Onboard and secure devices
This page explains how devices join Fundamentum: how you organize your fleet, describe your device models, and bring each device online with its own secure identity, from a single prototype to factory production.
Organize your fleet with registries
A registry is a container of devices inside a project. You decide how to segment your fleet: one registry per site, per customer or per type of installation. A registry defines:
- the connection settings its devices use (the MQTT host and port, and the provisioning secret);
- a provisioning window, the period during which new devices may join it;
- a quota per device type, the maximum number of devices of each model it accepts;
- the topics where its devices' telemetry and states are published.
Describe your device models with device types
A device type is the template a device is created from. It carries:
- a default configuration, copied onto every new device of that type;
- default metadata;
- the heartbeat policy: how long a device can stay silent before it is considered disconnected;
- its firmware versions, with their files;
- its capabilities: the actions the model supports, and how to encode them for each firmware version (see Operate remotely);
- whether it is a gateway, and whether it is a LoRaWAN device.
Each device type has an asset type ID, the number devices use to say which model they are.
Bring devices online
Fundamentum supports several provisioning paths, so you can pick the one that matches how your devices are built and installed.
Self-provisioning
The device registers itself in a registry, using the registry's provisioning secret. From a registry's dashboard, the Hub generates a ready-to-flash token file containing everything the device needs: the Devices API URL, the MQTT host and port, the project, registry and secret. The device sends its serial number and the public key of its RSA key pair, and receives its configuration and MQTT connection details in return.
Factory pre-registration: shelf devices
When devices are manufactured before anyone knows where they will be installed, you pre-register them as shelf devices: the factory records each serial number and public key, authorized by a time-limited provisioning key. A shelf device cannot connect yet. Later, when the destination is known, you assign it to the client's registry; the device asks for its registry until it gets an answer, then connects with the same credentials. A shelf device can also be moved back to the shelf and assigned to another registry.
LoRaWAN
Fundamentum includes a LoRaWAN Join Server. You register your LoRaWAN devices, set their AppKey from the Hub, and the platform handles their join requests.
Secure by default
- One identity per device. Each device signs in with its own RSA key pair; Fundamentum stores only the public key.
- No accidental re-provisioning. A device that is already provisioned with different credentials is refused; replacing its credentials is always an explicit step.
- Windows and quotas limit when and how many devices can join each registry.
See Security and trust for the complete picture.
Go further
-
Devices: the device guides.
-
Provisioning: choose a provisioning path.