SlideShare a Scribd company logo
© FIDO Alliance 2024 Confidential
1
Choosing the right FDO
deployment model for
your application
Geoffrey Cooper, Intel Corporation
FIDO Alliance, IOT Technical Working Group, Co-Chair
April, 2024
FDO Deployment Issues
Device Manufacturer
Ownership
Voucher (OV)
FDO
Manufacturing
tool
FDO Client &
Credentials
Device Initialization (DI)
Target Cloud
FDO owner
Rendezvous
server (RV)
FDO Client &
credentials
TO0 & TO1
Device Discovers
Server
T02 protocol
Device Onboards
Onboarding
Data
→
• The Ownership Voucher is invalidated after the device onboards. The Target
Cloud gets a new OV, to allow only it to use FDO in the future.
Where is device?
Where to Send OV?
TO0 protocol
TO1 protocol
Device
shipped
Device
installed
Is Target Cloud on Prem / Internet?
Single- Multi-tenant?
We need Zero Trust → Ownership Voucher
• Ownership Voucher is a new concept in FDO
• Popular Zero trust security model is “never trust, always verify.”
• Problem for onboarding, device doesn’t know server yet!
• Ownership Voucher provides credentials for the device to trust,
because OV & Device both came from same factory
Target Cloud
FDO owner
FDO Client &
credentials
Onboarding
Data
→
Ownership
Voucher (OV)
SERVER
TRUST
FROM
FACTORY
CLIENT
TRUST
FROM
FACTORY
Zero Trust
Concept
in FDO
Verify Trust
Choosing the right FDO deployment model for
your application
FDO is very flexible. Several architectures are available.
Architectures are based on network configuration:
Single Cloud
Multi-Cloud
Closed Network
Cloud Service
Multi-Tenant Cloud
Service
X
In this presentation, we look at scenarios with
FDO deployments for different network configurations
Scenario 1: Onboarding devices with direct
internet access, single cloud/platform
Cloud 1
Devices
Scenario 1: Onboarding devices with direct
internet access, single cloud/platform
Customer Cloud
Manufacturer
Manufacturer Server
• Sets FDO device
credentials
• Creates FDO Ownership
Voucher
FDO Device
Initialize (DI)
FDO Device under
manufacture
RV
Cloud Controller (FDO
Owner)
• Receives Ownership Vouchers
• Runs FDO server to onboard
• Runs cloud services
Ownership Vouchers
for each device
TO2
Protocol
FSIM’s download
configs, code,
data, keys, etc.
Device is drop-shipped
to customer location.
Device access
via Internet
TO1
Protocol After onboard,
access cloud
services
Manufacturer sends OV for each
device to same customer cloud
Scenario 2: Onboarding devices with direct
internet access, multiple clouds
Cloud 1
US
Cloud 2
Asia
Clouds can be in
different geographies
Same type of
hardware is
deployed to
different Clouds
Scenario 2: Onboarding devices with
direct internet access, multiple clouds
Customer Cloud 2
RV
Manufacturer
Manufacturer Server
• Sets FDO device
credentials
• Creates FDO Ownership
Voucher
FDO Device
Initialize (DI)
FDO Device under
manufacture
TO2
Protocol
FSIM’s download
configs, code, data,
keys, etc.
Devices drop-shipped to
customer locations. After onboard,
access cloud
services
Customer Cloud 1
RV
TO1 TO2 FSIM’s
Cloud Controller
(FDO Owner)
Cloud Controller
(FDO Owner)
Orders for each device
include cloud address to
send OV
Order Processing
Orders specify where to send OV
(e.g., by geography, by ordering
company)
Ownership Vouchers for
each device determine
which cloud onboards
TO0
Protocol
Scenario 3: Onboarding devices: no direct internet access
(on-premises/Closed Network)
Customer Premise
Scenario 3: Onboarding devices without direct internet access
(on-premise/Closed Network)
Customer Premise
Manufacturer
Manufacturer Server
• Sets FDO device
credentials
• Creates FDO Ownership
Voucher
FDO Device
Initialize (DI)
FDO Device under
manufacture
RV
Cloud Controller (FDO
Owner)
• Receives Ownership Vouchers
• Runs FDO server to onboard
• Offers network services
Ownership Vouchers for
each device, sent to
customer
TO2
Protocol
FSIM’s
download
configs, code,
data, keys,
etc.
Device powers
on and
onboards using
FDO
Device is drop-shipped
to customer location.
Customer
Portal or
Email
Customer retrieves
Ownership Vouchers and
places them in FDO server
in closed network.
Manufacturer can send
Ownership Vouchers by
email instead of using a
portal.
After onboard,
access network
services
Customer distributes OV
Scenario 4: Onboarding devices –
some Local, Some Internet
Cloud 1 Cloud 2
Cloud 3
Scenario 4: Onboarding devices – some with and some
without direct internet access
Roaming Devices
Manufacturer
Manufacturer
Server
• Sets FDO device
credentials
• Creates FDO
Ownership Voucher
FDO
Device
Initialize
(DI)
FDO Device under
manufacture
TO2
Protocol
FSIM’s download
configs, code,
data, keys, etc.
Device is drop-
shipped to customer
location.
Customer
Premise
RV
Shared FDO Owner
• Receives Ownership
Vouchers
• Runs FDO server to onboard
• Application servers
Ownership
Vouchers
TO2 FSIM’s
etc
TO1
Protocol
TO1
After onboard,
access intranet
services
Scenario 5: Onboarding devices with direct internet
access, single cloud/platform, multi-tenant
Cloud 1
Tenant 1
Tenant 2
Tenant 3
Customer 1
Customer 2
Customer 3
Scenario 5: Onboarding devices on internet,
single multi-tenant cloud
Multi-Tenant Host Cloud
Customer N
Premise
(= Tenant A)
Customer N
Infrastructur
e
Customer N
Infrastructur
e
Manufacturer
Manufacturer Server
• Sets FDO device credentials
• Creates FDO Ownership
Voucher
FDO Device
Initialize (DI)
FDO Device under
manufacture
Ownership Vouchers for each
device, labeled with Tenant ID
TO2
Protocol
FSIM’s download
configs, code, data,
keys, etc.
Device powers on
and onboards using
FDO. Device
connects to tenant
infrastructure within
Host Cloud
Device is drop-shipped to
customer location.
Orders with Tenant ID
Tenant A
Infrastructure
RV
Cloud Controller (FDO
Owner)
• Receives Ownership Vouchers
• Runs FDO server to onboard
TO1
Protocol
Tenants
Tenant
A
Tenant
B
Tenant
C
Scenario 6: Onboarding devices on internet and closed network,
single cloud/platform, Roaming customers and multi-tenant
Cloud 1
Tenant 1
Tenant 2
Tenant 3
Customer 1
Internet &
embedded cloud 2
Customer 2
Customer 3 (roaming)
Cloud 2
Scenario 6: Onboarding devices with internet access and Closed
Network, single cloud/platform, multi-tenant
Closed Network
Manufacturer
Manufacturer Server
• Sets FDO device
credentials
• Creates FDO
Ownership Voucher
FDO-DI
FDO Device under
manufacture
RV
Cloud Controller (FDO
Owner)
Services for all devices
Customer
Portal /
Email
FDO Protocols
Ownership Vouchers
Internet Multi-Tenant
Orders by Tenant ID
Ownership Vouchers with Tenant ID RV
Cloud Controller (FDO
Owner)
Tenant Servers
FDO Protocols
Tenant Services
Intranet + Roaming
RV
Cloud Controller (FDO
Owner)
Application Servers for
all users
FDO Protocols
Intranet + Roaming
FDO Protocols
Local Services
Intranet Services
Conclusion
 Ownership Voucher allows FDO to implement Zero Trust
 Many client configurations are supported by sending
Ownership Vouchers to servers using combinations of:
Single Cloud
Multi-Cloud
Closed Network
Cloud Service
Multi-Tenant Cloud Service
X
© FIDO Alliance 2024 Confidential
22
Thank you

More Related Content

Similar to Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at Intel.pdf

New FIDO Specifications Overview -FIDO Alliance -Tokyo Seminar -Nadalin
New FIDO Specifications Overview -FIDO Alliance -Tokyo Seminar -NadalinNew FIDO Specifications Overview -FIDO Alliance -Tokyo Seminar -Nadalin
New FIDO Specifications Overview -FIDO Alliance -Tokyo Seminar -Nadalin
FIDO Alliance
 
FIDO UAF 1.0 Specs: Overview and Insights
FIDO UAF 1.0 Specs: Overview and InsightsFIDO UAF 1.0 Specs: Overview and Insights
FIDO UAF 1.0 Specs: Overview and Insights
FIDO Alliance
 
Forti Gate Virtual Appliances Sales 201010
Forti Gate Virtual Appliances Sales 201010Forti Gate Virtual Appliances Sales 201010
Forti Gate Virtual Appliances Sales 201010
Alvaro Roldan Peral
 
MT82 IoT Security Starts at Edge
MT82  IoT Security Starts at EdgeMT82  IoT Security Starts at Edge
MT82 IoT Security Starts at Edge
Dell EMC World
 
Let soracom help your IoT devices connect to the cloud!
Let soracom help your IoT devices connect to the cloud! Let soracom help your IoT devices connect to the cloud!
Let soracom help your IoT devices connect to the cloud!
Soracom Global, Inc.
 
The Value of FIDO Certification
The Value of FIDO CertificationThe Value of FIDO Certification
The Value of FIDO Certification
FIDO Alliance
 
End to End IoT projects with Zephyr.pdf
End to End IoT projects with Zephyr.pdfEnd to End IoT projects with Zephyr.pdf
End to End IoT projects with Zephyr.pdf
Alvaro Viebrantz
 
Overview of FIDO Security Requirements and Certifications
Overview of FIDO Security Requirements and CertificationsOverview of FIDO Security Requirements and Certifications
Overview of FIDO Security Requirements and Certifications
FIDO Alliance
 
FIDO, Federation and the Internet of Things
 FIDO, Federation and the Internet of Things FIDO, Federation and the Internet of Things
FIDO, Federation and the Internet of Things
FIDO Alliance
 
Using FIDO Authenticator for IoT Devices
Using FIDO Authenticator for IoT DevicesUsing FIDO Authenticator for IoT Devices
Using FIDO Authenticator for IoT Devices
FIDO Alliance
 
CIS14: FIDO 101 (What, Why and Wherefore of FIDO)
CIS14: FIDO 101 (What, Why and Wherefore of FIDO)CIS14: FIDO 101 (What, Why and Wherefore of FIDO)
CIS14: FIDO 101 (What, Why and Wherefore of FIDO)
CloudIDSummit
 
IoT Meets Security
IoT Meets SecurityIoT Meets Security
IoT Meets Security
Samsung Open Source Group
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
Enterprise Mobility (Admin)
Enterprise Mobility (Admin)Enterprise Mobility (Admin)
Enterprise Mobility (Admin)
Microsoft
 
FIDO2 and Microsoft
FIDO2 and MicrosoftFIDO2 and Microsoft
FIDO2 and Microsoft
FIDO Alliance
 
UAF Case Study by NTT Docomo
UAF Case Study by NTT DocomoUAF Case Study by NTT Docomo
UAF Case Study by NTT Docomo
FIDO Alliance
 
Open Source & The Internet of Things
Open Source & The Internet of ThingsOpen Source & The Internet of Things
Open Source & The Internet of Things
All Things Open
 
FIDO Technical Overview at FIDO KWG Hackathon
FIDO Technical Overview at FIDO KWG HackathonFIDO Technical Overview at FIDO KWG Hackathon
FIDO Technical Overview at FIDO KWG Hackathon
Ki-Eun Shin
 
CIS 2015 Extreme OpenID Connect - John Bradley
CIS 2015 Extreme OpenID Connect - John BradleyCIS 2015 Extreme OpenID Connect - John Bradley
CIS 2015 Extreme OpenID Connect - John Bradley
CloudIDSummit
 
SFScon 22 - Gabriele Sankalaite - Blockchain Smart Contracts and Multicast En...
SFScon 22 - Gabriele Sankalaite - Blockchain Smart Contracts and Multicast En...SFScon 22 - Gabriele Sankalaite - Blockchain Smart Contracts and Multicast En...
SFScon 22 - Gabriele Sankalaite - Blockchain Smart Contracts and Multicast En...
South Tyrol Free Software Conference
 

Similar to Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at Intel.pdf (20)

New FIDO Specifications Overview -FIDO Alliance -Tokyo Seminar -Nadalin
New FIDO Specifications Overview -FIDO Alliance -Tokyo Seminar -NadalinNew FIDO Specifications Overview -FIDO Alliance -Tokyo Seminar -Nadalin
New FIDO Specifications Overview -FIDO Alliance -Tokyo Seminar -Nadalin
 
FIDO UAF 1.0 Specs: Overview and Insights
FIDO UAF 1.0 Specs: Overview and InsightsFIDO UAF 1.0 Specs: Overview and Insights
FIDO UAF 1.0 Specs: Overview and Insights
 
Forti Gate Virtual Appliances Sales 201010
Forti Gate Virtual Appliances Sales 201010Forti Gate Virtual Appliances Sales 201010
Forti Gate Virtual Appliances Sales 201010
 
MT82 IoT Security Starts at Edge
MT82  IoT Security Starts at EdgeMT82  IoT Security Starts at Edge
MT82 IoT Security Starts at Edge
 
Let soracom help your IoT devices connect to the cloud!
Let soracom help your IoT devices connect to the cloud! Let soracom help your IoT devices connect to the cloud!
Let soracom help your IoT devices connect to the cloud!
 
The Value of FIDO Certification
The Value of FIDO CertificationThe Value of FIDO Certification
The Value of FIDO Certification
 
End to End IoT projects with Zephyr.pdf
End to End IoT projects with Zephyr.pdfEnd to End IoT projects with Zephyr.pdf
End to End IoT projects with Zephyr.pdf
 
Overview of FIDO Security Requirements and Certifications
Overview of FIDO Security Requirements and CertificationsOverview of FIDO Security Requirements and Certifications
Overview of FIDO Security Requirements and Certifications
 
FIDO, Federation and the Internet of Things
 FIDO, Federation and the Internet of Things FIDO, Federation and the Internet of Things
FIDO, Federation and the Internet of Things
 
Using FIDO Authenticator for IoT Devices
Using FIDO Authenticator for IoT DevicesUsing FIDO Authenticator for IoT Devices
Using FIDO Authenticator for IoT Devices
 
CIS14: FIDO 101 (What, Why and Wherefore of FIDO)
CIS14: FIDO 101 (What, Why and Wherefore of FIDO)CIS14: FIDO 101 (What, Why and Wherefore of FIDO)
CIS14: FIDO 101 (What, Why and Wherefore of FIDO)
 
IoT Meets Security
IoT Meets SecurityIoT Meets Security
IoT Meets Security
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
Enterprise Mobility (Admin)
Enterprise Mobility (Admin)Enterprise Mobility (Admin)
Enterprise Mobility (Admin)
 
FIDO2 and Microsoft
FIDO2 and MicrosoftFIDO2 and Microsoft
FIDO2 and Microsoft
 
UAF Case Study by NTT Docomo
UAF Case Study by NTT DocomoUAF Case Study by NTT Docomo
UAF Case Study by NTT Docomo
 
Open Source & The Internet of Things
Open Source & The Internet of ThingsOpen Source & The Internet of Things
Open Source & The Internet of Things
 
FIDO Technical Overview at FIDO KWG Hackathon
FIDO Technical Overview at FIDO KWG HackathonFIDO Technical Overview at FIDO KWG Hackathon
FIDO Technical Overview at FIDO KWG Hackathon
 
CIS 2015 Extreme OpenID Connect - John Bradley
CIS 2015 Extreme OpenID Connect - John BradleyCIS 2015 Extreme OpenID Connect - John Bradley
CIS 2015 Extreme OpenID Connect - John Bradley
 
SFScon 22 - Gabriele Sankalaite - Blockchain Smart Contracts and Multicast En...
SFScon 22 - Gabriele Sankalaite - Blockchain Smart Contracts and Multicast En...SFScon 22 - Gabriele Sankalaite - Blockchain Smart Contracts and Multicast En...
SFScon 22 - Gabriele Sankalaite - Blockchain Smart Contracts and Multicast En...
 

More from FIDO Alliance

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdfFIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdfFIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: CloudGate.pdf
FIDO Alliance Osaka Seminar: CloudGate.pdfFIDO Alliance Osaka Seminar: CloudGate.pdf
FIDO Alliance Osaka Seminar: CloudGate.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdfFIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: Welcome Slides.pdf
FIDO Alliance Osaka Seminar: Welcome Slides.pdfFIDO Alliance Osaka Seminar: Welcome Slides.pdf
FIDO Alliance Osaka Seminar: Welcome Slides.pdf
FIDO Alliance
 
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FIDO Alliance
 
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
FIDO Alliance
 
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdfHow Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
FIDO Alliance
 
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
FIDO Alliance
 
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdfWhere to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
FIDO Alliance
 
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdfLinux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
FIDO Alliance
 
ADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptxADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptx
FIDO Alliance
 
Design Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptxDesign Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptx
FIDO Alliance
 
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptxHarnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
FIDO Alliance
 
Hyatt driving innovation and exceptional customer experiences with FIDO passw...
Hyatt driving innovation and exceptional customer experiences with FIDO passw...Hyatt driving innovation and exceptional customer experiences with FIDO passw...
Hyatt driving innovation and exceptional customer experiences with FIDO passw...
FIDO Alliance
 
Intro to Passkeys and the State of Passwordless.pptx
Intro to Passkeys and the State of Passwordless.pptxIntro to Passkeys and the State of Passwordless.pptx
Intro to Passkeys and the State of Passwordless.pptx
FIDO Alliance
 
Introduction to FIDO Authentication and Passkeys.pptx
Introduction to FIDO Authentication and Passkeys.pptxIntroduction to FIDO Authentication and Passkeys.pptx
Introduction to FIDO Authentication and Passkeys.pptx
FIDO Alliance
 

More from FIDO Alliance (20)

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdfFIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
 
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdfFIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
FIDO Alliance Osaka Seminar: CloudGate.pdf
FIDO Alliance Osaka Seminar: CloudGate.pdfFIDO Alliance Osaka Seminar: CloudGate.pdf
FIDO Alliance Osaka Seminar: CloudGate.pdf
 
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdfFIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
 
FIDO Alliance Osaka Seminar: Welcome Slides.pdf
FIDO Alliance Osaka Seminar: Welcome Slides.pdfFIDO Alliance Osaka Seminar: Welcome Slides.pdf
FIDO Alliance Osaka Seminar: Welcome Slides.pdf
 
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
 
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
 
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdfHow Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
 
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
 
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdfWhere to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
 
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdfLinux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
 
ADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptxADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptx
 
Design Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptxDesign Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptx
 
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptxHarnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
 
Hyatt driving innovation and exceptional customer experiences with FIDO passw...
Hyatt driving innovation and exceptional customer experiences with FIDO passw...Hyatt driving innovation and exceptional customer experiences with FIDO passw...
Hyatt driving innovation and exceptional customer experiences with FIDO passw...
 
Intro to Passkeys and the State of Passwordless.pptx
Intro to Passkeys and the State of Passwordless.pptxIntro to Passkeys and the State of Passwordless.pptx
Intro to Passkeys and the State of Passwordless.pptx
 
Introduction to FIDO Authentication and Passkeys.pptx
Introduction to FIDO Authentication and Passkeys.pptxIntroduction to FIDO Authentication and Passkeys.pptx
Introduction to FIDO Authentication and Passkeys.pptx
 

Recently uploaded

Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
Safe Software
 
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
Pixlogix Infotech
 
Pushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 daysPushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 days
Adtran
 
UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6
DianaGray10
 
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
Tomaz Bratanic
 
“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...
“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...
“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...
Edge AI and Vision Alliance
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
Uni Systems S.M.S.A.
 
Mariano G Tinti - Decoding SpaceX
Mariano G Tinti - Decoding SpaceXMariano G Tinti - Decoding SpaceX
Mariano G Tinti - Decoding SpaceX
Mariano Tinti
 
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
Neo4j
 
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
panagenda
 
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
Neo4j
 
Mind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AIMind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AI
Kumud Singh
 
GenAI Pilot Implementation in the organizations
GenAI Pilot Implementation in the organizationsGenAI Pilot Implementation in the organizations
GenAI Pilot Implementation in the organizations
kumardaparthi1024
 
How to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For FlutterHow to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For Flutter
Daiki Mogmet Ito
 
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdfUnlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Malak Abu Hammad
 
Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1
DianaGray10
 
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
SOFTTECHHUB
 
AI 101: An Introduction to the Basics and Impact of Artificial Intelligence
AI 101: An Introduction to the Basics and Impact of Artificial IntelligenceAI 101: An Introduction to the Basics and Impact of Artificial Intelligence
AI 101: An Introduction to the Basics and Impact of Artificial Intelligence
IndexBug
 
National Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practicesNational Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practices
Quotidiano Piemontese
 
How to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptxHow to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptx
danishmna97
 

Recently uploaded (20)

Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
 
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
 
Pushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 daysPushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 days
 
UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6
 
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
 
“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...
“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...
“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
 
Mariano G Tinti - Decoding SpaceX
Mariano G Tinti - Decoding SpaceXMariano G Tinti - Decoding SpaceX
Mariano G Tinti - Decoding SpaceX
 
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
 
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
 
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
 
Mind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AIMind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AI
 
GenAI Pilot Implementation in the organizations
GenAI Pilot Implementation in the organizationsGenAI Pilot Implementation in the organizations
GenAI Pilot Implementation in the organizations
 
How to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For FlutterHow to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For Flutter
 
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdfUnlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
 
Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1
 
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
 
AI 101: An Introduction to the Basics and Impact of Artificial Intelligence
AI 101: An Introduction to the Basics and Impact of Artificial IntelligenceAI 101: An Introduction to the Basics and Impact of Artificial Intelligence
AI 101: An Introduction to the Basics and Impact of Artificial Intelligence
 
National Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practicesNational Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practices
 
How to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptxHow to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptx
 

Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at Intel.pdf

  • 1. © FIDO Alliance 2024 Confidential 1 Choosing the right FDO deployment model for your application Geoffrey Cooper, Intel Corporation FIDO Alliance, IOT Technical Working Group, Co-Chair April, 2024
  • 2. FDO Deployment Issues Device Manufacturer Ownership Voucher (OV) FDO Manufacturing tool FDO Client & Credentials Device Initialization (DI) Target Cloud FDO owner Rendezvous server (RV) FDO Client & credentials TO0 & TO1 Device Discovers Server T02 protocol Device Onboards Onboarding Data → • The Ownership Voucher is invalidated after the device onboards. The Target Cloud gets a new OV, to allow only it to use FDO in the future. Where is device? Where to Send OV? TO0 protocol TO1 protocol Device shipped Device installed Is Target Cloud on Prem / Internet? Single- Multi-tenant?
  • 3. We need Zero Trust → Ownership Voucher • Ownership Voucher is a new concept in FDO • Popular Zero trust security model is “never trust, always verify.” • Problem for onboarding, device doesn’t know server yet! • Ownership Voucher provides credentials for the device to trust, because OV & Device both came from same factory Target Cloud FDO owner FDO Client & credentials Onboarding Data → Ownership Voucher (OV) SERVER TRUST FROM FACTORY CLIENT TRUST FROM FACTORY Zero Trust Concept in FDO Verify Trust
  • 4. Choosing the right FDO deployment model for your application FDO is very flexible. Several architectures are available. Architectures are based on network configuration: Single Cloud Multi-Cloud Closed Network Cloud Service Multi-Tenant Cloud Service X In this presentation, we look at scenarios with FDO deployments for different network configurations
  • 5. Scenario 1: Onboarding devices with direct internet access, single cloud/platform Cloud 1 Devices
  • 6. Scenario 1: Onboarding devices with direct internet access, single cloud/platform Customer Cloud Manufacturer Manufacturer Server • Sets FDO device credentials • Creates FDO Ownership Voucher FDO Device Initialize (DI) FDO Device under manufacture RV Cloud Controller (FDO Owner) • Receives Ownership Vouchers • Runs FDO server to onboard • Runs cloud services Ownership Vouchers for each device TO2 Protocol FSIM’s download configs, code, data, keys, etc. Device is drop-shipped to customer location. Device access via Internet TO1 Protocol After onboard, access cloud services Manufacturer sends OV for each device to same customer cloud
  • 7. Scenario 2: Onboarding devices with direct internet access, multiple clouds Cloud 1 US Cloud 2 Asia Clouds can be in different geographies Same type of hardware is deployed to different Clouds
  • 8. Scenario 2: Onboarding devices with direct internet access, multiple clouds Customer Cloud 2 RV Manufacturer Manufacturer Server • Sets FDO device credentials • Creates FDO Ownership Voucher FDO Device Initialize (DI) FDO Device under manufacture TO2 Protocol FSIM’s download configs, code, data, keys, etc. Devices drop-shipped to customer locations. After onboard, access cloud services Customer Cloud 1 RV TO1 TO2 FSIM’s Cloud Controller (FDO Owner) Cloud Controller (FDO Owner) Orders for each device include cloud address to send OV Order Processing Orders specify where to send OV (e.g., by geography, by ordering company) Ownership Vouchers for each device determine which cloud onboards TO0 Protocol
  • 9. Scenario 3: Onboarding devices: no direct internet access (on-premises/Closed Network) Customer Premise
  • 10. Scenario 3: Onboarding devices without direct internet access (on-premise/Closed Network) Customer Premise Manufacturer Manufacturer Server • Sets FDO device credentials • Creates FDO Ownership Voucher FDO Device Initialize (DI) FDO Device under manufacture RV Cloud Controller (FDO Owner) • Receives Ownership Vouchers • Runs FDO server to onboard • Offers network services Ownership Vouchers for each device, sent to customer TO2 Protocol FSIM’s download configs, code, data, keys, etc. Device powers on and onboards using FDO Device is drop-shipped to customer location. Customer Portal or Email Customer retrieves Ownership Vouchers and places them in FDO server in closed network. Manufacturer can send Ownership Vouchers by email instead of using a portal. After onboard, access network services Customer distributes OV
  • 11. Scenario 4: Onboarding devices – some Local, Some Internet Cloud 1 Cloud 2 Cloud 3
  • 12. Scenario 4: Onboarding devices – some with and some without direct internet access Roaming Devices Manufacturer Manufacturer Server • Sets FDO device credentials • Creates FDO Ownership Voucher FDO Device Initialize (DI) FDO Device under manufacture TO2 Protocol FSIM’s download configs, code, data, keys, etc. Device is drop- shipped to customer location. Customer Premise RV Shared FDO Owner • Receives Ownership Vouchers • Runs FDO server to onboard • Application servers Ownership Vouchers TO2 FSIM’s etc TO1 Protocol TO1 After onboard, access intranet services
  • 13. Scenario 5: Onboarding devices with direct internet access, single cloud/platform, multi-tenant Cloud 1 Tenant 1 Tenant 2 Tenant 3 Customer 1 Customer 2 Customer 3
  • 14. Scenario 5: Onboarding devices on internet, single multi-tenant cloud Multi-Tenant Host Cloud Customer N Premise (= Tenant A) Customer N Infrastructur e Customer N Infrastructur e Manufacturer Manufacturer Server • Sets FDO device credentials • Creates FDO Ownership Voucher FDO Device Initialize (DI) FDO Device under manufacture Ownership Vouchers for each device, labeled with Tenant ID TO2 Protocol FSIM’s download configs, code, data, keys, etc. Device powers on and onboards using FDO. Device connects to tenant infrastructure within Host Cloud Device is drop-shipped to customer location. Orders with Tenant ID Tenant A Infrastructure RV Cloud Controller (FDO Owner) • Receives Ownership Vouchers • Runs FDO server to onboard TO1 Protocol Tenants Tenant A Tenant B Tenant C
  • 15. Scenario 6: Onboarding devices on internet and closed network, single cloud/platform, Roaming customers and multi-tenant Cloud 1 Tenant 1 Tenant 2 Tenant 3 Customer 1 Internet & embedded cloud 2 Customer 2 Customer 3 (roaming) Cloud 2
  • 16. Scenario 6: Onboarding devices with internet access and Closed Network, single cloud/platform, multi-tenant Closed Network Manufacturer Manufacturer Server • Sets FDO device credentials • Creates FDO Ownership Voucher FDO-DI FDO Device under manufacture RV Cloud Controller (FDO Owner) Services for all devices Customer Portal / Email FDO Protocols Ownership Vouchers Internet Multi-Tenant Orders by Tenant ID Ownership Vouchers with Tenant ID RV Cloud Controller (FDO Owner) Tenant Servers FDO Protocols Tenant Services Intranet + Roaming RV Cloud Controller (FDO Owner) Application Servers for all users FDO Protocols Intranet + Roaming FDO Protocols Local Services Intranet Services
  • 17. Conclusion  Ownership Voucher allows FDO to implement Zero Trust  Many client configurations are supported by sending Ownership Vouchers to servers using combinations of: Single Cloud Multi-Cloud Closed Network Cloud Service Multi-Tenant Cloud Service X
  • 18. © FIDO Alliance 2024 Confidential 22 Thank you