This letter contains latest information about the above mentioned firmware version. 1 of 15

Transcription

1 Frm ST-VS/MKP1 Prduct Management Release Letter Prducts: H.264/H.265 Firmware fr CPP7.3 HD/MP cameras Versin: This letter cntains latest infrmatin abut the abve mentined firmware versin. 1 General This firmware release is a maintenance release based n FW It is an upgrade fr CPP7.3 based cameras nly. Changes since last release FW are marked in blue. 1 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

2 Frm ST-VS/MKP1 Prduct Management Applicable prducts: AUTODOME IP 4000i AUTODOME IP 5000i AUTODOME IP starlight 7000i DINION IP bullet 4000i DINION IP bullet 5000i DINION IP bullet 6000i FLEXIDOME IP 4000i FLEXIDOME IP 5000i MIC IP starlight 7000i MIC IP fusin 9000i Nte: All cameras are prepared t receive a unique Bsch certificate during prductin, assigned and enrlled by Escrypt LRA. These certificates prve that every device is an riginal Bschmanufactured and untampered unit. Escrypt is a Bsch-wned cmpany, prviding a public certificate authrity (CA). Enrllment f the certificates in prductin is asynchrnus t this firmware release. 2 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

3 Frm ST-VS/MKP1 Prduct Management Changes Cipher suites were enhanced by TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256. An issue with simultaneus multicast streams, intrduced with FW 6.43, has been fixed. An issue with ONVIF SetImageSettings, where incrrect settings culd be applied when an unsupprted namespace was used, has been fixed. An issue with ONVIF IVA messages suspended, when mre than ne IVA rule was cnfigured, has been fixed. An issue with VCA calibratin lst after image rtatin has been fixed. An issue with EAP-TLS certificates with CRL extensin, intermittently prhibiting authenticatin, has been fixed. An issue with panramic cameras, where pre-psitins culd nt be set in the web interface when in n-bard dewarping mde, has been fixed. Varius smaller issues have been fixed. 4 System Requirements Web Brwsers: Micrsft Internet Explrer 11 r higher Mzilla Firefx DirectX 11 MPEG-ActiveX 6.13 r newer Cnfiguratin Manager 5.52 r newer 3 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

4 Frm ST-VS/MKP1 Prduct Management Restrictins; Knwn Issues User Interface If UAC is set t default in Windws 7, n snapsht r recrding via LIVEPAGE is pssible. Vide and audi may be asynchrnus during replay via Web page. If a VCA cnfiguratin using a rule engine is switched t a VCA cnfiguratin withut using a rule engine, e.g. MOTION+ r IVA default cnfiguratin, the saved cnfiguratin is invalid. Frensic search with this cnfiguratin may lead t undesired search results. In Firefx, n audi is audible n the Audi Settings page. Opera mini fr mbile devices cannt wrk in Intranets because it gets all pages thrugh an pera prxy in the Internet. If there is n Internet cnnectin n cntent is prvided. When changing GUI language, the brwser cache may have t be deleted and the web brwser be reladed befre the language will be selected crrectly. Ggle Chrme requires a plug-in fr displaying TIFF images t prperly shw the reference image. Fluent decding f buffered.mp4 vide frm camera is strngly dependent n the brwser, Jerky vide may ccur, e.g. with Mzilla Firefx 52.0, which is nt a camera malfunctin. Encding Fr H.264, nly Main Prfile using CABAC is supprted. CAVLC is nt supprted. Frame rates in lw light mde might vary and cause bit rate cntrl t prduce higher bit rates than set as maximum. With GOP structure set t IBP and IBBP the I-frame distance may nt exactly crrespnd with the set value. Fr stream setting Dual ROI the maximum reslutin f stream 2 might be limited regardless f a higher reslutin selected in the encder prfile. Encder quality regins are nt implemented. Security When using certificates fr mutual authenticatin, it must be ensured that the camera uses a slid and trusted time base. In case the time differs t much frm the actual time, a client might be lcked ut. Then, nly a factry default will recver access t the camera. Underscre character ( _ ) and blank space are nt allwed in cmmn name in certificates. Excessive signing, e.g. due t very shrt vide authenticatin signing interval, may have an impact n TLS cnnectin setup. Client authenticatin is nt wrking using Micrsft Edge as the brwser des nt send any certificate fr client authenticatin, s the camera has nthing t authenticate. 4 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

5 Frm ST-VS/MKP1 Prduct Management Netwrk QS values are set accrding t grup Vide/Audi/Cntrl fr UDP packets, but fr TCP packets, nly the QS value fr Vide is inserted. IP addresses /30 which include t are reserved fr internal cmmunicatin and must nt be used as device addresses. Prducts withut internal cmmunicatin ignre this restrictin and allw the use f this range. IVA IVA and flw need at least 12.5 frames per secnd vide input frame rate. If IVA r Flw are cnfigured, minimum frame rate f 12.5 must be set in ALC mde. There is nly ne cnfiguratin fr IVA. When analysis type is changed, e.g. frm IVA t IVA Flw, the frmer cnfiguratin is lst. Due t this, it is nt pssible t change the analysis type in a VCA prfile switch. Due t a limitatin f the script language that is used in the backgrund, the delay timer fr event-triggered VCA starts immediately when the cnfiguratin is set. A trigger event during this perid des nt restart the timer. Once the timer has elapsed, peratin is as desired. On devices with VCA FPGA an utging IPv6 cnnectin fails when device is initiatr, e.g. trying t reslve a time server dmain name, T dark alarm is nt triggered under nrmal cnditins due t the cameras lw-light capabilities. MOTION+ An alarm recrding cnfigured t be triggered by MOTION+ with masks may nt be peratinal after rebt. Saving MOTION+ cnfiguratin withut any changes recvers frm that. Alternatively masks may nt be used with MOTION+. 5 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

6 Frm ST-VS/MKP1 Prduct Management Recrding LUN size fr lcal recrding via Direct iscsi is limited t 2 TB. VRM versin 2.12 r higher is required. In sme cases frmatting errrs n external iscsi drives may ccur, which might need multiple tries t vercme. In rare cases it may happen that the wner f an iscsi LUN is nt displayed crrectly. Recrding is nt affected, just previus wner remains displayed. If a device had primary and secndary recrding running n SD card and is then added t a VRM system, the blcks used fr primary recrding will nt be re-used, reducing the available recrding space fr the ANR recrding. This can be slved by re-frmatting the SD card. SD card recrding perfrmance is highly dependent n the speed (class) and perfrmance f the SD card. With I-frame-nly recrding and audi als enabled fr recrding, audi will be fragmented r nt audible during replay. Please disable audi recrding in case f I-frame-nly recrding. Numbering f the recrded files n the replay page is nt always cntiguus. If snippets acrss blck brders belng tgether, like pre-alarm and alarm recrding, the snippets becme lgically united and nly the lwer file number is presented in the list. SDXC cards are frmatted t FAT32 file system and nt using the exfat file system as being mandatry fr SDXC standard cmpliance but fully recgnized and accessible. The maximum size f 2TB is als supprted with FAT32, nce SD cards f that size might becme available. FAT32 als increases prtability t ther than Windws platfrms. If a lcal media is exchanged, existing frmer recrdings are nly discvered after rebting the device. Physically remving the lcal strage media while recrding causes the device t rebt. Recrding must be stpped befre remval. Changing audi frmat while audi is being recrded may cause unknwn behaviur f the device and must be avided. 5MP and larger JPEG streaming via RTSP is nly pssible with decders supprting the ONVIF extensins. JPEG streaming via RTSP is based n RFC This RFC nly allws fr a maximum JPEG size f 2048 by With ONVIF, the riginal, larger JPEG headers can als be transmitted via RTP header extensins. Unfrtunately, this nly wrks with decders using these extensins, i.e. it des nt wrk with a standard VLC. After mdifying accunt settings, e.g. FTP server address, t get the changes applied either switching psting ff and n r restarting the device is required. The strage system indicatr status must be ignred during frmatting f an SD card. Frcing the camera int an verlad situatin may cause undesired behaviur and in wrst cases even recrding gaps. It shuld always be ensured that the CPU lad is nt cnsistently 6 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

7 Frm ST-VS/MKP1 Prduct Management arund r at its maximum. This can be achieved by adapting encder settings r aviding t many tasks, e.g. client sessins, in parallel. Exprt FTP exprted files which include audi in a frmat ther than AAC must be renamed frm.mp4 t.m4a t allw crrect playback in QuickTime. With JPEG Psting active when device is bting, the first psted JPEG image may be a ncam lg. FTP psting with reslutin 1080p delivers JPEG with size f 1920x1072 pixels due t 16 pixel macrblck bundary f the JPEG encder. If FTP exprt files cntain nly a few frames sme players might nt crrectly replay such a file, r the replay is t quick t recgnize smething. The exprted file is nt crrupt thugh it might seem s. Files exprted using cntinuus FTP backup fr Rec. 2 where stream 2 is set t I-frames nly mde cntain wrng timing infrmatin and play back t fast. FTP exprt file size is always 100 MB if reslutin change ccurred in exprted time span. Getting the file list frm Drpbx may fail if there are t many bjects (files and flders). Limit is apprximately higher than 500 bjects but als dependent n file name length etc. ONVIF cnfrmance When using GetPresets cmmand prepsitin names are nt set fr scene1 t scene6. DIVAR hybrid / netwrk Cameras running FW 6.4 are nly cmpatible with DIVAR netwrk / hybrid FW and higher. With earlier DIVAR netwrk / hybrid firmware versins, the I-frame distance needs t be adapted t 30 r less. 7 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

8 Frm ST-VS/MKP1 Prduct Management Dme cameras Autpan starts utside f defined range if rientatin is set t Inverted. Tilt up limit is treated as lwer tilt limit if rientatin is set t Inverted. In AUTODOMEs, blanked sectr may trigger a t dark alarm. On AUTODOMEs, privacy masking des nt cver the cmplete cnfigured area if privacy mask is placed t clse t the edge f a scene. Mve the target psitin t the center f the scene befre creating a privacy mask. If LIVEPAGE is refreshed during recrding f Tur A/B n AUTODOMEs the buttn Stp display will falsely display Start recrding but still cntinue tur recrding. After a firmware uplad it may happen that the Privacy Masks and settings frm Installer Menu are set t default. Make sure t check if Privacy Masks and Installer Menu settings are still valid after uplading new firmware. Fr ptimal image perfrmance the user is advised nt t turn ff cntrast enhancement during nrmal camera peratin. T imprve Recrded (Guard) tur playback accuracy, Bsch recmmends users recrd turs using the User Interface (UI) instead f using a keybard. In the event that the Recrded (Guard) tur lses psitin accuracy during playback, users shuld re-hme the camera using the Find hme buttn n the Live page. MIC 7000 rientatin can be switched between nrmal and canted. When the user changes rientatin frm nrmal/canted t inverted (r vice versa), MIC 7000 will tilt itself up and ver s that the visr and wiper are n tp. If there is an attached illuminatr this wuld result in the illuminatr hitting the MIC's bdy. T avid this, MIC 7000 will nt allw an rientatin change while the illuminatr is attached. A warning message with Yes/N selectin will be displayed when the user clicks the rientatin radi buttn and the MIC has an illuminatr. On AUTODOME 7000 and MIC 7000 HDR can be selected in the prepsitin mapping but has n effect as it is nt supprted in these mdels. NTCIP requires t have the SNMP prt enabled t becme functinal. As the SNMP prt, amngst thers, has been clsed by default if nt needed due t security imprvements, it must be re-enabled t allw NTCIP t wrk. Scene/VCA prfile may nt be crrectly restred, causing the Sketch buttn t be disabled. 8 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

9 Frm ST-VS/MKP1 Prduct Management Miscellaneus After firmware uplad while daylight saving time checkbx is activated the time zne must be adjusted. After rebt, the system time re-synchrnisatin may be delayed up t 9 secnds fr SNTP respectively up t 14 secnds fr time server prtcl. AAC audi timestamps fr UDP live vide streams as well as fr recrding streams are based n 90 khz instead f 16 khz t ensure cmpatibility with Vide SDK. AAC audi timestamps fr TCP live vide streams are based n the standard 16 khz timestamps. Standard players shuld cnnect t live vide with AAC audi using TCP. After changing the selectable camera mde via alarm input the switch back t a previus mde desn't wrk anymre. Firmware uplad stps recrding when it fails r is terminated. After dwngrade cnfiguratin integrity cannt be ensured and settings need t be checked r re-cnfigured. When a cnfiguratin file is laded t an incmpatible camera, e.g. a cnfiguratin file frm a HD camera laded nt a VGA camera, encder settings might becme invalid and need t be re-cnfigured. Uplading a cnfiguratin file frm a different camera platfrm may result in unpredictable behaviur. If it shall be checked if the image is nt frzen, use millisecnds timestamp t verify. Intelligent Defg default is OFF under Lw bitrate scene mde. When cmbining CPU-intensive functins like e.g. encryptin, watermarking, r dual recrding, with high quality and high frame rate encder settings, tuning f encder prfile settings might be required t avid verlad situatins. N time change is allwed during the time when the "hur is repeated". Maintenance lg file creatin and dwnlad requires sme time, thugh there is n prgress indicatin, and needs t be waited fr cmpletin. Millisecnd stamping n 60 fps cameras is refreshed with 30 Hz nly, updating nly every secnd frame. JPEGs with VCA verlay are nt fully synchrnized. Shapes might be slightly ff. Please check the respective release letter f a camera fr further device-specific restrictins. 9 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

10 Frm ST-VS/MKP1 Prduct Management Previus Revisins 6.1 New Features with FW ITS versins f AUTODOME and MIC cameras can be enabled t allw NTCIP prtcl ver serial interface. A pssibility t increase the Pwer-ver-Ethernet (PE) demand signalled via LLDP has been added. This may help t ptimize the pwer management n switches and e.g. als eases t use the cameras in utdr husings with PE-pwered heating systems. IGMP versin can nw be set t a specific versin. Autmatic detectin is still default. 6.2 Changes with FW After updating t firmware versin 6.43, users will be able t take advantage frm bsted perfrmance and enhanced image quality f AUTODOME IP 5000i and AUTODOME IP 5000i IR: Imprvement n depth f field Overall imprved cntrast Imprved visibility fr fggy scenes After updating t firmware versin 6.43, users will be able t take advantage frm bsted perfrmance and enhanced image quality f AUTODOME IP 4000i: Overall imprved cntrast Imprved visibility fr fggy scenes Imprvements n Multipathing supprt fr strage devices. Varius smaller issues have been fixed. Nte: Due t imprved image tuning in this firmware versin, the behavir f varius image enhancement sliders can be different than in lder FW releases. Therefre it is recmmended t perfrm a Restre Mde Defaults after the firmware update is finished in rder t get the best perfrmance. This buttn can be fund under: Cnfiguratin -> Camera -> Scene Mde 10 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

11 Frm ST-VS/MKP1 Prduct Management Changes with FW Strnger user name and passwrd plicy is enfrced. The fllwing rules apply: User names must be at least five (5) characters lng. User name and passwrd must nt be identical. A passwrd must cnsist f minimum eight (8) characters. A passwrd must cntain bth upper-case and lwer-case letters. A passwrd must include ne r mre numerical digits. A passwrd must include at least ne f these special characters:!? " # $ % ( ) { } [ ] * + - =., ; ^ _ ~ \ Other special characters (like : < > ' & etc.) are nt supprted. Multicast discvery prt is nw cnfigurable via brwser interface. The base frame rate default fr DINION IP bullet 6000i has been changed t 60 fps. An issue where spradically n vide was shwn after pwer cycle has been fixed. An issue where Autmatic Netwrk Replenishment ANR failed when SD card is brken has been fixed. Imprved behaviural respnse n denial f service attacks. Varius ONVIF cmmunicatin issues have been fixed. Varius smaller issues have been fixed. 6.4 Changes with FW Varius smaller issues have been fixed. 11 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

12 Frm ST-VS/MKP1 Prduct Management Features with FW Encding Supprt f H.265 cmpressin A camera can be cnfigured t use either H.265 r H.264. As H.265 requires mre CPU perfrmance, there might be limitatins t maximum frame rate under certain cnditins. Nte: H.265 requires apprx. 4 times the perfrmance fr decding cmpared t H.264. Installed wrkstatins, decders and sftware might lack the perfrmance t fluently decde H.265 streams. Intelligent Streaming Intelligent Streaming is a cmbinatin f features and functins t ptimize bitrate cnsumptin f recrded vide. It benefits frm imprved nise reductin in still areas f the image, an average nise level cmmunicated t the encder, larger GOP size, strng use f predictin in case f B slices, and dynamic tuning f quantizatin parameters (QP) in the encder. The strength f the bitrate ptimizatin can be set via 5 levels. Savings can be up t 90% using H.265 cmpressin but are strngly scene-dependent. Intelligent Streaming is enabled by default in medium setting. Imaging Supprt f 120 db high dynamic range fr 5000 camera series has been added. Imprved nise filtering in still scenes. VCA Fr details n VCA 6.40 please refer t the separate release ntes f Essential Vide Analytics r Intelligent Vide Analytics. ONVIF ONVIF manual iris and fcus cntrls added. Feature cverage f the ONVIF metadata stream has been extended t include e.g. bject classes, bject shape plygns, faces, flame and smke detectin inf. Prfile G supprt Recrding start and cntrl has been added. Recrding search and replay functinality has been added. Tested with ONVIF Device Test Tl SR2 rev f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

13 Frm ST-VS/MKP1 Prduct Management Security Passwrd enfrcement New cameras with this firmware installed will nly becme perable after the passwrd fr the administratin level (user service ) has been assigned. Other users user and live will nly becme accessible after the administratr assigned passwrds t them. Cameras which are updated t this firmware frm a versin lwer than 6.40 will nt change their behaviur and remain at their frmer prtectin level unless reset t factry defaults. Signed firmware file enfrcement Only Bsch-signed firmware will be accepted by the camera withut cmprmises. Data encryptin n iscsi strages The paylad n an iscsi drive is encrypted using a symmetric XTS encryptin scheme (blck encryptin). The camera uses a number f public keys t asymmetrically encrypt the XTS key fr multiple receivers. These public keys are maintained in the certificate stre via certificates. Usage can be defined as fr recrding1 and/r recrding2. Paylad encryptin is pssible n SD cards as well as n external iscsi strage. A client that shall be allwed t replay this ftage must have its cert/key registered and activated. The Vide Recrding Manager (VRM) may als be a receiver t decrypt the paylad data fr replay. SRTP paylad encryptin fr live and replay SRTP prvides paylad encryptin f UDP streams via TLS, similar t what HTTPS des by using TLS fr TCP streams. Als encrypted multicast cnnectins are pssible. SNMPv3 supprt New alternative SNMP supprt prvides encryptin and authenticatin. This new service will prvide pure MIB-II access. Legacy functins, like NTCIP supprt r mapping f dedicated RCP cmmands t SNMP Enterprise MIB ndes, are nly prvided with existing SNMPv1 implementatin. Certificate revcatin list (CRL) supprt T imprve usability and prvide a mre cmpact verview, the web user interface fr the certificate stre has been updated. It nw allws direct tagging f certificates fr usages. The frmer split int tw areas (Files and Usage) is remved. 13 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

14 Frm ST-VS/MKP1 Prduct Management Strnger encryptin and passwrd prtectin fr cnfiguratin file The cnfiguratin file is encrypted and passwrd-prtected befre dwnlad. The user as the wner f this cnfiguratin file is prmpted fr the passwrd. The passwrd is required when the cnfiguratin file is upladed t a camera. The cnfiguratin file is encrypted using standard mechanisms but nt intended t be pened r mdified by the user, thus the encryptin key itself is kept internal and nt expsed. Strnger encryptin fr maintenance lg file The maintenance lg file as being used in tech supprt cases is encrypted with a Bsch public key. Only tech supprt staff is authrized t decrypt and pen the file. The minimum TLS versin can be defined, e.g. t avid vulnerabilities frm TLS 1.0 and 1.1. The Telnet cnsle has been cmpletely remved and is substituted by a new lgging facility prviding: A mre structured utput including timestamp, severity and mdule surces Search and filtering fr specific events via web user interface Direct utput t a syslg server Cnfiguratin t prduce similar debug printuts fr tech supprt as previusly Cnslidatin f running services, visualized n new page Netwrk Services. Only thse services (HTTP, HTTPS, RTSP, RCP, iscsi, NTP, discvery, ONVIF discvery) are running which are required fr activated functinality. All ther services (FTP, SNMP, UPnP, GB/T 28181) and their respective prts are deactivated. The passwrd unlck functinality (supprt recvery ptin) can be disabled. CHAVE cameras Multiple trusted issuers are nw allwed fr client certificate authenticatin. An ptin t nt wipe the SXI certificate when a factry default is issued has been added. Installatin Cde has been enhanced with a blck fr crypt-cprcessr versin indicatrs. The Installatin Cde thus has a length f 48 digits instead f nly 44 digits. 14 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

15 Frm ST-VS/MKP1 Prduct Management Miscellaneus SMTP prt is cnfigurable via web interface. Multipathing supprt fr strage devices. User name frm certificate fr EAP-TLS is used as EAP identity, if prvided. Dynamically clred privacy masks, depending n surrunding vide added. This can be used t nt distract the peratr due t intense clr, e.g. white privacy mask in night scene. Cameras can cnnect t the CBS Remte Prtal installer service. New illuminatrs fr MIC 7000 are supprted. Large OSD fnt can be selected, rughly dubling the size f the fnts used fr stamping. Intelligent Aut Expsure (IAE) has been extended t cameras withut FPGA. An event playback buttn has been added t the Live page t allw a quick playback f the last event in case there was an incident and the camera was cnnected remtely t check what happened instead f checking live and then g t the playback page. Default device date is set t firmware build time in case f invalid RTC time t avid lck-ut in case f certificate-based authenticatin. Drpbx API has been updated. The API used befre was ging bslete n June 28th, Imprved certificate parser t supprt mre attributes used e.g. by varius mail prviders. A banner mde fr stampings has been intrduced, allwing large scale stamping n tp r bttm f image. The firmware basis is equivalent t the platfrms CPP4, CPP6 and CPP7 and inherits all the features that exist upn them. The Previus Revisins sectin thus mainly lists the features that are cmmnly intrduced with the FW 6.40 fr all fur platfrms in additin t the unique features intrduced with the platfrm CPP7.3. Fr earlier features please refer t release ntes frm the ther platfrms. 15 f 15 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany