What B-AS Is
A BACnet device profile is a standardized capability level: a checklist of things a device must be able to do before it can wear the label. B-AS (BACnet Authorization Server) is defined in Annex L of ANSI/ASHRAE 135-2024 (clause L.14.1) as the server in the BACnet authorization model: it issues access tokens to authorization clients (or their helpers) and holds the persistent authorization policies for the tokens it issues. The authorization mechanics are defined in Clause 17.
The checklist items are BACnet Interoperability Building Blocks (BIBBs). B-AS is the only profile in the Authentication and Authorization family. A device documents its claim in its PICS (Protocol Implementation Conformance Statement); to verify a claim, ask for the PICS and check the profile line.
Where It’s Used
B-AS fits the device that centralizes authorization decisions on a BACnet network.
- Token issuance. A server that issues access tokens a client presents to gain authorized access to protected operations.
- Policy enforcement point. A device holding the authorization policies for a site’s secured BACnet interactions.
- Security infrastructure. A server component in a BACnet deployment that layers authorization onto the network.
Required Services
The table below is the exhaustive service set required by the B-AS BIBBs. Initiates means the device sends the request or notification; Executes means the device receives and acts on it (responding, for confirmed services). BIBB codes encode the same split: a -A BIBB is the initiating side, a -B BIBB the executing side. A - means the profile does not require that direction; a device may still support it.
| Capability area | Service | Required by BIBB | Initiates | Executes |
|---|---|---|---|---|
| Authentication and authorization | AuthRequest | AA-AS-B | - | Yes |
| Data sharing | ReadProperty | DS-RP-B | - | Yes |
| Device and network management | Who-Is | DM-DDB-B | - | Yes |
| Device and network management | I-Am | DM-DDB-B | Yes | - |
| Device and network management | Who-Has | DM-DOB-B | - | Yes |
| Device and network management | I-Have | DM-DOB-B | Yes | - |
| Device and network management | DeviceCommunicationControl | DM-DCC-B | - | Yes |
The AA-AS-B requirement is the authorization-server function itself: the device executes the AuthRequest exchange defined in Clause 17 to issue tokens. The other rows are the ordinary device surface every BACnet device exposes.
Related Profiles
| Profile | How it relates to B-AS |
|---|---|
| B-SCHUB | Secure Connect Hub: the transport-security infrastructure profile, a complementary security role |
| B-BC | Building Controller: a device that may rely on an authorization server for secured operations |
| B-GENERAL | General: the catch-all profile, where an unusual security device might otherwise land |
What Chipkin Provides
The Clause 17 authorization-server function is part of Chipkin’s BACnet security roadmap; talk to us about B-AS and BACnet authorization on the CAS BACnet Stack.