Building BIOS Architecture

Key and Credential Management controls the creation, provisioning, storage, use, rotation, revocation, recovery, and destruction of cryptographic credentials.

Credential categories may include:

BIOS platform identity;

Building ID credentials;

device and Cartridge credentials;

user credentials;

service credentials;

configuration-signing keys;

software-update signing keys;

communication credentials;

emergency-access credentials;

backup-encryption keys;

recovery credentials.

Every credential shall have:

unique identifier;

owner or controlling authority;

purpose;

permitted operations;

scope;

creation date;

expiration or review date;

storage requirement;

rotation requirement;

revocation status;

recovery policy.

Private keys shall be protected from unauthorized export where appropriate. Shared keys shall be limited because compromise of one entity may affect every entity using the same secret.

Credential rotation shall avoid uncontrolled interruption of building operation. Transitional trust may permit old and new credentials for a defined period.

Revoked credentials shall be distributed to affected local BIOS systems without requiring permanent cloud connectivity.

Ownership transfer shall include controlled transfer or replacement of building-administration credentials without changing the persistent Building ID.

Emergency recovery shall not rely on a single individual, device, or vendor. High-consequence root recovery may require multiple authorized parties or physically protected recovery materials.

Credential destruction shall occur when a device is decommissioned, transferred, compromised, or permanently removed from the trust domain.