_lora.proto b/src/service/poc_lora.proto
index 98e49e31..a168b176 100644
--- a/src/service/poc_lora.proto
+++ b/src/service/poc_lora.proto
@@ -3,6 +3,7 @@ syntax = "proto3";
 package helium.poc_lora;
 
 import "data_rate.proto";
+import "gps.proto";
 
 enum verification_status {
   valid = 0;
@@ -39,6 +40,19 @@ enum invalid_reason {
   duplicate = 20;
 }
 
+message secure_packet_v1 {
+
+  // Globally Unique identifier of Concentrator Card
+  bytes card_id = 1;
+
+  gps_time gps_time = 2;
+
+  wgs84_position pos = 3;
+
+  // signature of the RX pkt signed by Secure Concentrator Card
+  bytes sc_signature = 4;
+}
+
 // beacon report as submitted by gateway to ingestor
 message lora_beacon_report_req_v1 {
   bytes pub_key = 2;
@@ -75,6 +89,9 @@ message lora_witness_report_req_v1 {
   uint64 frequency = 8;
   data_rate datarate = 10;
   bytes signature = 11;
+
+  // optional extra info used for secure concentrators
+  secure_packet_v1 secure_pkt = 12;
 }
 
 // response returned to gateway submitting witness report to ingestor