Secure Credential Management for Installation

Overview

During home installations, certain devices and integrations require credentials (usernames, passwords, API keys) that homeowners consider sensitive. Currently installers have full visibility into these credentials — they can see, copy, and retain them indefinitely. This creates a privacy and security risk.

This feature introduces a secure credential vault that acts as a zero-knowledge proxy: homeowners share credentials with Selora Connect, not with the installer. The installer can request credential usage for specific integration/device configuration tasks without ever seeing the credentials.

Credentials are encrypted with AWS KMS, stored securely, and deleted after the installation is completed and approved by the homeowner.

Workflow

1. Credential Submission — The homeowner (or installer on their behalf) submits credentials for a specific device or integration through Selora Connect.
2. KMS Encryption — Credentials are immediately encrypted using AWS KMS keys tied to the homeowner’s account. The installer never sees plaintext credentials.
3. Installer Requests Credential Usage — When the installer needs to configure an integration or device, they request credential usage through the installer dashboard. The request includes what integration/device, what credentials, and why.
4. Homeowner Approval — Homeowner receives a notification (email + dashboard) showing which credentials are being requested, for what device/integration, and by which installer. They approve or deny each request.
5. Credential Provisioning — Upon approval, the encrypted credentials are made available to the installer’s session for the requested purpose only. The installer’s session decrypts and uses them inline — the credentials are never exposed as plaintext to the installer. The session is logged.
6. Credential Deletion — After the installation is approved by the homeowner, the credentials are permanently deleted from Selora Connect storage. The installer’s session is terminated.

Device Provisioning

When a new device is being installed and the homeowner needs an account (e.g., a camera service, security system, or third-party integration):

1. Automated Account Creation — Selora Connect creates the device account on behalf of the homeowner using provisioning APIs.
2. Credential Release — After installation is approved, the generated credentials are delivered directly to the homeowner’s Selora Connect dashboard. The installer never sees them.
3. Homeowner Verification — Homeowner receives a notification with a summary of the newly provisioned account (device name, service, creation date). They can activate or reject the account.

Security Model

• KMS-Encrypted Storage — All credentials are encrypted at rest using AWS KMS customer-managed keys. Each homeowner has their own KMS key alias. Credentials are never stored in plaintext in any database, log, or backup.
• Zero-Knowledge for Installers — The installer UI only shows credential metadata (what service, what device, when it was submitted) — never the actual username or password.
• Session-Only Decryption — When the installer requests credentials for configuration, decryption happens in-memory within the installer’s session and is logged. The credentials are never written to disk.
• Automatic Expiration — Credentials expire after the installation is approved or after a configurable TTL (default: 48 hours after installation approval). Expired credentials are permanently deleted.
• Audit Trail — Every credential submission, access request, approval, and deletion is logged with timestamps, installer identity, and homeowner actions.

Customer Value

• Homeowner privacy — Credentials are shared only with Selora’s secure vault, not with the installer who may leave or have access to other customers.
• Trust through transparency — Homeowners always know which credentials were used, for what devices, and by which installers.
• Reduced liability — No credentials in installer systems means no credential leakage if an installer’s systems are compromised.
• Compliance — Meets privacy regulations by design — credentials are deleted after use, with no retention risk.

Scope (first iteration)

• KMS-encrypted credential storage and management.
• Installer credential usage request workflow (submit request → homeowner approval → use → delete).
• Device account provisioning API (auto-create accounts, deliver credentials to homeowner).
• Email notifications for credential submission, requests, approvals, and deletions.
• Dashboard UI for homeowners: view submitted credentials, approve/deny requests, verify provisioned accounts.
• Dashboard UI for installers: request credential usage, see metadata only, no plaintext access.

Target Customers

• Homeowners — Protect their account credentials during third-party installation work.
• Installers — Configure devices without handling sensitive credentials — reducing liability and complexity.

Technical Considerations

• KMS Integration — AWS KMS with customer-managed keys, key rotation policies, and cross-account access controls.
• Secret Management — Secrets Manager or equivalent for runtime credential retrieval during installer sessions.
• Audit Logging — All credential access must be logged to CloudWatch/ CloudTrail for traceability.
• Installer Session Isolation — Installer sessions must be sandboxed to prevent credential extraction (no copy-paste, no screenshots, no export).

Related

• Support Access Requests Validation (Epic #60): Roadmap — the approval workflow that also gates credential requests.