The FIDO Device Onboard (FDO) workflow transfers device ownership and operational configuration from the manufacturer to the target owner environment through two primary stages.

• Overview of the FDO Lifecycle

FDO enables zero-touch onboarding by establishing cryptographically verified trust between the device, the manufacturer, and the owner. The onboarding lifecycle transitions the device from initial manufacturing to full operational status without requiring manual field configuration.

• Stage 1: Device Initialization (DI Protocol)

During manufacturing or factory preparation, the device establishes its foundational identity and cryptographic credentials.

Credential Generation

The device client contacts the manufacturer server to generate and store secure credentials directly on the device.

Identity Assignment

The manufacturer server assigns a globally unique identifier (GUID) to the device.

Ownership Voucher Creation

The manufacturer server generates an ownership voucher containing the network address of the rendezvous server (or the Owner server in rendezvous-bypass scenarios). Upon completion, the device is ready for shipment and onboarding.

• Stage 2: On-Site Onboarding (TO0, TO1, and TO2 Protocols)

Onsite onboarding connects the device to its final owner through a three-part Transfer Ownership (TO) protocol sequence.

Owner Registration (TO0)

The server administrator uploads the ownership voucher to the Owner server. The Owner server extracts the rendezvous server address, contacts the rendezvous server to prove ownership, and registers its own network address for device discovery.

Rendezvous Routing (TO1)

Upon first boot, the device client retrieves the rendezvous server address from its credentials and connects to it. The rendezvous server locates the device’s ownership voucher and redirects the client to the Owner server’s network address.

Device Setup and Provisioning (TO2)

The device client connects to the Owner server. Both entities authenticate each other using the ownership voucher and device credentials to establish an encrypted channel. The Owner server delivers ServiceInfo key-value pairs, which the device uses to execute its final configuration and reach an operational state.