Bosch/Genetec Video Cybersecurity Partnership Examined (CHAVE)

By: Brian Karas, Published on Feb 15, 2017

Surveillance products have been relatively weak when it comes to cyber security. Default passwords, open ports, and weak authentication mechanisms led to a wave of exploits.

Now, Bosch and Genetec are working together to deliver a system that is "resilient against unauthorized access, malware, brute force cracking and other exploit techniques."

The two companies described the solution, which Bosch is marketing as CHAVE (Credentialed High Assurance Video Encryption), in a conversation with IPVM.

In this report we describe how CHAVE differs from other security mechanisms, what it adds in terms of costs, and how installation and day to day use vary from other systems.

CHAVE ****** ********

***** ** ** ***-**-*** security *********** *** ***** systems. ** ******** ******* with ********** ******** / chipsets *** ******** **** encryption, ***** **** ***-****** security ************ *** * VMS **** *** ********* make *** ** ***** components.

*** **** ** ***** is ** ****** *** integrity ** *****, **** *** cameras **** *** **** compromised, *** ** ****** manage *** *** **** access ** **** *** stored *****. ***** ***** *.*. government **** ***-* ***** * ************, ***** Bosch ****** ** ***** manufacturer ** **** ** do.

*********, ***** ** ********* CHAVE-capable *******, *** ******* is ****** ***** ******* to ** ******** ******** Center *******.

User **************

***** ** * ***** system *** ****** ***** cards, **** ******************-****** ****-** *****, ***** **** **** an ********** ****. ***** to *** *** ******** inserting ***** ***** **** in * ****** ******** to *** ****** ** and ******** * ***.

Target *********

*******/**********, ** ******* ********* that **** ********** ** compliance ************ ****** ************* are *** ****** ******. ** is ******** **** **** a ***** ********** *******-****** customer ***** ********* ***** without ******* ************.

CHAVE ********** ********

********* ** *****, *** technology ********** ** ***** are *** ***** ** standards-compliant ********, **** ** *.*** ************ ****** (********* ***** ********). ***** ** *****'* marketing **** *** ******* these ********* ******** **** an ** ******, *** implementing *** ******** *** accessing *** *******.

******* ******* *** ******** to **** ******** ******** components ** ******* *****, it ** *** * feature **** *** ** added ** ******** ******* via ******** ******** ** other *******.

Username/Password No ****

***** **** *********** ***** **************, ***** ********** ********/******** access ** *******, *** the **** ** ****** or ******* *********. *** system ** ******** ** have ****** ** *** internet, ** **** *** devices *** ********* ******* the *********** ********* ** ensure *** ***** *** still *****. ********* ** Bosch, *** ******** ****** requirement ** *** ** issue, **** *** ********-****** government *************, ** *** systems ********* ******* **** internet ****** *** ****** access/administration ********.

Supported *******

***** ***** *** ********* cameras ** ********* ********** CHAVE:

********* ** **** ** fixed **** ******
********* ** ********* **** VR ***** **** ******
****** ** ********* **** MP ***** *** ******
********* ** **** ** panoramic ******
******** ** ******* **** HD PTZ
*** ** ********* **** HD ********** ***
****** ** ****** **** HD ******

Genetec *******

******* **** **** *** aiming ** **** **** support *** ***** ** the **** ******* ** Security ******, ***** ****** be *.*.

********* ***** ******* ** ********* to *******, ****** ******* Bosch *** ******* ***** specify *** **** *** exclusive *********** ** ******** to ****.

Additional ******** *** ************ ************

******* **** ** **** the ******** ************ ***-********* before ********, **** **** is ******* ** ************. *** *********** ******* process **** ******** ****-**** slightly, ********* ** *****, but ****** *** *** more **** * *** extra ****.

**** ********, ************* ************ need ** ** ******** into ******** ****** ****** the ******* *** ** added ** *** *** and **********. ***** ******** of ****** *****, **** as ******** ******* ******** or ******** ******** *** the **** ** ***-***** cameras.

*******, *** ********** **** required ** ******* *** configure *****-******* ******* ****** be *******, *** **** require ***** ** ** through * ********/************* *******.

Training ************

***** **** **** *********** will **** ** ******* additional ******** ****** **** are ********* ** **** and ******* ***** ********. The ******** ** ******** to ** ********* *****, and **** ****** ** a **** *** ******.

Cost ** *****

***** *** ********** ******* costs ** ********* ***** vs * ***-***** ******. While *** ********* ******* do *** **** ***** and ***-***** ********, ******* that * ******** **** not *** **** *** CHAVE *******, *** ******* price *** * ***** camera *** ** ****** than * *********** *******.

*** ******** ******** ************ cost $**-$***, ********* ** the ***** ***** ** the *********** ***** ******, and **** **** ** be ******* ***** * years.

******* **** **** **** not ********* ******* *** Security ****** **** *****, but *** *** ** would ****** ** * different ******* *******, **** an ********** ****.

***** **** **** **** to ** ****** ***** cards, *** **** ****** PCs ******** **** ***** card *******. *******, ** is ****** **** ********* implementing ***** **** ******* be ***** ***** *****, so **** **** *** not ** ********, ** may **** ******* * few *** ** **** smart **** ******* *****.

Compared ** ***** ******** *******

*****'* ******* *************** *** the **** ***-* ***** 3 **********, *** ***********-***** logins **** *** *********** of ********/******** *****. ** ** *** **** ******** ** are ***** ** **** specifically ****** *** **** compliance, ***** ***** ** valuable ** ********* **** need ** **** ***** requirements, ** ** ***** eliminate *** **** ** submit ** *********** ******** for *******/********. *********** *** ability ** ***** **** a ****/**** ***** ***** be ******** ** ********-****** customers, **** ** **** did *** **** ** meet *** ******** ********** requirements.

*******, * ***** ****** would ****** ** ************ more ********* **** *********** options, **** ** ***** a *** *** ******* that ******* ***** ************** and ***** *********, ** it ******** ******** ****** hardware, ************ **** **** to ** ****** ********* and **** ******* ***** 3 *****, **** ********** setup/installation ****.

Outlook *** *****

***** **** ** ****** targeted ** ********** ************, it **** **** *** a ********* *** **** can ** **** **** a ************* *********** ** make ******* **** **********. When/if ***** ***** ******* CHAVE, ** *** ****** some ** ***** ******** methods ** *******-**** ** everyday *******, ****** ****** with ******* ************ (*.*., no *********** *** ***** cards). *****, **** ** unlikely ** ****** ** 2017, ****** ***** * relatively ***** ******* **** only ** *** ********** market.

Comments (19)

Undisclosed #1

02/15/17 02:12pm

This is a fantastic and innovate solution that Bosch have come up with. I am jealous.

John Honovich

IPVM | In reply to Undisclosed #1 | 02/15/17 02:16pm

Well, I can buy 2 of your cameras for the cost of adding just the certificate to Bosch, so you may still have some advantages ;)

Eddie Perry

02/15/17 02:27pm

CHAVE's primary differentiators are the FIPS 140-2 Level 3 compliance, and certificate-based logins with the elimination of username/password login. it is the only approach we are aware of that specifically claims the FIPS compliance, which would be valuable to customers that need to meet these requirements, as it would eliminate the need to submit an alternative approach for testing/approval. Eliminating the ability to login with a user/pass combo could be valuable to security-minded customers, even if they did not need to meet any specific regulatory requirements

Panasonic Has something similar to this they claim FIPS Level-1 or something on the new extreme cameras coming out along with the new WJ-NX400.

Details are still fuzzy on the new Security licenses that the have listed for the Units but I still havent really sat down and looked at the FIPS Documentation on my desk yet anyway so I'll make that decision when i get there.

Brian Karas

IPVM | In reply to Eddie Perry | 02/15/17 02:58pm

FIPS 140-2 has 4 levels of protection, 1 being the most basic, 4 being the most secure.

Panasonic lists FIPS 140-2 Level 1 in their Extreme series release. We covered some more details of the newer Extreme cameras, and also did a test.

The Panasonic cameras also only offer 720p and 1080p fixed options, the Bosch cameras have options for a 1080p PTZ, 5MP box camera, and 12MP panoramic.

Undisclosed

02/15/17 04:45pm

From an end user standpoint, I'd like to see the camera manufacturers provide notification (email or alarm into VMS etc) when the number of failed log-in attempts exceeds a configurable number. This would provide the system administrator visibility of how often a human or bot etc. is attempting to access to the cameras.

Ethan Ace

IPVM | In reply to Undisclosed | 02/15/17 04:52pm

I agree with that sentiment. I appreciate that Dahua, Hanwha, and Hikvision have added auto account lock, but I believe only Hikvision allows emails to be sent or events sent to the client (and I believe that's only compatible with iVMS, but I haven't checked). Locking the account is good, but without notification, far less useful than it could be.

That setup in Hikvision cameras is here:

The bigger issue is how few manufacturers support failed login detection at all. My email tells me the second someone tries to login with a wrong password, but cameras and VMSes, products in the security industry, do not?

John Honovich

IPVM | In reply to Undisclosed | 02/15/17 05:33pm

I'd like to see the camera manufacturers provide notification (email or alarm into VMS etc) when the number of failed log-in attempts exceeds a configurable number.

Related: Axis: 90% Of Hacks Are NOT The Manufacturer's Fault discusses how Axis does not support this.

Jon Dillabaugh

Pro Focus LLC
In reply to Undisclosed | 02/16/17 01:35am

With Hikvision cameras, simply keep the default setting of auto lock on illegal login enabled and let your VMS alert you of the camera being offline. Should be easy with any decent VMS.

Ethan Ace

IPVM | In reply to Jon Dillabaugh | 02/16/17 01:55am

Locking an account on a Hikvision camera doesn't drop the stream necessarily, just the web interface. I just tested this with Exacq and I've seen the same in other VMSes. It could vary depending on the VMS, though.

Second, even if it did reliably does kick the camera offline, that notification will only tell you it's offline. Then you're left investigating why it's offline separately. Actually sending a discrete event would be preferable.

Undisclosed

In reply to Ethan Ace | 02/16/17 04:47pm

I am hoping that camera manufacturers are reading this... As an end user and camera specifier of a relatively large video surveillance system - I will be making purchasing decisions based upon the camera's cyber-security features.. Top among these will be cameras that can notify me either by email or SDK hook into a VMS when failed login attempts occur as a prime differentiator as most camera manufacturers can do a decent job with WDR, picture quality etc. I don't think I am alone on this....

Brian Karas

IPVM | In reply to Undisclosed | 02/16/17 05:08pm

Curious, would you trade cyber-security features for other advancements? On-board analytics, higher resolutions, better compression, enhanced WDR?

Undisclosed

In reply to Brian Karas | 02/16/17 05:33pm

Brian, For us, the features that you listed are nice to haves for the majority of our locations needing surveillance. That being said, I am a big fan of the Smart Codecs for reducing file storage and better performing WDR.

In my opinion, from a corporate network standpoint - having features that provide notification of threat to the security of your video surveillance system is a higher priority (Marai Botnet which you covered extensively etc) .

Putting this all together - I am looking for a 4K dome with built in IR , an excellent wide dynamic range, good low light performance, utilizes a smart codec and includes log-in failure notification - Am I asking for too much :) ??

Brian Karas

IPVM | In reply to Undisclosed | 02/16/17 06:11pm

I don't think you are asking for too much in the sense of wanting a product featureset that is impractical. I think the challenge for manufacturers is that it is often a zero-sum game with engineering resources. Implementing more cyber-security features means something else gets cut or delayed. Maybe that delay is just 1 quarter, maybe it is 1 year, hard to say.

I think more customers need to make it clear the cyber security enhancements might be more important than "camera stuff" like analytics or smart(er) CODECs (assuming of course that the other camera features are on par with industry standards, a company with an old H.264 CODEC might be better off working on that first).

Undisclosed

In reply to Brian Karas | 02/17/17 04:04pm

I agree with what you are saying - all things being equal we will lean towards companies that have robust security features. At this point I feel that notification would add more value than all of the overhead involved in using certificate based authentication etc.

Undisclosed Integrator #3

02/16/17 09:19am

"The system is required to have access to the internet, so that the devices can routinely contact the certificate authority to ensure the certs are still valid. According to Bosch, the internet access requirement is not an issue, even for security-minded government organizations, as the systems typically already have internet access for remote access/administration purposes."

This is where I stopped reading. My opinion is no security systems should be EVER connected to the Internet. Especially not for remote administration purposes.

Another issue I have with this system that you need one card and a login/password combo and you can login to the system. These can be stolen or cloned, so your system is vulnerable again.

If the user is already on the Internet, why can't the user use their smartphone NFC with the builting fingerprint reader, online certification system can be developed for iOS or Android, I know one system like that already.

Michael Archer

In reply to Undisclosed Integrator #3 | 02/16/17 11:53pm

So do you mean NFC to camera? if you installed a camera up a 30foot pole how you doing to touch it with your Android phone!

Also currently NFC on iOS currently at 10.3beta3 as yet does not support NFC flags, rumour maybe iOS10 will.

So how to make a secure IPC for a respectable cost with minimal effort?

1. Camera has a Bluetooth module, and attached to this is a QR code label. removable.

2. Install camera where is needed, requires power PoE or direct.

3. Device on first power on will go into certification / password generation mode.

4. Installer run the appropriate phone App, which will then after a code scan allow a pairing with the device, for only enough time so than certification generate is done from phone (because it will have a better chance at a random generation) making the use wiggle his finger over the screen to be used a part of the certificate generation. (see PuTTy software which is what the do via the mouse)

5. When complete the device then can enable Ethernet communication, close off Bluetooth.

6. Smart App now has a master public / private codes stored, when then can be passed to the software, this could be cloud based.

7. Camera generates it's own password, to stop reverse engineering of the App to discover a weakness.

8.Time/date can be set from phone to device as normally at least most users will have this correct.

7. Note: An installation engineer may not be person doing software side, so that the data now collected. Password and certificate are then delivered to the software side, or sent as data to customer.

8. Many assumptions that software platform is on internet, can allow phone - device (NVR or PC platform) to open a P2P pre-setup so all information about new device is added.

9 Software platform can be accessed by phone App so we don't need know password.

10. installation company could keep backup of device data, not even knowing the data contents.

11. Device will only now respond to communication from the generated certificate.

Linux as used in most IPC devices has all software certificate generation, and password generation available now. a simple 'openssl rand -base64 24' gives you a lovely password nobody would be able to guess.

Undisclosed Integrator #3

In reply to Michael Archer | 02/20/17 03:58pm

No, I meant logging in to the VMS client:

Baudouin Genouville

In reply to Undisclosed Integrator #3 | 03/17/17 04:56am

Another issue I have with this system that you need one card and a login/password combo and you can login to the system. These can be stolen or cloned, so your system is vulnerable again.

Do not worry!

Bosch has already some good fingerprint readers, so if you have the requirement, then Bosch can supply that product as well

=> https://us.boschsecurity.com/en/products/accesscontrolsystems/readersandcards/biometricreaders/biometricreaders_34654

Fabian Muyawa

LONTECH SYSTEMS
IPVMU Certified | 11/30/17 01:10pm

There is no exaggeration in suggestion that CHAVE by Genetec and Bosch is a giant step forward towards improving system hardening. It is also exciting to learn that authentication as been extended to biometric which appears to be more reliable.

I want to believe that the onus lies on the installers and integrators to utilise the systems tools and capabilities to full capacity.

Read this IPVM report for free.

This article is part of IPVM's 6,534 reports, 880 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.