About Central_Support

📚 Overview BVMS and VRM Encrypted Recording Prerequisites Data Encryption: General Overview VRM Encryption Operation Overview VRM Encryption Operation Overview: Playback Step-by-step guide VRM Encryption Configuration Step 1  Step 2  VRM Encryption: Certificate Page VRM Encryption: Playback VRM Encryption: What’s NOT Supported VRM Encryption: Old Keys | New Keys   BVMS and VRM Encrypted Recording Prerequisites   Starting with BVMS v10.0, you can leverage VRM Encryption Technology.   Compatibility requirements are as follows: VRM version 3.82 or higher Camera Firmware 7.10 or higher  Camera must have Crypto Coprocessor version 3 or higher Devices “System Overview” web page as noted in the “Lock Down Module”  Note Video Devices that do not meet the prerequisites defined above, or were produced prior to 2014, can be encrypted utilizing VSG   Data Encryption: General Overview    Data encryption on iSCSI storages The payload on an iSCSI drive is encrypted using a symmetric XTS (AES) encryption scheme This is block encryption, NOT Whole Disk Encryption The Step-by-Step Process is covered in this article The camera uses the VRM’s public key(s) to asymmetrically encrypt the XTS key for multiple receivers. These public key(s) are maintained in the camera’s certificate store. Usage can be defined as for “REC1 or REC2”. VRM decrypts the payload data for replay for supported clients Supported Clients: VSC, BVMS v10 and Higher   VRM Encryption Operation Overview   The VRM iSCSI encryption process happens in several phases and utilizes two sets of keys: VRM’s Asymmetric Key set   The cameras Internal Symmetric Key used specifically for “LUN” Encryption When cameras are added to the VRM configuration VRM distributes a “Static” public key to all devices   The Camera will encrypt all of it’s “Blocks” with its own dynamically generated Symmetric Keys: The AES Encryption Keys are generated in the cameras Crypto Co-Processor   Each Block is Encrypted with a Unique Key   The Camera’s “Symmetric Key” that was used to encrypt the block is then:  Encrypted VRM’s “REC1” public key   The key is then “Stored” in the block that it encrypted   VRM Encryption Operation Overview: Playback   VRM performs the playback function by retrieving the camera’s Symmetric Key that was encrypted with its “Public Key”, and stored in the block. VRM Decrypts the “Symmetric Key” using its “Private Key” The Video in the AES Encrypted “Block” can now be decrypted and played back to the client   Step-by-step guide   VRM Encryption Configuration   When a VRM service starts for the first time, it will auto generate a self signed “Recording” Certificate (REC1) Certificates and keys will either be placed in the OS Certificate Store (MMC), or the Crypto Co-Processor of its appliance if equipped.   Certificate Structure is the same as discussed in the “Certificate and MCA” module All capable video devices that are added to the VRM are automatically given the VRM’s static “Public” key:   Step 1    VRM encryption cannot be initially started until a “Backup” of the of its Private “REC1” key is made!   In the Devices Tree highlight the system’s VRM. Navigate to the “Service” menu tab and the “Recording encryption” submenu: Under “Redundancy key” select the “Create” button   You will receive a “Create redundancy key pop-up menu Select the “Browse” tab Once you select a location …   You will receive a key menu similar to the Micro CA  Fill in the appropriate data and password    Note The backup key will be saved as a PKSC12 File (PXF) which will contain the Private Key and X.509 Certificate    Step 2    After a Redundancy key has been created you will now have access to the “Enable encrypted recording” checkbox. After you select it you will be asked if you want to proceed: select “Yes”   After saving and activating your configuration, all VRM devices should show a status if “Encrypting”   VRM Encryption: Certificate Page   Similar to the Certificate Store in the Cameras and the Micro CA in Configuration Manager, VRM has a “Certificates Page” ( Services and Certificates menu). Back Up certificates can be uploaded using this page: Usage “REC1” needs to be applied    VRM Encryption: Playback   Because the Workstation setting of direct playback from storage will not function if dealing with encrypted video, this setting is automatically ignored if configured: The Workstation will be redirected to utilize VRM Decrypted Playback   VRM Encryption: What’s NOT Supported   Encoder 32 Block Playback during VRM Downtime Not Supported   ANR Playback does not function when recording are encrypted   VRM Encryption: Old Keys | New Keys   If there is a VRM failure and a new installation has occurred: Video encrypted with the original certificate cannot be replayed unless the “Back Up” key is applied to the new VRM In this example all video using the Certificate from July 2019 would be inaccessible unless the Redundancy Key was utilized:   Nice to know: What is VRM eXport Wizard and how to use it? How to play exported recording files from VRM eXporter Wizard in BVMS Export Player? How to export VRM recordings of cameras & convert them to mp4-file (VRM eXport Wizard 2.0)? How to export VRM recordings of cameras & convert them to mp4-file (VRM eXport Wizard 2.10)?   ... View more

Question:   What is the Glutton MODE in VRM, what are the causes and how does it work?   Answer:   Enhanced glutton protection mode is a new feature in VRM versions e.g. VRM 3.71 and newer.    The prevention of a glutton (German: Vielfraß) defines and prevents a camera or multi-channel encoder from mounting and consuming  a large number of  blocks in a very short time. If a device is placed in glutton mode, VRM performs the following operations: All blocks except the actual mounted and recording block are removed from the camera span list. If a device is in glutton mode, it gets only 6* number of configured cameras blocks per hour. The device is monitored and when block consumption returns to normal, it is removed from Glutton Mode.   Possible messages when a camera is in Glutton mode are as follows:   This device has an abnormal high storage consumption. To protect other recordings, storage allocation is reduced. This may result in recording gaps for this device. Device runs out of storage and might stop recording. This device had an abnormal high storage consumption and is now set back to regular mode.   Glutton Mode possible causes:   BVMS Profiles: Normal-Good-Excellent used on any Current CPP. Corrupts the Camera Configuration, VRM will place camera into Limited span mode (6 spans per hour max). Bad Time Server: If Time Server jumps more than 2 seconds (Forward or Backwards) frequently. Causes Camera to prematurely release blocks and take new ones. Network Issues: Wireless, bad cables, bad switch ports, port 3260 blockage issues, network disconnections, etc.   Glutton prevention feature explained:   Every time a block is mounted by a device, the block and the time of mount operation is saved. The last 15 time differences between mount operations are considered for glutton protection If more than the half time differences between mount operations are less than a threshold of 120 seconds, Glutton protection mode is switched on   ... View more

During the troubleshooting process, the Central Technical Support team often needs to run several different loggers to gain a more complete understanding of the problem.  You can use custom console traces to regroup and run different loggers that are not combined in the default Server Admin list. To create and run custom console traces for Security Center, follow the steps below.   Step-by-step guide   1. In your browser, open and log in to Server Admin. You can access the consoles for Security Center client applications at the following addresses: Server Admin: localhost/Genetec/Overview Security Desk: localhost:6020/Genetec/Overview Config Tool: localhost:6021/Genetec/Overview Genetec™ Mobile: localhost:9001/Genetec/console#/Diagnostic   2. From the Servers list, select your server, and click Actions > Console:   3. Click the Trace logger tab and Click Add ( ) to configure the new trace:   4. In this example, on the client machine where we run the Forensic Search, we created the Trace Logger*: *the Trace Logger name will be provided by the Central Technical Support team give the name and location at the logger search box write Bosch and choose all Bosch loggers. save and start the logger ( )   5. Reproduce the issue you have. Collect the logs. Stop the Trace Logger. IMPORTANT: Unless you stop the trace, it continues to run. If a trace continues running unchecked, it consumes more disk space than needed, making your server's hard drive unusable or causing system failures. Send the logs to the Central Technical Support Team.   Nice to know: How to export logs from Genetec Security Center? ... View more

Question   What is GUID and what is its role for VRM configuration and recording (replacing defective camera)?   Answer    GUID The camera identifiers include the Physical ID (~ MAC address), Camera ID (system designated UUID), and Logical ID (a simplified version of the Camera ID). Camera identifiers are important for performing tasks involving the cameras in a System   The Camera ID is a UUID that the system assigns to each camera, usually in a format that looks similar to 1c32a29a-dec7-418a-ad5d-a154f92393c3 The Logical ID simplifies device identification when integrating with third-party systems and is necessary for environments with input fields that are not capable of entering the full Camera ID due to a limitation in the maximum number of characters.  GUID was a term first used by Microsoft to refer to a specific variant of a similar term, Universally Unique Identifier, or UUID. Since then, the terms have been combined, with the RFC 4122 specification using them synonymously. Different versions of GUIDs follow the RFC 4122 specification. If two devices have the same instance ID, they might generate identical MAC addresses (duplicate MAC address) for them. This can cause conflicts if they are on the same network, leading to packet loss and other problems.    Video Recording Manager (VRM) VRM is a Windows service, which manages recordings (storage distribution, monitoring, replay) of Bosch cameras or 3rd party cameras (using the Video Streaming Gateway). There are 2 types of VRM's: Standalone Once configured, does not change as there are no outside influences. VRM does not manage the recording parameters set in the camera. Managed by a VMS (Video Management System) A Managed VRM acts in a slightly different way as compared to standalone. In the case of Bosch VMS, this VMS is responsible for pushing the configuration to the VRM. Add devices, Remove devices, set retention times in camera's, creates the GUID, etc. The VMS manages the Licensing. E.g. BVMS & Genetec The VMS can influence the recording behavior of the camera. I.e. the camera is not always managing the recording tasks as the VMS can start and stop recording based on it's programming.    Example: An example of a faulty VRM configuration and recording issue could be caused by a camera HW that was replaced with a new camera HW with the same IP, containing a GUID from a different VRM. This will cause recording problems, or the camera may not record at all. This indication can be seen in the Warning message from the VRM logs, similar with the one below: VRM logs Warning;Cannot connect to device xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx because of MAC address mismatch. Please check if you need to reconfigure the system. 2022-04-12 16:24:03.523; deviceId=xxx.xxx.xx.xx\0;Sysinfo;Internal;No Guid set on device xxx.xxx.xx.xx, expected was xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Checking if mac address matches. where xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx is the GUID and xxx.xxx.xx.xx is the camera IP address  In this case, you have to check in the VRM webpage showCameras: which are the cameras that are not recording.    Delete them from BVMS (save, activate) Factory default all the removed cameras Add them to BVMS and reconfigure them   If replacing a defective camera, the camera must be the same IP address as the defective device, and it cannot contain a GUID from a different VRM: ... View more

Question   Can BVMS Op. Client receive live video from Bosch cameras using fixed and pre-configured TCP ports?   Answer   The configured camera TCP port is used from the BVMS Operator Client to the camera. This port is used by the BVMS Operator Client as a destination port. The source port is dynamic and therefore, it cannot be adjusted. To understand TCP video streaming, the client sets up a TCP tunnel to the camera via the configured camera port and then the camera sends the stream to the client via this connection. ... View more