Security: Video

Time is everything: meetings, public transportation, religion, transactions: the whole world is working because the concept of “time” exists. Within a security (or any other) system this is not different: recording schedules, logging, authorizations, encryption keys, timelines, all of these concepts can exist because of time. As a result, time can either make or break a system: problems can appear only due to a time difference of a couple of seconds between two system components. This article describes how time services can be configured in a BVMS version ≤ 10.1 environment. For BVMS  version ≥ 11.0 please refer to the following article:  Where can you configure NTP server for cameras/encoders in BVMS≥11? Time: what is the challenge? Each device has its own internal clock, which is based on a hardware mechanism. This mechanism acts like a watch: try to put two watches together and synchronize them on the millisecond. A security system consists out of more than two devices, it can consist of thousands of devices. Synchronizing the time of all these devices by hand is a very time consuming task. Additionally, due to small differences in electronic components, devices can have deviations from one another. These deviations cannot be detected by the human eye, but can result in considerable time differences when a device is running for months. Synchronizing time The Network Time Protocol (NTP) was created to solve these challenges. The Network Time Protocol is a network-based protocol for clock synchronization between system components. The protocol utilizes a standard IP network to communicate and can maintain a time difference (considering a local area network) of less than one millisecond between components. The Network Time Protocol is a standard protocol and documented in RFC 5905. The operation and configuration of the Network Time Protocol are complex: a hierarchical architecture needs to be set-up including several layers of systems which are able to run the Network Time Protocol. To reduce complexity the Simple Network Time Protocol (SNTP) was  created. The Simple Network Time Protocol is mainly used when less accuracy (deviations of 1-2 seconds are acceptable). Windows Time Service The Bosch Video Management System is running on Microsoft Windows Server operating systems. Windows includes an internal time service, which is explained on Microsoft Technet: “The Windows Time service, also known as W32Time, synchronizes the date and time for all computers running in an AD DS domain. Time synchronization is critical for the proper operation of many Windows services and line-of-business applications. The Windows Time service uses the Network Time Protocol (NTP) to synchronize computer clocks on the network so that an accurate clock value, or time stamp, can be assigned to network validation and resource access requests. The service integrates NTP and time providers, making it a reliable and scalable time service for enterprise administrators. The W32Time service is not a full-featured NTP solution that meets time-sensitive application needs and is not supported by Microsoft as such. For more information, see Microsoft Knowledge Base article 939322,Support boundary to configure the Windows Time service for high-accuracy environments (http://go.microsoft.com/fwlink/?LinkID=179459).” Source: Windows Time Service Technical Reference - Microsoft Technet The Windows Time service is based on the Simple Network Time Protocol. Summary The Network Time Protocol requires a very complex infrastructure, which impacts the total installation and configuration effort of the system. The Simple Network Time Protocol (also used for the Windows Time Service) reduces the complexity, but at the same time also reduces the accuracy. For most security applications the Simple Network Time Protocol provides sufficient accuracy. Bosch recommends to use the Windows Time service, based on the Simple Network Time Protocol, as basis for time synchronization in a security network. This article provides best-practices on how to configure the Bosch Video Management System and related components in a time synchronization environment based the Windows Time service. Alternatively, the Network Time Protocol can be used whenever it is already existing inside an infrastructure or when event accuracy with a deviation less than one second is required. Due to the complexity of the infrastructure Bosch does not make any recommendations related to the Network Time Protocol.     Step-by-step guide   Management server configuration   A. Operating system configuration This section also applies for the Video Recording Manager and Mobile Video Service when these are not running on the management server. Microsoft has prepared a lot of documentation related to time configuration Go to the Microsoft Support: How to configure an authoritative time server in Windows Server page and scroll down to the section “Configuring the Windows Time service to use an external time source”. Click the download button under the “Here’s an easy fix” section. Figure: Download the Microsoft Windows Time service configuration utility   The utility will configure external time servers. To select these, browse to http://pool.ntp.org and select two servers which are related to the geographical location of the system, for example “de.pool.ntp.org” and “nl.pool.ntp.org”, referring to Germany and the Netherlands. Another (local or external) (S)NTP server can also be chosen.   Start the Microsoft configuration utility and configure it as indicated and shown in the figure below. Administrative access is required to run the utility. Figure: Pool.ntp.org locations   Figure: Windows Time service configuration   Alternatively the configuration can be done from the command-line, using the command shown below. net stop w32time w32tm  /config   /syncfromflags :manual  /manualpeerlist : "nl.pool.ntp.org, de.pool.ntp.org" net start w32time The configuration can be verified by starting the Windows Command prompt and issuing the command “w32tm /query / status”, as shown in the figure below. Notice the time source, this should point towards the configured servers. Figure: verifying configuration   It can take up to one minute before the correct time source is displayed. When there is a problem, the configured (S)NTP server can be tested by issuing the “w32tm /stripchart /computer:de.pool.ntp.org”, which should result in the output displayed in the figure below. Figure: test the (S)NTP service   When an unexpected result is returned, it is recommended to check access to the specific (S)NTP server. A firewall might prevent the communication between the (S)NTP server and the management server.   B. BVMS Management Server configuration BVMS automatically points devices to its own time-server. This can be changed by editing the BvmsCenterlServer.exe.config file, located in C:\Program Files\Bosch\VMS\bin\. Find the key "TimeServerIPAddress" and adjust the value, as shown in the example below (192.168.0.1). <!-- Ip address of the time server for VRM/NVR encoders(defaults to the Central-Server IP if not set). --> < add   key = "TimeServerIPAddress"   value = "192.168.0.1"   />     C. Workstation configuration The Bosch Video Management System Operator client runs on a Windows workstation. When the workstation and server are part of the same Microsoft Active Directory service domain, no manual time synchronization needs to be configured. Figure: workstation configuration, "192.168.0.200" needs to be replaced by the IP address or Fully Qualified Domain Name of the management server.   When the Bosch Video Management System workstation and management Server are not joined in a domain, or into the same domain, the workstation(s) need to be manually configured to use the management server as a time server. To achieve this, the description above can be used. Instead of using the pool.ntp.org as a server, the management server is now entered.   D. Camera configuration If a camera is connected to a BVMS system the time server will be automatically configured.

This article informs about improvements in firmware handling and new security mechanisms that help our customers to increase security related to firmware updates and IP camera protection.

The following procedure describes how to restore DIVAR IP 5000 ALL-IN-ONE to the factory default image.   Step-by-step guide   1. Start the unit and press F7 during the BIOS power-on-selftest. The Recovery menu is displayed.   2. Select one of the following: – Initial factory setup: restores to factory default image and deletes all data on the HDDs. or – System Recovery (back to Factory Defaults): restores to factory default image; data on the HDDs will not be deleted.   Note: While the System Recovery option doesn't delete video footage stored on the data HDDs, it still replaces the complete OS (operating system) partition (including VMS settings) with a default configuration. In order to access existing video footage after recovery, the VMS configuration needs to be exported before System Recovery and re-imported afterwards.   Notice! Do not turn off the unit during the process. This will damage the Recovery media.   3. The unit starts from the Recovery media. If the setup is successful, press OK to restart the system.   4. Windows performs the initial setup of the operating system. The unit restarts after Windows has completed the setup. 5. After the restart of the unit, the factory settings are installed. 6. After the system has reboot, the next step is to change the BVRAdmin password. The default one is WSS4Bosch.

Similar to VRM eXport Wizard 2.0,  encrypted and unencrypted VRM recordings can be exported (VRM block export) from any video surveillance system based on Bosch Video Recording Manager (VRM) and exported recordings can be converted to mp4-files.    VRM eXport Wizard 2.10 introduces a new look and feel of the graphical user interface and some UX changes. In general, the VRM eXport wizard is a software tool that allows you to export video directly from the VRM and to convert exported video data to mp4. You can find the VRM eXport wizard setup file in the VRM Master Installer or in the bonus directory of the BVMS zip file. Exports made with the VRM eXport Wizard 2.10 can be open in BVMS (Viewer) 9.0 or newer. In this document we describe how to use the VRM eXport Wizard for either export of video data and conversion of the exorted video data to mp4. With the VRM eXport Wizard 2.10 encrypted and unencrypted VRM recordings can be exported (VRM block export) from any video surveillance system based on Bosch Video Recording Manager (VRM) and exported recordings can be converted to mp4-files. Therefore, the VRM eXport Wizard 2.10 offers - similiar to the previous version - the following two options, compare also Figure 1: Export Video Recording Manger recordings of cameras Convert already exported data to MP4 files

With the VRM eXport Wizard 2.0 encrypted and unencrypted VRM recordings can be exported (VRM block export) from any video surveillance system based on Bosch Video Recording Manager (VRM) and exported recordings can be converted to mp4-files. Therefore, the VRM eXport Wizard 2.0 offers the following two options, compare also Figure 1: Export VRM recordings of cameras Convert already exported data to mp4-file

The default Community Strings for Bosch cameras is - public. To change it, please follow the steps below.

This article provides you with information related to the Windows Firewall, how to access, configure and adjust it.

If BVMS and VRM are installed on the same machine, it is needed to change the TCP Port of the VRM Monitor.

This article explains how BVMS can be configured to connect to an LDAP (or Microsoft Active Directory) and use it as a base for user authentication.   BVMS is able to function in a (Windows) domain-controlled environment. The BVMS (and related) services run under the local system account. If another (domain-controlled) account is used to run these services, their permissions level should be the same as the local system account. It is recommended to add the Windows server to the domain first (as a domain member), before installing the BVMS software. The BVMS configuration is independent from the domain configuration, however, crucial changes in the domain could break the connection between the BVMS system and the LDAP authentication mechanism.

The Divar AN 3000/5000 features the ability to ping an IP address, thus allowing the technician to verify that the workstation that is to connect to the Divar can be seen on the network. Please note that this only checks the connection from the DIVAR to the Workstation. Ping operates by sending Internet Control Message Protocol (ICMP) echo request packets to the target host and waiting for an ICMP echo reply. The program reports errors, packet loss, and a statistical summary of the results.

This article will explain how to set-up the RAID quickly in order to start the "re-imaging" process from the Recovery DVD (one at DIVAR IP 6000 R2 - or two DVDs at DIVAR IP 7000 R2) enclose to each DIVAR IP 7000 R2 or DIVAR IP 6000 R2 delivery. 

This article explains how to integrate the Bosch MIC IP 7000 HD camera series into any existing analog CCTV system using the Bosch VIDEOJET decoder 3000. The most common integration scenarios are listed below: Simple integration using direct connectivity to analog monitor and joystick, typically found in single camera installation (for example, mobile surveillance vehicles) Integration into an existing analog matrix switcher typically found in large installations (such as for city surveillance)

An object moving or a low/ higher contrast scene can throw off the autofocus option, resulting in a soft focus or even not focus at all. Using manual focus is an obvious solution, but manual focus isn’t exactly easy to get sharp images. Manual focus requires a bit of know-how and some practice to get right. If you would like to improve the performance and get a sharp image, please see below how you can manually adjust the focus ring on a Dinion Thermal camera.

Sometimes it is preferable to have a different “user mode” during the day then in the night. Our cameras by default have the option to switch the user mode e.g. triggered by the camera D/N switch over. But also other triggers can be chosen. Below an example how to setup the “user mode” switching triggered by the D/N switch over.

Perhaps you are wondering how to set the maximum retention time on a Divar Network? Some of our customers asked about this option. Well, in DIVAR Network and Hybrid there is not retention time. But you can set the automatically deleting time, that is more or less the same.   Step-by-step guide:   Open one Browser and type your device IP address Login with the administrator account Go to Settings > Storage > Recording Fill in the box with the desired automatic deletion time   Another option is to make this change directly in the local interface of the unit.

Short intro and related topics: This article will review the settings required to configure Windows as a NTP time server. Note: If you are running VRM and have the Time Server enabled, you must disable the Time Server before performing the following. Article requirements: Windows Server 2016/ Windows 10

Find below Gmail SMTP settings which you have to set in your EMAIL screen of DIVAR Menu. SMTP Server address: smtp.gmail.com Username: Your Gmail e-mail adress Password: Your Gmail password Port (TLS😞 587 Port (SSL😞 465 TLS / SSL required: Yes TLS : Transport Layer Security         SSL: Secure Sockets Layer What happens if you do not select either one? If neither SSL nor TLS is used , then the communication line can easily become a party line for eavesdroppers, all data transmitted between DIVAR and e-mail account for anyone to see.

In Cloud-based Services, different 'Actions' can be configured for automatic processing as well as manual action for the operators (Alarm Agents). There are 2 different options how an action is processed: An 'Automatic Action' is processed automatically when the related Service Scenario is performed. An 'Intervention Action' is executed manually by an operator from the Cloud-based Service Operator Interface. This note shows available actions in Cloud-based Services and provides a step by step instruction to configure these actions.   Step-by-step guide   1. Send e-mail "Send e-mail" sends an e-mail notification to the configured recipient(s). The action can be used as manual action for the operators (Intervention Action). The content of the alarm email can be configured to the customer's needs.   To configure a "Send e-mail" action, perform the following steps: 1. Open Cloud-based Services Configuration website (/config), log in as Integrator or Config Agent. 2. Enter the related Account. 3. Click tab 'Actions'. 4. Click '+' button to add an action. 5. Give the action a descriptive name and select 'Email'. 6. Type recipients, CC's, mail subject and message. Use the pull down to enter environment variables to the e-mail text. 7. Click 'Create'. 8. Add the action to a Service Scenario for processing.   2. Execute PTZ Command "Execute PTZ Command" starts an auxiliary command on a Pan-Tilt-Zoom (PTZ) camera. The action can be used for automatic processing (Automatic Action) as well as manual action for the operators (Intervention Action). Note the available auxiliary commands in the camera’s manual. To configure an "Execute PTZ Command" action, perform the following steps: 1. Open Cloud-based Services Configuration website (/config), log in as Integrator or Config Agent. 2. Enter the related Account. 3. Click tab 'Actions'. 4. Click '+' button to add an action. 5. Give the action a descriptive name and select 'Execute PTZ Command'. 6. Select PTZ camera, select auxiliary command and type the command No. 7. Click 'Create'. 8. Add the action to a Service Scenario for processing   3. Go to PTZ Preposition "Go to PTZ Preposition" moves a Pan-Tilt-Zoom (PTZ) camera to a preposition. The action can be used for automatic processing (Automatic Action) as well as manual action for the operators (Intervention Action). The prepositions (shots) need to be configured via the Device Page upfront. To configure a "Go to PTZ Preposition" action, perform the following steps: 1. Open Cloud-based Services Configuration website (/config), log in as Integrator or Config Agent. 2. Enter the related Account. 3. Click tab 'Actions'. 4. Click '+' button to add an action. 5. Give the action a descriptive name and select 'Go to PTZ preposition'. 6. Select PTZ camera and type the preposition No. 7. Click 'Create'. 8. Add the action to a Service Scenario for processing.   4. Play Audio on Device "Play Audio on Device" replays an audio file directly from the device's loudspeaker. The action is intended to perform standard audio interventions without the need for the operator (alarm agent) to talk. "Play Audio on Device" can be used for automatic processing (Automatic Action) as well as manual action for the operators (Intervention Action). Audio files need to be prepared and installed by CBS development. If you want to use your own audio files, please get in contact with technical support. To configure a "Play Audio on Device" action, perform the following steps: 1. Open Cloud-based Services Configuration website (/config), log in as Integrator or Config Agent. 2. Enter the related Account. 3. Click tab 'Actions'. 4. Click '+' button to add an Action. 5. Give the Action a descriptive name and select 'Play audio on device'. 6. Select the audio device and select the audio file. 7. Click 'Create'. 8. Add the action to a Service Scenario for processing.   5. Switch Relay "Switch Relay" switches a relay of one or more IP devices. The action can be used for automatic processing (Automatic Action) as well as manual action for the operators (Intervention Action). To configure a "Switch Relay" action, perform the following steps: 1. Open Cloud-based Services Configuration website (/config), log in as Integrator or Config Agent. 2. Enter the related Account 3. Click tab 'Actions'. 4. Click '+' button to add an action. 5. Give the action a descriptive name and select 'Relay'. 6. Select activation mode and select one or more relays to switch. 7. Click 'Create'. 8. Add the action to a Service Scenario for processing.   6. Notify Monitoring Center and Log Event Both action types "Notify Monitoring Center" and "Log Event" are obsolete and can not be used in a Service Scenario.  See also: How to add a user to Remote Alert service in Remote Portal?

Related Products: BVMS / MVS / VSDK Overview: On request from development to provide a dump file from MVS system please follow the steps in the solution section.   Step-by-step guide   Reproduce the issue Download the Microsoft debugger procdump (https://technet.microsoft.com/en-us/sysinternals/dd996900.aspx). The procdump tool is also attaced to the article :How To create BVMS memory dump?  When application is crashing, do not click any buttons on the appeared error window that will change the program state. Run the procdump.exe from the directory where you copied the tool with following command line (Start - cmd): procdump.exe –ma <name of the programm exe> <dump file name>.dmp   In the case of MVS you need to do that for all 4 MVS services: - Bosch.MVS.SourceProvider.BVMS.Service.exe - Bosch.MVS.DataStorage.Service.exe - Bosch.MVS.SourceProvider.MobileCamera.Service.exe - Bosch.MVS.Transcoder.Service.exe