Startup Idea - Remote Recorder Access - Is There A Market For This?

Dan -

There *is* a market for this (IMO). You're solving a fairly common problem in a practical manner.

In the early 2000's another company patented this basic idea for a similar use case. I think that company is essentially dead, but just in case, I'm not going to mention their name here to make sure a Google alert doesn't wake up some patent troll that bought the IP/patent. I'll send the info to John to send to you.

The biggest headache you'll face is that now you are essentially an ISP of sorts for every one of your customers. Any issues they have, they'll want to call you up and tell you "I can't see my cameras, your service is down", even when a hurricane has leveled their building... So, make sure you hire plenty of support people :)

A practical approach would be to sell this as a convienience+security offering with an RMR kickback to the dealer. At least in the beginning you probably want it to be a no-brainer purchase option, so something like $25/mo (USD) with a $5 kickback to the dealer should work. You'll need some language in your contract about bandwidth usage I think, because if people leave a live view of their cameras up 24/7, all that data is streaming through whereever your VPN is hosted and it will start to add up quick.

Why not just sell them a router/firewall with the ability to do VLANS? Just sell them a Sonicwall and a managed switch and call it a day. I don't get why people try to get too fancy when dealing with simple issues. You can also charge them for the install/config of the Sonicwall and switch.

If a small biz doesn't want you to TOUCH their LAN period, why would they trust you at all?

My biggest concern with this is that IT from a customer does not have control over this firewall. After the Target problem, many should be concerned that Logmein is a security vulnerability for customers, and many allow this that are not knowledgeable to the fact that you have the keys to their network (you have access to NVR, which can change router settings, which does not show audit trail to customer on their network). Most of our IT fluent customers require VPN access (they setup) and frown on logmein. The reason is that this gives them logs and audit trails for any vendor that accesses an internal network. They must have full control and monitoring of "doors" (routers, firewalls) that interact with their systems. If you do have a small business with the Linksys router protecting their network, Logmein may sound great to them for remote support, but make sure you have them sign something stating what is in place and what you can do, with the process you will follow to alert them that you are entering their network.

Other better method is to upsell a Sonicwall TZ100/200, put it outside of their business network and before the public connection, and then put the DVR/NVR in this zone. Portforward client and web access for mobile devices, and allow all out and none inbound. With business ISP services from the provider (usually pool of a couple of public addresses and a gateway address), instead of NAT, can just assign IP public address to their WAN port. Firewall your NVR to another public address assigned. Now you can Logmein at will with no risk. Customer can access NVR easily from their outbound rules.

I saw the whole point of this was to limit access to the customer network from the remote access to the box ( rules to only allow access to gateway) but I assume allow customer to the box. This whole thing is based on also gaining remote desktop or ultravnc or logmein to box? DMZ is a horrible idea, where isolated port forwarding is preferred. (with trusted root certificate for secured web access). Many times you will not have credentials to router and do not want liability for setting anyway. Also the day and age of all windows computers in you line of boxes is coming to an end. (hikvision 64 channel our cost 2000 bucks) so single port access to administration functions of cameras and boxes may be all you need. I am building some microcomputers to put within customers networks for VPN or logmein because of appliance box applications. (see Foxconn). Not sure of last question and meaning of untrusted side of firewall.

Hi, Dan. I do something much like this - using a router to isolate NVR network from client's side of network, at least.

Most of my customers are small enterprises, or remote facilities with minimal LAN infrastructure. Usually, just a local WAN router/modem and maybe a switch, and a few cable 'homeruns' to local appliances.

Almost every surveillance network I deploy is 'insulated' with a gateway router - including cameras (which, if IP, are just another computer host, with similar security risks). I run dedicated Cat5/6 cable for these networks, and almost never use/resuse any local LAN - I trust it less than they trust me.

I use a very powerful but inexpensive router as the gateway, as you describe. The NVR and all cameras are NAT'ed behind it. I use 'typical' firewall rules to help protect the router from attack, tarpitting what falls through. To 'slow down' potential hacking via administrative login (either local or remote), I use double port knocking rules and, of course, a strong password.

If the customer is unsophisticated, I'll get on thier local WAN router/modem (usually a common brand, with default user names and passwords still intact!), and set appropriate port forwarding to my gateway router. I used to 'zone' traffic from the private surveillance network, but realized that the WAN router itself was a far greater security risk to the local LAN than any attack from 'within' the private surveillance network, via a 'hack' of the remote access to either my gateway router or the NVR host itself. The principal exception, of course, is local, physical access to the NVR host box itself, and what might be done from a keyboard directly.

If they have an IT admin, then he/she puts the port forwarding rules on thier WAN router, and may create firewall rules to limit (zone) all traffic from my gateway router to the WAN. Sometimes we'll use a VPN for another layer of 'insulation,' but not usually.

Some, very anal, IT folks will put a completely separate WAN access point in place, so there is absolutely no interconnection with the surveillance network and the company's private network. Ironclad, but comes with addtional cost.

All customers have a public URL (DynDns) that I provide them, with specifc ports set for access to the NVR VMS service(s) running.

For NVR host remote administration, I used to use LogMeIn, but have recently gone to TeamViewer. I find it quicker and easier for me to use - not sure if either is more 'secure' than the other, Target notwithstanding. Again, strong passwords for TeamViewer connection and NVR host user login. No Windows Remote enabled, of course.

By the way, as you're an IT instructor, you know all the potential benefits of having a fully-featured router on your 'private' surveillance network, with regards to performance monitoring and tuning, and remote maintenance and administration. I could not be doing this without this type of architecture. Way too many truck rolls and attempts to resolve issues with the end customer at the keyboard, over the phone...

I thought everyone did something like this - at least when existing LAN infrastructure is minimal. The VPN would make it stronger, if you're not confident that the remote access method you use, combined with the private surveillance network isolation you employ, are adequate. If you're using the existing LAN, then the VPN would certainly be recommended - especially if PoS or other high-security exposures are present on it.

Sorry about the anonymous post - but I recently got my mail server hacked (by Russians), and don't want anyone trying to figure out where these installations might be in place... now, am I paranoid, or what?