Network Design and Security for the Physical Security Professional. Steve Surfaro Group Manager, Enterprise Projects

Transcription

1 Network Design and Security for the Physical Security Professional Steve Surfaro Group Manager, Enterprise Projects

2 Agenda Terminology / Technologies / Network topologies Structured cabling Reading network diagrams Intrusion detection systems and vulnerabilities The System of Network Application Design Bandwidth calculations, storage calculations Server recording selection

3 Technologies and Transport Technologies Compression IP Multicast Megapixel Progressive Scan 802.3af Transport Structured Cabling Fiber WAN

4 Why IP Video? Lower total cost of ownership for life cycle of the system Lower installation costs Power over Ethernet eliminates the need for localized power supplies Reduced operational overhead Less maintenance Less system downtime

5 Why IP Video? Deployed and expanded much more quickly and easily Compared with installation of point-to to-point infrastructure Live or recorded video viewed anywhere at anytime By one or many individuals Open infrastructure permits integration of video surveillance devices from different manufacturers Integration of related systems: access control, intrusion, fire/safety Higher-end end imaging: Megapixel & Progressive Scan Easier for objects and individuals to be identified in recordings Storage Area Networks are easily scalable/future growth

6 Intraframe Encoding Methods Code a single image on a standalone basis Rely on spatial redundancy alone to achieve compression Easier random access Lower complexity systems for encoding and decoding Interframe MPEG1, 2, 4, H.261, H.263, H.264/AVC (also known as MPEG4 Part 10) Utilizes motion compensation Takes advantage of redundancy between nearby video frames Each encoder differs slightly in the way motion compensation is performed Based on motion vectors that predict frame content Use blocks drawn from one or more nearby frames Compression efficiency superiority

7 Dual Output &MPEG4 Normal monitoring is high fps MPEG4 Send high resolution to NDR Dual Output & MPEG4 MPEG4 Monitoring Recording Identification MPEG4 w/ Audio Observation NETWORK

8 Multicast Transmission(MPEG4) Multicast Transmission(MPEG4) Multicast Group 4Mbps 16Mbps Unicast Multicast MPEG4 : Max. 4 users Push : Max. 8 users Pull : Unlimited * Frame rate drops according to # of clients MPEG4 : Unlimited * Bandwidth is fixed regardless of # of clients

9 Image from conventional 380k pixels

10 Image from 1.3Mega pixels

11 Progressive Scan Imaging a comparison Progressive Scan IP Camera Interlace camera

12 POE and the 802.3af standard 802.3af devices PSE (power sourcing equipment) - Ethernet LAN switches and midspan power injectors PD (powered device). - wireless access points, video cameras, receive power from PSE draw up to 15 watts of power from the network. built-in in safety mechanisms to protect nonpowered devices like PCs, laptops and printers from stray voltage. How PoE works 802.3af PSE s detect PoE-capable devices and puts power on the cable only if there's a compatible device on the other end of the line If the device on the opposite end is not PoE-capable, the port behaves just like a normal LAN switch port

13 The System of Network Application Design Determine what are the critical limiting factor(s) # Users and type Connectivity (available bandwidth) Protocols needed for required infrastructure Storage Method

14 The System of Network Application Design Match the appropriate solution to the requirement (examples) IP Multicast large # users viewing same device Corporate LAN with prioritizing maximizes and prioritizes available bandwidth Layer 3 Switches include key protocols like IP Multicast (needed for some IP Cameras) and IGMP Snooping (needed for GX solution) Direct Attached Storage on board NDR

15 Video System Deployment Strategies Gather information: Determine System and Camera Device Purpose Who will use the system design the user interface layer to match requirements Determine System Design Criteria Cost / Infrastructure / Topology Review by System Management

16 Video Capture Layer (Cameras) Control Layer User Interface Layer

17 Camera Selection Criteria now includes specific decisions for IPV Systems IPV

18 Monitored and Recorded Targets Verification* Verify all Monitoring and Recording Functions using Rotakin or other accepted standard Adjust System as necessary for key areas, adding or moving cameras as required Monitor Detect Not less than 5% Vertical Not less than 10% Vertical Recognition Identification Not less than 50% Vertical Not less than 120% Vertical *courtesy Isle of Man Constabulary; CCTV Systems within Licensed Premises

19 Match Compression and Frame Rate to Connectivity WAN POTS very poor connectivity DSL (ADSL, SDSL) better; synchronous is preferred T1 improvement approx. 1.2Mbps after overhead T3 approx. 44Mbps LAN Connectivity via Fiber Multi Mode (approx. 300MBps Max for 400m) Single Mode (Gigabit, 10G) Gigabit 10G MAN WLANs WiMax

20 Network Design Key rules 1. Computer network and video surveillance network should be separate networks (may be virtually separated) 2. Video V surveillance network should be of higher throughput (capacity) 3. Consider network stability and expandability

21 Network Design Step Figure out maximum bandwidth for each camera (Based on Resolution, Compression and Frame rate) Figure out maximum bandwidth for each client (PC) Planning Network topology Study bandwidth allocation Evaluate network device performance (Capability of transmission packet, function)

22 Figure out maximum bandwidth for each camera 1.Resolution NTSC (WV (WV-NP472,NS324,NW474S) 640x480 WV-NP1000/ x x x x x x x960, 960x720 Only WV-NP x x x240

23 Figure out maximum bandwidth for each camera 2.Compression O riginal Super Fine Fine Compress 1/6 1/8 1/10 1/12 Normal Extem ded MPEG4 Compress Original Fine N orm al Rough 1/6 1/10 1/15 1/15 1/50 1/120 MPEG4 data-stream widely changes according to the movement of the actual surveillance object. (whether the objects are moving more or less)

24 Figure out maximum bandwidth for each camera 3.Frame Rate 30 image / second (30 ips) 15 image / second (15 ips) 1 image / second(1ips) Camera has maximum frame rate at expected resolution and compression.

25 Figure out maximum bandwidth for each camera 1. Calculate Bandwidth for each camera Bandwidth Resolution Frame Rate Compression (Mbps) Color signal 1.5 Bit 8 Example Bandwidth (Mbps) 3.4 Resolution 704x480 Frame Rate 5 Compression 1/6 (Mbps) 3.4 Color signal 1.5 *A bandwidth calculator helps to determine the bandwidth a network video product will use, based on the image size and frame rate. 2. List All Planning camera Bandwidth Bit 8 Camera # Type Resolution Frame Rate (Ips) Compression Data Size (Mbps) Camera #1 WV-NP x /6 4.9 Camera #2 WV-NS32 NS x / Camera #3 WV-NW x /0 2.3 Camera #4 WV-NS x /6 2.6 : : : : : : Camera #12 WV-NS x /6 2.6

26 M M EX EX1/12 1/ M M N 1/10 1/ M M FN FN1/8 1/ M M SF SF1/6 1/6 KB KB ips ips Mbps Mbps Per Camera Per Camera NTSC NTSC Camera WJ-ND300 Client PC M M EX EX1/12 1/ M M N 1/10 1/ M M FN FN1/8 1/ M M SF SF1/6 1/6 KB KB ips ips Mbps Mbps Per Camera Per Camera NTSC NTSC M M EX EX1/12 1/ M M NQ NQ 1/10 1/ M M FN FN1/8 1/ M M SF SF1/6 1/6 KB KB ips ips Mbps Mbps Per Camera Per Camera NTSC NTSC The value will be changed by condition. Figure out maximum bandwidth for each client Resolution 640x240 Resolution 640x240 Bandwidth (Mbps) 10.8 Bandwidth (Mbps) 10.8 Quad 4 Quad 4 Frame rate 12 Frame rate 12 Compression 1/8 Compression 1/8 Example 10.8Mbps

27 Design Example Scenario Facility Office Building Camera 31pcs PC 4 clients

28 Design Example 1.Calculate all camera bandwidth # Location M odel Video M ode Resolution Com pression Fram e rate Bandwidth 1 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2Mbps 2 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2Mbps 3 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2Mbps 4 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2Mbps 5 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2Mbps 6 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2Mbps 7 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2Mbps 8 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2Mbps 9 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2Mbps 10 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 11 2F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 12 2F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 13 2F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 14 2F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 15 2F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 16 2F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 17 2F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 18 2F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 19 2F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 20 2F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 21 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 22 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 23 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 24 3F Indoor W V-NW 474S PUSH 320x240 Fine(1/8) 10 ips 1.2 Mbps 24 1F indoor WV-NS324 PUSH 320x240 Fine(1/8) 15 ips 1.8Mbps 25 2F indoor WV-NS324 PUSH 320x240 Fine(1/8) 15 ips 1.8Mbps 26 3F indoor WV-NS324 PUSH 320x240 Fine(1/8) 15 ips 1.8Mbps 28 2F indoor AXIS 241S PUSH 320x240 1/10 15 ips 2.5Mbps 29 2F indoor AXIS 241S PUSH 320x240 1/10 15 ips 2.5Mbps 30 2F indoor AXIS 241S PUSH 320x240 1/10 15 ips 2.5Mbps 31 2F indoor AXIS 241S PUSH 320x240 1/10 15 ips 2.5Mbps

29 Design Example 2.Network topology

30 Design Example 3.Check Bandwidth allocation map

31 Camera Bandwidth Calculator

32 Recording System Performance Simulator

33 Recording System Storage Calculator

34 Recording System Server Estimator

35 Match Compression and Frame Rate to Connectivity - Sample Project

36 Match Compression and Frame Rate to Connectivity - Sample Project

37 Network Disk Recorder Network Function Camera server Web server FTP server WJ-ND300 Network Function DNS Client DDNS Client SNMP Agent FTP Client DHCP Client SMTP Client NTP Client

38 Network Disk Recorder Network Function SMTP Client * Alarm - ND300 Client Alarm associated image data Server Client Simple Mail Transfer Protocol notification : Send (Notification + Still image data, Error status) Client

39 Network Disk Recorder Network Function SNMP Agent A protocol that enables a management HD300 to configure, monitor, receive trap (alarm) messages from HD Network Manager and WJ- ND300 SNMP Agent Management Information Equipments and Version Vender Up time Contact person Information Device name on Network Location Service MAC address IP address System Log Error log HDD Hour Meter

40 Network Disk Recorder Network Function DHCP Client - D300 DNS Client Dynamic Host Configuration Protocol Request IP address DHCP Server DHCP allows a computer to join an IP-based network without having a pre-configured IP address. DHCP is a protocol that assigns unique IP addresses to devices, then releases and renews these addresses as devices leave and re-join the network. DNS Client Domain Name System - D300 DNS Client panasonic.com DNS Resolver DNS translates Internet domain and host names to IP addresses. DNS automatically converts the names we type in our Web browser address bar to the IP addresses of Web servers hosting those sites. DDNS Client - D300 DDNS Client Update IP address Change DDNS Resolver DDNS is a service that maps Internet domain names to IP addresses. DDNS serves a similar purpose to DNS: Support under DHCP network configuration.

41 Network Disk Recorder Network Function NTP Client NTP Server Network Time Protocol NTP provides the mechanisms to synchronize time in network.

42 NDR Network Function WJ-ND300 simultaneous connection No.1 No.2 No.3 No.4 No.5 Maximum eight (8) network sessions are allowed for simultaneous network connections toward WJ-ND ND300. Up to Four (4) FTP users can be accessed. HTTP HTTP HTTP HTTP HTTP No.6 How to count on WV-AS65 session One (1) AS65 user is counted on two (2) HTTP network users (Live and Playback) and one (1) FTP network user (Download) is counted during download. No.1 FTP No.2 FTP NETWORK No.3 FTP No.4 FTP No.8 HTTP No.7 HTTP HTTP WJ-ND300 User management Maximum simultaneous users WV-AS65 Front panel NW 1 operation Live operation (HTTP) NW 2 NW 3 NW 4 NW 5 NW 5 NW 6 NW7 NW 8 FTP 1 FTP 2 FTP 3 FTP 4 Playback operation (HTTP) Download operation (FTP) During download NW3 is utilized

43 Source Factor Camera Type WV-NP472 WV-NS324 WV-NW474 WV-NP244 WV-NP1004 AXIS NDR Network Performance Video mode PUSH PULL MPEG4 Quality Resolution Compression Live Rate REC RATE Number of Stream Load Can ND300 Guarantee the recording and operation Performance? Client Factor Load Type of Client IE AS65 Number of Client Number of inquired image Operation Combination =63 Billion

44 NDR Network Performance Summary of verified performance at version 1.A3 Purpose of Measurement Number of Camera Data stream from one camera Recording ips Number of Client Maximum data stream and recording ips at maximum camera number 32 3ips 3ips Two (2) 2 QUADs or One (1) Screens Maximum recording ips at practical number of camera connected 16 10ips 5ips Two (2) 2 QUADs or One (1) Screens Maximum number of camera to provide maximum number of recording ips 10 10ips 10ips Two (2) 2 QUADs or One (1) Screens Within above conditions, the recording rate of the WJ-ND300 can be guaranteed, picture drop in the recording is not observed. For more detailed data between 10 to 16 cameras, please see data sheet attached. Tested camera at this moment is the WV-NP472 at VGA ROUGH mode(= 40kB). Connection with the MPEG4 stream from the WV-NP1000 and WV-NP240 series is planned in February version up. The number of the browser for this test is limited to two (2) browser/pc or one (1) WV-AS65. WV-NP472 VGA ROUGH (= 40Kb) Recording ips Number of Client Data stream from camera Two (2) 2 QUADs or One (1) Screens

45 Camera Schedule Documents the Camera Locations and Video Path Helps the Maintenance Team

46 Camera Schedule Part II

47 Camera Schedule Part III Provides Document of Special Feature Requirement and Programming

48 Sample Command Center Sequence of Operations Fire Alarm Condition

49 Sample Command Center Sequence of Ops. Access Card Denied Restricted Area

50 Sample Command Center Rack Estimate and Heat Load Data

51 IP Video Commissioning Specification Commissioning Specification Bandwidth Measurement Scenarios Data Closet Design Camera Schedule Camera Detail Bill of Material Workstation Bill of Material Security Block Diagram

52 IP Video Commissioning Specification