Frm ST-VS/MKP1 Prduct Management 14.05.2018 Release Letter Prducts: H.264 Firmware fr CPP6 UHD/MP cameras Versin: 6.44.0020 This letter cntains latest infrmatin abut the abve mentined firmware versin. 1 General This firmware release is a maintenance release based n FW 6.43.0027. It is an upgrade fr CPP6 based cameras nly. Changes since last release FW 6.43.0027 are marked in blue. Nte: Due t an internal file system being intrduced since firmware 6.1x and architectural changes theref, an upgrade t firmware 6.20 and higher is nly pssible frm firmware 6.1x versins r higher. Cameras with previus firmware versins belw 6.1x first need t upgrade t firmware 6.1x. 1 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 2 Applicable prducts: DINION IP starlight 8000 12MP DINION IP ultra 8000 12MP DINION IP ultra 8000 12MP with C/CS munt telepht lens FLEXIDOME IP panramic 7000 12MP 180 FLEXIDOME IP panramic 7000 12MP 360 FLEXIDOME IP panramic 7000 12MP 180 IVA FLEXIDOME IP panramic 7000 12MP 360 IVA AVIOTEC IP starlight 8000 FLEXIDOME IP panramic 6000 12MP 180 FLEXIDOME IP panramic 6000 12MP 360 FLEXIDOME IP panramic 6000 12MP 180 IVA FLEXIDOME IP panramic 6000 12MP 360 IVA Nte: All CPP6 devices incrprate a Trusted Platfrm Mdule (TPM) with wn firmware. This TPM hardware and firmware have been enhanced ver time t allw fr additinal security features. Due t security reasns, the firmware r functinality f the TPM cannt be altered in the field. Thus, nt all new security features becme available n devices with lder TPM hardware r firmware revisins. Nte: Since firmware versin 6.30 all cameras are prepared t receive a unique Bsch certificate during prductin, assigned and enrlled by Escrypt LRA. These certificates prve that every device is an riginal Bsch-manufactured and untampered unit. Escrypt is a Bsch-wned cmpany, prviding a public certificate authrity (CA). Enrllment f the certificates in prductin is asynchrnus t this firmware release. 2 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 3 Changes Cipher suites were enhanced by TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256. An issue with simultaneus multicast streams, intrduced with FW 6.43, has been fixed. An issue with ONVIF SetImageSettings, where incrrect settings culd be applied when an unsupprted namespace was used, has been fixed. An issue with ONVIF IVA messages suspended, when mre than ne IVA rule was cnfigured, has been fixed. An issue with VCA calibratin lst after image rtatin has been fixed. An issue with EAP-TLS certificates with CRL extensin, intermittently prhibiting authenticatin, has been fixed. An issue with panramic cameras, where pre-psitins culd nt be set in the web interface when in n-bard dewarping mde, has been fixed. Varius smaller issues have been fixed. 4 System Requirements Web Brwsers: Micrsft Internet Explrer 11 r higher Mzilla Firefx DirectX 11 MPEG-ActiveX 6.13 r newer Cnfiguratin Manager 5.52 r newer 3 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 5 Restrictins; Knwn Issues User Interface If UAC is set t default in Windws 7, n snapsht r recrding via LIVE page is pssible. Vide and audi may be asynchrnus during replay via Web page. In rare cases it may happen that n recrdings can be fund n PC with Windws XP SP2 and IE6. Internet Explrer may stay in status cnnecting n replay page. An update f Internet Explrer is recmmended. In Firefx, n audi is audible n the Audi Settings page. Opera mini fr mbile devices cannt wrk in Intranets because it gets all pages thrugh an pera prxy in the Internet. If there is n Internet cnnectin n cntent is prvided. When changing GUI language, the brwser cache may have t be deleted and the web brwser be reladed befre the language will be selected crrectly. Ggle Chrme requires a plug-in fr displaying TIFF images t prperly shw the reference image. IE10 by default des nt allw snapshts r recrding frm the LIVE page n lcal hard disk until ne f the fllwing actins is perfrmed: - uncheck the bx "Enable Prtected Mde" in internet ptins/security - add the device s IP range t "Lcal intranet" zne - add the device s IP address t the trusted sites - start IE as administratr If an intranet site is pened, IE10 autmatically runs in cmpatibility mde. This leads t a misbehaviur that n timeline is shwn n the PLAYBACK page. Therefre the functin "Display intranet sites in Cmpatibility View" must be disabled. Upgrading the firmware t versin 6.10 may require clearing the Web brwser cache t have the new user interface style appear. In dewarped multi came views (like quad and duble panramic), selectin f came can be dne in the scene and ROI menu nly, nt by clicking in the vide Fluent decding f buffered.mp4 vide frm camera is strngly dependent n the brwser, Jerky vide may ccur, e.g. with Mzilla Firefx 52.0, which is nt a camera malfunctin. 4 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 Encding Only H.264 Main Prfile using CABAC is supprted. CAVLC is nt supprted. Frame rates in lw light mde might vary and cause bit rate cntrl t prduce higher bit rates than set as maximum. Aspect ratis 16:9 and 4:3 are nt cmbinable. Aspect rati frm stream 1 will lead. With GOP structure set t IBP and IBBP the I-frame distance may nt exactly crrespnd with the set value. Fr stream setting Dual ROI the maximum reslutin f stream 2 is 432p regardless f a higher reslutin selected in the encder prfile. If bit rate is already reaching maximum level due t image cntent t be encded, encder quality regins with setting bject cannt be imprved fr quality anymre and differences will gradually be reduced. Security When using certificates fr mutual authenticatin, it must be ensured that the camera uses a slid and trusted time base. In case the time differs t much frm the actual time, a client might be lcked ut. Then, nly a factry default will recver access t the camera. Underscre character ( _ ) and blank space are nt allwed in cmmn name in certificates. Excessive signing, e.g. due t very shrt vide authenticatin signing interval, may have an impact n TLS cnnectin setup. Client authenticatin is nt wrking using Micrsft Edge as the brwser des nt send any certificate fr client authenticatin, s the camera has nthing t authenticate. Image Prcessing Fr ptimal image perfrmance the user is advised nt t turn ff cntrast enhancement during nrmal camera peratin. In cases where the camera is cnfigured t d very little nise filtering (far lwer than default settings f the camera), in a lw-light scene the bit rate needed fr encding the unfiltered, lw-nise image is high. If the target and maximum encding bit rate values d nt match this bit rate requirement, blckiness r stuttering images may result. On these ccasins please apply strnger tempral r spatial filtering and/r reduce sharpness. When reslutin 3840x2160 r 3584x2016 is selected, n B frames are supprted and the GOP structure is always IP despite B frames can be cnfigured in the encder prfile. ROI PTZ cmbined with IDNR enabled may blur image when n mtin is present in the scene. When the camera runs in HDR mde, the analg utput menu cannt be used by pressing the lcal menu buttn. In this mde, pressing the menu buttn n the camera will switch n the analg utput, pressing it nce again will switch the analg utput ff. Aspect rati and zm and fcus changes can nly be dne via IP in the FW cnfiguratin. 5 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 IVA IVA and flw need at least 12.5 frames per secnd vide input frame rate. If IVA r Flw are cnfigured, minimum frame rate f 12.5 must be set in ALC mde. There is nly ne cnfiguratin fr IVA. When analysis type is changed, e.g. frm IVA t IVA Flw, the frmer cnfiguratin is lst. Due t this, it is nt pssible t change the analysis type in a VCA prfile switch. If a VCA cnfiguratin using a rule engine is switched t a VCA cnfiguratin withut using a rule engine, e.g. MOTION+ r IVA default cnfiguratin, the saved cnfiguratin is invalid. Frensic search with this cnfiguratin may lead t undesired search results. Due t a limitatin f the script language that is used in the backgrund, the delay timer fr event-triggered VCA starts immediately when the cnfiguratin is set. A trigger event during this perid des nt restart the timer. Once the timer has elapsed, peratin is as desired. On devices with VCA FPGA an utging IPv6 cnnectin fails when device is initiatr, e.g. trying t reslve a time server dmain name, After firmware upgrade t versin 6.10 the minimum bject size seems being reset when editing 'mtin in field' task. As a prpsed wrkarund check minimum bject size and crrect value as applicable. IVA cnfiguratin is lst during upgrade frm FW 5.9x t FW 6.1x. MOTION+ An alarm recrding cnfigured t be triggered by MOTION+ with masks may nt be peratinal after rebt. Saving MOTION+ cnfiguratin withut any changes recvers frm that. Alternatively masks may nt be used with MOTION+. Netwrk QS values are set accrding t grup Vide/Audi/Cntrl fr UDP packets, but fr TCP packets, nly the QS value fr Vide is inserted. IP addresses 172.20.1.0/30 which include 172.20.1.0 t 172.20.1.3 are reserved fr internal cmmunicatin and must nt be used as device addresses. Prducts withut internal cmmunicatin ignre this restrictin and allw the use f this range. Link-lcal addresses frm the Aut-IP range (169.254.1.0/16) must nt be entered manually. Rebt will nt be perfrmed autmatically after uplading a SSL certificate r SSL key; must be dne manually. 6 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 Recrding LUN size fr lcal recrding via Direct iscsi is limited t 2 TB. VRM versin 2.12 r higher is required. In sme cases frmatting errrs n external iscsi drives may ccur, which might need multiple tries t vercme. In rare cases it may happen that the wner f an iscsi LUN is nt displayed crrectly. Recrding is nt affected, just previus wner remains displayed. If a device had primary and secndary recrding running n SD card and is then added t a VRM system, the blcks used fr primary recrding will nt be re-used, reducing the available recrding space fr the ANR recrding. This can be slved by re-frmatting the SD card. Thrughput limit fr simultaneus recrding and lcal replay at 100% playback speed is: maximum ttal recrding bit rate f 7 Mbps fr external iscsi recrding maximum ttal recrding bit rate f 10 Mbps fr SD card recrding, depending n SD card perfrmance SD card recrding perfrmance is highly dependent n the speed (class) and perfrmance f the SD card. With I-frame-nly recrding and audi als enabled fr recrding, audi will be fragmented r nt audible during replay. Please disable audi recrding in case f I-frame-nly recrding. Numbering f the recrded files n the replay page is nt always cntiguus. If snippets acrss blck brders belng tgether, like pre-alarm and alarm recrding, the snippets becme lgically united and nly the lwer file number is presented in the list. SDXC cards are frmatted t FAT32 file system and nt using the exfat file system as being mandatry fr SDXC standard cmpliance but fully recgnized and accessible. The maximum size f 2TB is als supprted with FAT32, nce SD cards f that size might becme available. FAT32 als increases prtability t ther than Windws platfrms. If a lcal media is exchanged, existing frmer recrdings are nly discvered after rebting the device. Physically remving the lcal strage media while recrding causes the device t rebt. Recrding must be stpped befre remval. Changing audi frmat while audi is being recrded may cause unknwn behaviur f the device and must be avided. 5MP and larger JPEG streaming via RTSP is nly pssible with decders supprting the ONVIF extensins. JPEG streaming via RTSP is based n RFC 2435. This RFC nly allws fr a maximum JPEG size f 2048 by 2048. With ONVIF, the riginal, larger JPEG headers can als be transmitted via RTP header extensins. Unfrtunately, this nly wrks with decders using these extensins, i.e. it des nt wrk with a standard VLC. The strage system indicatr status must be ignred during frmatting f an SD card. 7 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 Frcing the camera int an verlad situatin may cause undesired behaviur and in wrst cases even recrding gaps. It shuld always be ensured that the CPU lad is nt cnsistently arund r at its maximum. This can be achieved by adapting encder settings r aviding t many tasks, e.g. client sessins, in parallel. Triggered recrding (backup) tasks in buffered recrding cnfiguratin are nt persistent ver a pwer cycle. Pending backups t central recrding will be lst when a device rebts. When lcal SD-card recrding is active, bth live Stream1 and the recrded stream will use Encder Prfile parameters f Prfile 3. The default prfile 3 parameters may in certain cnditins lead t encding artefacts in the recrded stream and live Stream1. In this case, cnsider the fllwing changes: Lwer the reslutin, lwer the frame rate, lwer the sharpness and/r raise tempral/spatial filtering. Physically remving the lcal strage media while recrding causes the device t rebt. Recrding must be stpped befre remval. Spradically ccurring incrrect time zne inf in recrding packets may lead t gaps displayed in the playback timeline. The vide ftage within the gap cannt be replayed but becmes accessible via exprting the affected perid. This may happen with firmware 6.32 belw built 111. Exprt FTP exprted files which include audi in a frmat ther than AAC must be renamed frm.mp4 t.m4a t allw crrect playback in QuickTime. With JPEG Psting active when device is bting, the first psted JPEG image may be a ncam lg. FTP psting with reslutin 1080p delivers JPEG with size f 1920x1072 pixels due t 16 pixel macrblck bundary f the JPEG encder. If FTP exprt files cntain nly a few frames sme players might nt crrectly replay such a file, r the replay is t quick t recgnize smething. The exprted file is nt crrupt thugh it might seem s. Files exprted using cntinuus FTP backup fr Rec. 2 where stream 2 is set t I-frames nly mde cntain wrng timing infrmatin and play back t fast. After mdifying accunt settings, e.g. FTP server address, t get the changes applied either switching psting ff and n r restarting the device is required. FTP exprt file size is always 100 MB if reslutin change ccurred in exprted time span. Getting the file list frm Drpbx may fail if there are t many bjects (files and flders). Limit is apprximately higher than 500 bjects but als dependent n file name length etc. 8 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 Miscellaneus The camera date/time will be set t default (Year 2000) after pwer lss exceeding the buffer perid. It is imprtant t ensure that the date/time is crrect fr recrding. An incrrect date/time setting culd prevent frm crrect recrding. After firmware uplad while daylight saving time checkbx is activated the time zne must be adjusted. After rebt, the system time re-synchrnisatin may be delayed up t 9 secnds fr SNTP respectively up t 14 secnds fr time server prtcl. A printut was added t telnet when sending an e-mail failed. A mre detailed printut was added fr the three errr cases 'culd nt cnnect t server', 'authenticatin failed' and 'recipient nt accepted'. AAC audi timestamps fr UDP live vide streams as well as fr recrding streams are based n 90 khz instead f 16 khz t ensure cmpatibility with Vide SDK. AAC audi timestamps fr TCP live vide streams are based n the standard 16 khz timestamps. Standard players shuld cnnect t live vide with AAC audi using TCP. After changing the selectable camera mde via alarm input the switch back t a previus mde desn't wrk anymre. Firmware uplad stps recrding when it fails r is terminated. After a firmware uplad it may happen that the Privacy Masks and settings frm Installer Menu are set t default. Make sure t check if Privacy Masks and Installer Menu settings are still valid after uplading new firmware. After dwngrade cnfiguratin integrity cannt be ensured and settings need t be checked r re-cnfigured. When a cnfiguratin file is laded t an incmpatible camera, e.g. a cnfiguratin file frm a HD camera laded nt a VGA camera, encder settings might becme invalid and need t be re-cnfigured. Uplading a cnfiguratin file frm a different camera platfrm may result in unpredictable behaviur. If it shall be checked if the image is nt frzen, use millisecnds timestamp t verify. After changing the applicatin variant in the Installer menu, the camera rebts and starts cunting dwn time until it tries t recnnect t the rebted camera, IE desn't always recnnect s it keeps shwing nly the waiting circle (named hurglass in earlier times) In this case resetting the brwser with ctrl+f5 will re-establish cnnectin with the camera.. Please take nte that, whenever yu change the applicatin variant, the camera resets t factry defaults. Analgue utput des nt supprt 90 and 270 rtatin. FLEXIDOME IP panramic 7000 and AVIOTEC cameras nly supprt 180 rtatin. Maintenance lg file creatin and dwnlad requires sme time, thugh there is n prgress indicatin, and needs t be waited fr cmpletin. Millisecnd stamping n 60 fps cameras is refreshed with 30 Hz nly, updating nly every secnd frame. 9 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 JPEGs with VCA verlay are nt fully synchrnized. Shapes might be slightly ff. DIVAR IP 2000 / 5000 Due t its imprved security features, firmware 6.4 is nt fully backward cmpatible with DIVAR IP 2000 and DIVAR IP 5000. Upgrading cameras t FW 6.4 withut t-be-released firmware upgrades fr DIVAR IP 2000 and DIVAR IP 5000 may cause cnfiguratin prblems and pssibly stp recrding. DIVAR hybrid / netwrk Cameras running FW 6.4 are nly cmpatible with DIVAR netwrk / hybrid FW 1.2.1 and higher. With earlier DIVAR netwrk / hybrid firmware versins, the I-frame distance needs t be adapted t 30 r less. Please check the respective release letter f a camera fr further device-specific restrictins. 10 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 6 Previus Revisins 6.1 New Features with FW 6.43.0027 A pssibility t increase the Pwer-ver-Ethernet (PE) demand signalled via LLDP has been added. This may help t ptimize the pwer management n switches and e.g. als eases t use the cameras in utdr husings with PE-pwered heating systems. IGMP versin can nw be set t a specific versin. Autmatic detectin is still default. 6.2 Changes with FW 6.43.0027 Imprvements n Multipathing supprt fr strage devices. Varius smaller issues have been fixed. 11 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 6.3 Changes with FW 6.42.0021 Strnger user name and passwrd plicy is enfrced. The fllwing rules apply: User names must be at least five (5) characters lng. User name and passwrd must nt be identical. A passwrd must cnsist f minimum eight (8) characters. A passwrd must cntain bth upper-case and lwer-case letters. A passwrd must include ne r mre numerical digits. A passwrd must include at least ne f these special characters:!? " # $ % ( ) { } [ ] * + - =., ; ^ _ ~ \ Other special characters (like space @ : < > ' & etc.) are nt supprted. Multicast discvery prt is nw cnfigurable via brwser interface. An issue where spradically n vide was shwn after pwer cycle has been fixed. An issue where Autmatic Netwrk Replenishment ANR failed when SD card is brken has been fixed. Imprved behaviural respnse n denial f service attacks. Varius ONVIF cmmunicatin issues have been fixed. Varius smaller issues have been fixed. 6.4 Changes with FW 6.41.0037 Varius smaller issues have been fixed. 12 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 6.5 New Features with FW 6.40.0240 Intelligent Streaming Intelligent Streaming is a cmbinatin f features and functins t ptimize bitrate cnsumptin f recrded vide. It benefits frm imprved nise reductin in still areas f the image, an average nise level cmmunicated t the encder, larger GOP size, strng use f predictin in case f B slices, and dynamic tuning f quantizatin parameters (QP) in the encder. The strength f the bitrate ptimizatin can be set via 5 levels. Savings can be up t 80% but are strngly scene-dependent. Intelligent Streaming is enabled by default in medium setting. Security Passwrd enfrcement New cameras with this firmware installed will nly becme perable after the passwrd fr the administratin level (user service ) has been assigned. Other users user and live will nly becme accessible after the administratr assigned passwrds t them. Cameras which are updated t this firmware frm a versin lwer than 6.40 will nt change their behaviur and remain at their frmer prtectin level unless reset t factry defaults. Signed firmware file enfrcement Only Bsch-signed firmware will be accepted by the camera withut cmprmises. A dwngrade t a nn-signed firmware is nt pssible anymre. Data encryptin n iscsi strages The paylad n an iscsi drive is encrypted using a symmetric XTS encryptin scheme (blck encryptin). The camera uses a number f public keys t asymmetrically encrypt the XTS key fr multiple receivers. These public keys are maintained in the certificate stre via certificates. Usage can be defined as fr recrding1 and/r recrding2. Paylad encryptin is pssible n SD cards as well as n external iscsi strage. A client that shall be allwed t replay this ftage must have its cert/key registered and activated. The Vide Recrding Manager (VRM) may als be a receiver t decrypt the paylad data fr replay. SRTP paylad encryptin fr live and replay SRTP prvides paylad encryptin f UDP streams via TLS, similar t what HTTPS des by using TLS fr TCP streams. Als encrypted multicast cnnectins are pssible. 13 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 SNMPv3 supprt New alternative SNMP supprt prvides encryptin and authenticatin. This new service will prvide pure MIB-II access. Legacy functins, like NTCIP supprt r mapping f dedicated RCP cmmands t SNMP Enterprise MIB ndes, are nly prvided with existing SNMPv1 implementatin. Certificate revcatin list (CRL) supprt T imprve usability and prvide a mre cmpact verview, the web user interface fr the certificate stre has been updated. It nw allws direct tagging f certificates fr usages. The frmer split int tw areas (Files and Usage) is remved. Strnger encryptin and passwrd prtectin fr cnfiguratin file The cnfiguratin file is encrypted and passwrd-prtected befre dwnlad. The user as the wner f this cnfiguratin file is prmpted fr the passwrd. The passwrd is required when the cnfiguratin file is upladed t a camera. The cnfiguratin file is encrypted using standard mechanisms but nt intended t be pened r mdified by the user, thus the encryptin key itself is kept internal and nt expsed. Strnger encryptin fr maintenance lg file The maintenance lg file as being used in tech supprt cases is encrypted with a Bsch public key. Only tech supprt staff is authrized t decrypt and pen the file. The minimum TLS versin can be defined, e.g. t avid vulnerabilities frm TLS 1.0 and 1.1. The Telnet cnsle has been cmpletely remved and is substituted by a new lgging facility prviding: A mre structured utput including timestamp, severity and mdule surces Search and filtering fr specific events via web user interface Direct utput t a syslg server Cnfiguratin t prduce similar debug printuts fr tech supprt as previusly Cnslidatin f running services, visualized n new page Netwrk Services. Only thse services (HTTP, HTTPS, RTSP, RCP, iscsi, NTP, discvery, ONVIF discvery) are running which are required fr activated functinality. All ther services (FTP, SNMP, UPnP, GB/T 28181) and their respective prts are deactivated. The passwrd unlck functinality (supprt recvery ptin) can be disabled. CHAVE cameras Multiple trusted issuers are nw allwed fr client certificate authenticatin. An ptin t nt wipe the SXI certificate when a factry default is issued has been added. 14 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 Imaging Imprved nise filtering in still scenes. VCA Fr details n VCA 6.40 please refer t the separate release ntes f Essential Vide Analytics r Intelligent Vide Analytics. ONVIF ONVIF manual iris and fcus cntrls added. Feature cverage f the ONVIF metadata stream has been extended t include e.g. bject classes, bject shape plygns, faces, flame and smke detectin inf. Prfile G supprt Recrding start and cntrl has been added. Recrding search and replay functinality has been added. Tested with ONVIF Device Test Tl 16.07 SR2 rev. 617. Miscellaneus SMTP prt is nw cnfigurable via web interface. Multipathing supprt fr strage devices. User name frm certificate fr EAP-TLS is used as EAP identity, if prvided. Dynamically clred privacy masks, depending n surrunding vide added. This can be used t nt distract the peratr due t intense clr, e.g. white privacy mask in night scene. Cameras can cnnect t the CBS Remte Prtal installer service. New illuminatrs fr MIC 7000 are supprted. Intelligent Aut Expsure (IAE) has been extended t cameras withut FPGA. An event playback buttn has been added t the Live page t allw a quick playback f the last event in case there was an incident and the camera was cnnected remtely t check what happened instead f checking live and then g t the playback page. Default device date is set t firmware build time in case f invalid RTC time t avid lck-ut in case f certificate-based authenticatin. Drpbx API has been updated. The API used befre was ging bslete n June 28 th, 2017. 6.6 Changes with FW 6.40.0240 Installatin Cde has been enhanced with a blck fr crypt-cprcessr versin indicatrs. The length f the Installatin Cde has been extended t 48 digits instead f nly 44 digits. Imprved certificate parser t supprt mre attributes used e.g. by varius mail prviders. 15 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 6.7 New Features with FW 6.32.0111 Security Strengthened passwrd plicy: New passwrds must nw be a minimum f 8 characters including special characters. Passwrds are cntinuusly demanded; message cannt be hidden anymre. Fr full supprt f HSTS, an ptin HSTS plus HTTP redirectin has been added. Fallback t TLS 1.0 can be disabled. VCA 6000 series cameras supprt Essential Vide Analytics. 7000 series cameras supprt Intelligent Vide Analytics. JPEG with VCA verlay is nw als available in full screen view. Fr details n VCA 6.30 please refer t the release ntes f Essential Vide Analytics r Intelligent Vide Analytics. Miscellaneus Imprved user interface fr 802.1x settings. Interface shws an EAP-MD5 passwrd field and lists the EAP-TLS certificates with a link t the certificate stre. Security cprcessr (TPM) versin is listed in system verview. Prepsitin widget n Live page can be cmpletely disabled in Web appearance settings. 16 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 6.8 Changes with FW 6.32.0111 Limited frame rate stream capability names are presenting the frame rate as skip value, which is used as divisr in relatin t the base frame rate. A value skip 5 results e.g. in 12 fps if base frame rate is set t 60 fps, r in 5 fps if base frame rate is set t 25 fps. In preparatin fr ONVIF Prfile Q supprt, planned fr next majr firmware release, the default setting fr Autmatic IPv4 address assignment has changed frm On t On plus Link-Lcal, a setting that had already been in the ptin list befre. Thugh this might seem a small change, it may have an impact: The frmer default IP address 192.168.0.1 will virtually becme bslete. Instead, the camera will assign itself an aut-ip address ut f the range 169.254.1.0 t 169.254.254.255 as lng as there is n ther IP address assigned by a DHCP server. (https://en.wikipedia.rg/wiki/link-lcal_address) The advantage is that there are n mre duplicate IP addresses, which is cnsidered prhibited in a netwrk. VCA verlays are drawn after scaling t imprve visibility. An issue has been fixed where the maintenance lg culd nt be dwnladed. An issue has been fixed where the wrng SD card recrding status was displayed. A security leak, which allwed t extract critical data frm the device, has been fixed. A prblem with incrrect time zne inf in recrding packets causing gaps in timeline has been fixed. 6.9 New Features with FW 6.30.0140 Imaging Flexible vide input rientatin handling has been added, including mirrr and rtate (90, 180 and 270 ). This allws crridr view applicatins using full reslutin. [CPP4] Flexible vide input rientatin handling has been added, including mirrring and 180 rtatin. This allws t crrect the view f e.g. panramic cameras if wall-munted headfirst. FLEXIDOME IP panramic 7000 cameras nw allw reduced base frame rate f 12.5 fps t increase streaming capabilities fr the secnd stream. [CPP4] A 1.3 MP applicatin variant is nw selectable fr DINION IP bullet 4000 cameras. [CPP7] Built-in gyr sensr is supprted fr autmatic rientatin detectin. Security The user management has been extended t allw free assignment f usernames. Each user can be assigned a user grup representing live, user, r service level. 17 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 New user management system allws t dynamically create a user fr whm the passwrd can be treated as tken. Als timeut befre user accunt expires is pssible. Tken-based authenticatin implemented t allw user management based n cmmunicatin with Micrsft Active Directry Federatin Services. Secure FTP cnnectin (FTP ver TLS) is implemented. ICMP redirect messages are nt accepted anymre by default. Acceptance can be re-enabled via RCP+ cmmand, if needed. Vide authenticatin is nw als pssible n RTSP streaming. It can be enabled with CGI parameter auth=1 which requests picture inf packets (paylad type 97). Recrding Recrding t iscsi nw supprts LUN size up t 64 TB. A PTZ prepsitin can be stred in a recrding prfile, allwing t recrd nly a regin f interest (ROI) f the full image. ONVIF ONVIF encder prfile settings can be verified via http://<ipaddress>/nvif_encder_prfiles. Manual fcus and iris cntrl is nw supprted via ONVIF cmmand. Tamper detectin alarms are nw frwarded t and included in ONVIF event services. Vide Fire Detectin Autmatic mask detectin has been added t AVIOTEC IP starlight 8000 camera. Relay 1 autmatically fllws vide fire detectin alarm n AVIOTEC IP starlight 8000 camera. VCA Web page layut has been imprved fr better usability and larger vide fr cnfiguratin. Vide analytics nw fully supprt 16 tasks in RCP+ and IVA Task Script Language. Intelligent Tracking is nw als available n cameras 2 and 3 f FLEXIDOME IP panramic 7000 cameras in dewarping mde. JPEGs can nw include VCA verlays in Live page, alarm e-mails and JPEG Psting. Fr JPEG snapsht a new query parameter VCAOverlay can be added t the URL, e.g. http://<ipaddress>/snap.jpg?vcaoverlay=1. Vide can nw be paused during VCA cnfiguratin. Reference image is nw stred as JPEG instead f TIFF fr brader cmpatibility. 18 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 Tamper detectin t bright / t dark was n mre functinal due t t high dynamic n ur cameras. T slve this issue, sliders fr the brightness level have been added fr manual adjustment. Fr details n VCA 6.30 please refer t the release ntes f Essential Vide Analytics r Intelligent Vide Analytics. Miscellaneus HTML5 vide tag is used t display a cntinuus MP4 vide file frm the camera n brwsers nt supprting NPAPI plug-ins (MPEG-ActiveX) like Firefx, Chrme and MS Edge. A Links sectin in the main navigatin (blue tp bar) has been added, leading t a DwnladStre page prviding latest tls, apps and supprtive sftware. Unicde characters are nw als pssible n all cnfiguratin strings. Time server IP address can be accepted t be verwritten by DHCP. Display f prepsitin widget n Live page can be cnfigured. 19 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 6.10 Changes with FW 6.30.0140 Due t the intrductin f image rtatin, the high-reslutin/lw-framerate capability fr stream 2 is cnflicting and thus n mre available n FLEXIDOME IP panramic 7000 cameras. Image t nisy is remved as it never ccurs due t the high dynamic f image prcessing. Dwnscaled images 4CIF/CIF are nw encded as PAL reslutin (704x576 resp. 352x288) when camera is set t 25/50 fps base frame rate. Fixed a ptential recrding issue which culd cause recrding t stp due t insufficient strage errr handling under rare errr cnditins, like e.g. massive irregular netwrk cnnectin interrupts t strage system. Remved nn-supprted mirrring ptin frm FLEXIDOME IP panramic 7000 MP cameras in dewarping mde. 6.11 New Features with FW 6.22.0008 A high-reslutin/limited-frame-rate capability has been intrduced fr stream 2 n varius cameras. 6.12 Changes with FW 6.22.0008 Writing t ONVIF MaxFrameRate is nw pssible t imprve cmpatibility with clients nt using encding interval. Written values are presented in same frmat when read. The micrphne can be permanently blcked, irreversibly fr users, via a glbal license key t allw use f the cameras in cuntries where audi input is legally nt permitted. License type 2: 12-01.63.01-380AAC7E-B71E0D3D-6ADCC50C-6F296E08-F3AFBB71 The permanent blck can nly be lifted by releasing this license via ur service rganizatin. If nt legally required t cmpletely disable the audi functin, audi can simply be switched ff, r the micrphne sensitivity set t zer, always reversible thrugh cnfiguratin. The glbal license type 1 as being presented with release ntes f FW 6.00.0079 is nt functinal n CPP6 platfrm devices. 20 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 6.13 New Features with FW 6.21.0008 DINION IP panramic 7000 has been enhanced with a high-reslutin/lw-frame-rate mde fr stream 2, prviding 2640x2640 pixels at 5 frames per secnd while the first stream prvides the same reslutin at full frame rate. 6.14 Changes with FW 6.21.0008 An issue with fragmented EAP-TLS transfer has been fixed, allwing supprt fr Micrsft Windws NPS and RADIUS. An issue with ONVIF Analytics Service has been fixed. GUI translatins and sme embedded help files have been updated. Wrng wrding n time prtcl settings has been fixed. Nte: T avid a ptential timing issue with lder btlader firmware that, in cmbinatin with the actual FW 6.21 lad pattern, may very rarely lead t a camera rebt, this firmware release includes an updated btlader that is applied if an utdated btlader is being detected during firmware upgrade, pening a shrt windw f apprximately ne secnd f vulnerability against pwer lss. Be especially careful that the camera des nt lse pwer during firmware upgrade. 21 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 6.15 New Features with 6.20.0089 Cameras P-iris cntrl fr DINION IP 8000 cameras supprted. Supprt fr Vide Fire Detectin camera. Security Supprt f TLS 1.2 with updated cypher suites including AES 256 encryptin. Device access security has been imprved by: Implementatin f signed time synchrnizatin Signature-prtected passwrd unlck prcedure Telnet ver HTML5 web sckets in brwser, using secure TLS cnnectin Thrttling f wrng passwrd entries Urging user twards setting a device passwrd, strength meter prvided Firmware, which is signed with a private certificate, is authenticated befre transfer t Flash t ensure a secure firmware uplad. Certificate handling has been enhanced by: Aut-generatin f self-signed certificates fr SSL User-defined creatin f self-signed certificates Pssible uplad f certificates with encrypted private keys Imprved recrded vide authenticatin withut PKI required Strage and retrieval f certificate in recrding fr verifying signed vide Web GUI security has been imprved t prevent Crss-Site-Scripting in Brwser. Use f secure cnnectins can be advertised via supprt f HSTS. 6.16 Changes with 6.20.0089 56-bit encryptin disabled fr secure cnnectins t increase minimum security level. Telnet service (system cnsle) is nw disabled by default. 22 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 6.17 New Features with 6.11.0019 Imaging Enhancements On FLEXIDOME IP panramic 7000 cameras user can chse via applicatin variant in installer menu between edge dewarping inside the camera r client-side dewarping n an external platfrm. On-bard dewarping n FLEXIDOME IP panramic 7000 cameras with realizatin f virtual cameras, prviding different types f dewarped scene representatins: eptz, Panramic, Duble Panramic, Quad, and Crridr ONVIF Cnfrmance was tested using recent ONVIF test tl 14.12. 6.18 Changes with 6.11.0019 Adding small imprvements and errr crrectins. Replay nt wrking in BVC and BVMS clients fr negative time znes has been fixed. 23 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 6.19 New Features with 6.10.0129 Graphical User Interface Turs re-arranged nt single page and scheduler fr preset tur and alarm rules added fr mving cameras. Encder quality regins can be cnfigured n mving cameras preset psitins with up t 8 regins. Vide exprt frmat can be preselected frm Bsch frmat including metadata and generic MP4 frmat n LIVE page. Imaging Enhancements Digital Zm mde added t lens settings page. Setting migratin keeps all the previus imaging settings after camera upgraded t new firmware. Please nte: This is nly applicable after firmware 6.10. Security Enhancements Certificate Stre fr management and assignment f client and server side certificates. Preparatin fr Public Key Infrastructure (PKI), enabled via special license, has been added. 56-Bit DES cipher suite is disabled fr TLS cnnectin. IVA Enhancements Object classificatin f bject types upright persn, bike, car, truck replaces head detectin. Imprved rbustness t mving backgrund (water, branches), shaking, bad weather, fast illuminatin changes, lw-light cnditins, mutual bject cclusins and t detectin f idle / remved bjects. Scene cnditins are autmatically determined. Gelcatin allws setting a camera s glbal crdinates. The psitin f the tracked bjects in the respective crdinate system is added t metadata. Camera viewers can shw the tracked bjects n a map. Usability imprvements allw fr easier calibratin and easier drawing f elements and masks, including supprt f plygns. MOTION+ cnfiguratin has been rewrked. Eight MOTION+ alarm fields with up t 16 ndes can nw be set. Areas can be remved frm prcessing via VCA masks, which will then suppress metadata generatin in these areas. Nte: Fr details and cmplete verview refer t release ntes f IVA 6.10. 24 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 ONVIF Enhancements IVA events can be received via ONVIF messages. Overlay metadata can be received in ONVIF XML frmat. AUX cmmands can be sent via ONVIF messages. Cnfrmance was tested using recent ONVIF test tl 14.12. Miscellaneus Missing time znes added fr Caracas, Newfundland, Kathmandu, Yangn, Sama and Kiritimati Island. Internal strage can be disabled and hidden via special license fr certain LATAM cuntries. This license can nly be cleared via technical service and supprt. An additinal area in the flash memry, hlding a file system t stre specific files r data, has been implemented. This area can hld such like the enhanced Chinese character table r the FPGA image fr IVA cameras running in 5:4 setup, certificates r cnfiguratin data. With FW 6.10 necessary files can be installed by uplading a supplementary firmware file. Fr successive firmware versins the sectins will be recmbined. A custmer lg up t 128x128 pixels with a depth f 256 clrs can be upladed as BMP file t be displayed in the camera name blck. Optins fr placement are left, right r lg nly. 6.20 Changes with 6.10.0129 IPv6 peratinal imprvements, e.g. netmask extended t 64 bit. Reference image is deleted when device is set t factry default. Larger fnt used fr display stamping creates better visibility n large reslutin. Fix fr recrding status while pre-alarm recrding in RAM. 25 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 6.21 Changes with 6.01.0008 Varius small bug fixes and imprvements. ONVIF cnfrmance was tested using recent ONVIF test tl 14.12SR1. 6.22 Features with 6.00.0079 Image Prcessing Supprt f FLEXIDOME IP panramic 7000 12MP 360 and 180 cameras. New Web brwser user interface A new style and new clrs are being intrduced, accrding t the latest Bsch User Interface Style Guide fr Sftware User Interfaces. Tgether with usability imprvements this prvides a cmpletely new and imprved user experience. Easier navigatin is pssible due t the main tpics in the blue bar in the header f the Web pages as well as icn-supprted navigatin thrugh the cnfiguratin pages. Live and replay pages have been enhanced with mre intuitive cntrls and a new timeline which is easier t handle and better recgnizable. Live vide preview is shwn n mst cnfiguratin pages whenever sufficient space available. Privacy masks, encder quality regins and IVA fields can be drawn as plygns instead f rectangles, all with the same cntrls. N Java applets are used n the Web pages anymre. IVA Object classificatin added with the classes "upright persn", "bike", "car", "truck". Munting psitin and angle f panramic cameras can be added t aid calibratin fr dewarping in the client sftware. Gelcatin parameters can be added which are passed int metadata. This allws management systems t directly psitin the camera, r bjects tracked by this camera int a map. 26 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 Recrding Autmated Netwrk Replenishment (ANR) 2.0 has been enhanced t prvide mre rbustness against SD card failures, including the pssibility t add alternative strages. ANR can be cnfigured thrugh the Web interface with a single click. In ANR mde, SD card fill level is shwn n recrding status page. SD cards are autmatically detected, prepared fr use, and recrding started withut cnfiguratin required. SD card is added t managed strage media even if nt inserted. A strage system indicatr icn has been added t the Web page s title, prviding a quick indicatin abut the health status f SD card recrding by green, yellw, r red clr. An alarm is created if recrding stps, usable in Alarm Task Scripting. Netwrk Aut-IP assignment fr IPv4 (aka Link lcal, APIPA) has been added as an alternative setting t pure DHCP. In this mde, if n DHCP server is respnding after 10 secnds, a link-lcal address will be chsen. IPv6 stateless aut-cnfiguratin has been enabled t allw IPv6 rutability. The Aut-IPv6 address is displayed in Web brwser menu belw the manual IPv6 address, but is nt cnfigurable. 802.1x has been enhanced by EAP/TLS using specific certificate. Certificates fr client and server side can be upladed t be used fr authenticatin. After a netwrk link is re-established EAPOL cmmunicatin is initiated t restart 802.1x authenticatin even if the switch des nt initiate this. Secure SMTP ver Transprt Layer Security (TLS/SSL) is supprted accrding t RFC-3207. Cnnectin is established using plain text n prt 25; then TLS is negtiated with StartTLS cmmand. ONVIF cnfrmance A timeut range fr cntinuus mve has been added. ONVIF GetDigitalInputs is nw implemented. CONF_ONVIF_STREAM_URI_EX allws string a stream URI extensin that is appended t the ONVIF stream URI. ONVIF can be switched ff, advantageus in installatins that have native RCP integratin t avid accidental access thrugh ONVIF clients. ONVIF remains enabled by default, f curse. 27 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany
Frm ST-VS/MKP1 Prduct Management 14.05.2018 Miscellaneus Platfrm type (CPP) is nw displayed in System Overview page. The micrphne can be permanently blcked via a glbal license key t allw use f the cameras in cuntries where audi input is legally nt permitted. 02-01.63.01-1E034A4F-B9A37665-B468CBAD-D8945403-6891D511 The permanent blck can be lifted by releasing this license via ur supprt rganizatin. Filename definitin in ATSL has been enhanced. Date elements can nw be maintained separately. 28 f 28 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany