Releaseletter CPP6 FW 6.40.240

Releaseletter CPP6 FW 6.40.240
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
Release Letter
H.264 Firmware for
Products:
CPP6 UHD/MP cameras
Version:
6.40.0240
This letter contains latest information about the above mentioned firmware version.
1 General
This firmware release is a feature release based on FW 6.32.0111.
It is an upgrade for CPP6 based cameras only.
Changes since last release FW 6.32.0111 are marked in blue.
Note:
Due to an internal file system being introduced since firmware 6.1x and architectural changes thereof,
an upgrade to firmware 6.20 and higher is only possible from firmware 6.1x versions or higher.
Cameras with previous firmware versions below 6.1x first need to upgrade to firmware 6.1x.
1 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
2 Applicable products:
•
DINION IP starlight 8000 12MP
•
DINION IP ultra 8000 12MP
•
DINION IP ultra 8000 12MP with C/CS mount telephoto lens
•
FLEXIDOME IP panoramic 7000 12MP 180
•
FLEXIDOME IP panoramic 7000 12MP 360
•
FLEXIDOME IP panoramic 7000 12MP 180 IVA
•
FLEXIDOME IP panoramic 7000 12MP 360 IVA
•
AVIOTEC IP starlight 8000
•
FLEXIDOME IP panoramic 6000 12MP 180
•
FLEXIDOME IP panoramic 6000 12MP 360
•
FLEXIDOME IP panoramic 6000 12MP 180 IVA
•
FLEXIDOME IP panoramic 6000 12MP 360 IVA
Note:
All CPP6 devices incorporate a Trusted Platform Module (TPM) with own firmware.
This TPM hardware and firmware have been enhanced over time to allow for additional
security features.
Due to security reasons, the firmware or functionality of the TPM cannot be altered in the field.
Thus, not all new security features become available on devices with older TPM hardware or
firmware revisions.
Note:
Since firmware version 6.30 all cameras are prepared to receive a unique Bosch certificate
during production, assigned and enrolled by Escrypt LRA. These certificates prove that every
device is an original Bosch-manufactured and untampered unit.
Escrypt is a Bosch-owned company, providing a public certificate authority (CA).
Enrollment of the certificates in production is asynchronous to this firmware release.
2 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
3 New Features
Intelligent Streaming
• Intelligent Streaming is a combination of features and functions to optimize bitrate
consumption of recorded video. It benefits from improved noise reduction in still areas of the
image, an average noise level communicated to the encoder, larger GOP size, strong use of
prediction in case of B slices, and dynamic tuning of quantization parameters (QP) in the
encoder.
•
The strength of the bitrate optimization can be set via 5 levels. Savings can be up to 80% but
are strongly scene-dependent.
•
Intelligent Streaming is enabled by default in medium setting.
Security
• Password enforcement
o
o
o
New cameras with this firmware installed will only become operable after the password
for the administration level (user “service”) has been assigned.
Other users “user” and “live” will only become accessible after the administrator assigned
passwords to them.
Cameras which are updated to this firmware from a version lower than 6.40 will not
change their behaviour and remain at their former protection level unless reset to factory
defaults.
•
Signed firmware file enforcement
Only Bosch-signed firmware will be accepted by the camera without compromises.
A downgrade to a non-signed firmware is not possible anymore.
•
Data encryption on iSCSI storages
o
o
o
o
o
•
The payload on an iSCSI drive is encrypted using a symmetric XTS encryption scheme
(block encryption).
The camera uses a number of public keys to asymmetrically encrypt the XTS key for
multiple receivers. These public keys are maintained in the certificate store via
certificates. Usage can be defined as for „recording1“ and/or „recording2“.
Payload encryption is possible on SD cards as well as on external iSCSI storage.
A client that shall be allowed to replay this footage must have its cert/key registered and
activated.
The Video Recording Manager (VRM) may also be a receiver to decrypt the payload data
for replay.
SRTP payload encryption for live and replay
SRTP provides payload encryption of UDP streams via TLS, similar to what HTTPS does by
using TLS for TCP streams. Also encrypted multicast connections are possible.
3 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
•
Product Management
27.07.2017
SNMPv3 support
o
o
New alternative SNMP support provides encryption and authentication. This new service
will provide pure MIB-II access.
Legacy functions, like NTCIP support or mapping of dedicated RCP commands to SNMP
Enterprise MIB nodes, are only provided with existing SNMPv1 implementation.
•
Certificate revocation list (CRL) support
•
To improve usability and provide a more compact overview, the web user interface for the
certificate store has been updated. It now allows direct tagging of certificates for usages. The
former split into two areas (Files and Usage) is removed.
•
Stronger encryption and password protection for configuration file
o
o
o
o
The configuration file is encrypted and password-protected before download.
The user as the owner of this configuration file is prompted for the password.
The password is required when the configuration file is uploaded to a camera.
The configuration file is encrypted using standard mechanisms but not intended to be
opened or modified by the user, thus the encryption key itself is kept internal and not
exposed.
•
Stronger encryption for maintenance log file
The maintenance log file as being used in tech support cases is encrypted with a Bosch public
key. Only tech support staff is authorized to decrypt and open the file.
•
The minimum TLS version can be defined, e.g. to avoid vulnerabilities from TLS 1.0 and 1.1.
•
The Telnet console has been completely removed and is substituted by a new logging facility
providing:
o
o
o
o
A more structured output including timestamp, severity and module sources
Search and filtering for specific events via web user interface
Direct output to a syslog server
Configuration to produce similar “debug” printouts for tech support as previously
•
Consolidation of running services, visualized on new page “Network Services”.
Only those services (HTTP, HTTPS, RTSP, RCP, iSCSI, NTP, discovery, ONVIF discovery)
are running which are required for activated functionality. All other services (FTP, SNMP,
UPnP, GB/T 28181) and their respective ports are deactivated.
•
The password unlock functionality (support recovery option) can be disabled.
•
CHAVE cameras
o
o
Multiple trusted issuers are now allowed for client certificate authentication.
An option to not wipe the SXI certificate when a factory default is issued has been added.
4 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
Imaging
• Improved noise filtering in still scenes.
VCA
For details on VCA 6.40 please refer to the separate release notes of Essential Video Analytics or
Intelligent Video Analytics.
ONVIF
• ONVIF manual iris and focus controls added.
•
Feature coverage of the ONVIF metadata stream has been extended to include e.g. object
classes, object shape polygons, faces, flame and smoke detection info.
•
Profile G support
o
o
o
Recording start and control has been added.
Recording search and replay functionality has been added.
Tested with ONVIF Device Test Tool 16.07 SR2 rev. 617.
Miscellaneous
• SMTP port is now configurable via web interface.
•
Multipathing support for storage devices.
•
User name from certificate for EAP-TLS is used as EAP identity, if provided.
•
Dynamically colored privacy masks, depending on surrounding video added. This can be used
to not distract the operator due to intense color, e.g. white privacy mask in night scene.
•
Cameras can connect to the CBS Remote Portal installer service.
•
New illuminators for MIC 7000 are supported.
•
Intelligent Auto Exposure (IAE) has been extended to cameras without FPGA.
•
An event playback button has been added to the Live page to allow a quick playback of the
last event in case there was an incident and the camera was connected remotely to check
what happened instead of checking live and then go to the playback page.
•
Default device date is set to firmware build time in case of invalid RTC time to avoid lock-out in
case of certificate-based authentication.
•
Dropbox API has been updated. The API used before was going obsolete on June 28th, 2017.
5 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
4 Changes
•
Installation Code has been enhanced with a block for crypto-coprocessor version indicators.
The length of the Installation Code has been extended to 48 digits instead of only 44 digits.
•
Improved certificate parser to support more attributes used e.g. by various mail providers.
5 System Requirements
•
Web Browsers:
o
Microsoft Internet Explorer 11 or higher
o
Mozilla Firefox
•
DirectX 11
•
MPEG-ActiveX 6.11 or newer
•
Configuration Manager 5.50 or newer
6 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
6 Restrictions; Known Issues
User Interface
•
If UAC is set to default in Windows 7, no snapshot or recording via LIVE page is possible.
•
Video and audio may be asynchronous during replay via Web page.
•
In rare cases it may happen that no recordings can be found on PC with Windows XP SP2
and IE6. Internet Explorer may stay in status ‘connecting on replay page’. An update of
Internet Explorer is recommended.
•
In Firefox, no audio is audible on the Audio Settings page.
•
Opera mini for mobile devices cannot work in Intranets because it gets all pages through an
opera proxy in the Internet. If there is no Internet connection no content is provided.
•
When changing GUI language, the browser cache may have to be deleted and the web
browser be reloaded before the language will be selected correctly.
•
Google Chrome requires a plug-in for displaying TIFF images to properly show the reference
image.
•
IE10 by default does not allow snapshots or recording from the LIVE page on local hard disk
until one of the following actions is performed:
o
- uncheck the box "Enable Protected Mode" in internet options/security
o
- add the device’s IP range to "Local intranet" zone
o
- add the device’s IP address to the trusted sites
o
- start IE as administrator
•
If an intranet site is opened, IE10 automatically runs in compatibility mode.
This leads to a misbehaviour that no timeline is shown on the PLAYBACK page.
Therefore the function "Display intranet sites in Compatibility View" must be disabled.
•
Upgrading the firmware to version 6.10 may require clearing the Web browser cache to have
the new user interface style appear.
•
In dewarped multi cameo views (like quad and double panoramic), selection of cameo can be
done in the scene and ROI menu only, not by clicking in the video
•
Fluent decoding of buffered .mp4 video from camera is strongly dependent on the browser,
Jerky video may occur, e.g. with Mozilla Firefox 52.0, which is not a camera malfunction.
7 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
Encoding
• Only H.264 Main Profile using CABAC is supported. CAVLC is not supported.
•
Frame rates in low light mode might vary and cause bit rate control to produce higher bit rates
than set as maximum.
•
Aspect ratios 16:9 and 4:3 are not combinable. Aspect ratio from stream 1 will lead.
•
With GOP structure set to IBP and IBBP the I-frame distance may not exactly correspond with
the set value.
•
For stream setting “Dual ROI” the maximum resolution of stream 2 is 432p regardless of a
higher resolution selected in the encoder profile.
•
If bit rate is already reaching maximum level due to image content to be encoded, encoder
quality regions with setting “object” cannot be improved for quality anymore and differences
will gradually be reduced.
Security
•
When using certificates for mutual authentication, it must be ensured that the camera uses a
solid and trusted time base. In case the time differs too much from the actual time, a client
might be locked out. Then, only a factory default will recover access to the camera.
•
Underscore character (“_”) is not allowed in common name in certificates.
•
Excessive signing, e.g. due to very short video authentication signing interval, may have an
impact on TLS connection setup.
•
Client authentication is not working using Microsoft Edge as the browser does not send any
certificate for client authentication, so the camera has nothing to authenticate.
Image Processing
•
For optimal image performance the user is advised not to turn off contrast enhancement
during normal camera operation.
•
In cases where the camera is configured to do very little noise filtering (far lower than default
settings of the camera), in a low-light scene the bit rate needed for encoding the unfiltered,
low-noise image is high. If the target and maximum encoding bit rate values do not match this
bit rate requirement, blockiness or stuttering images may result. On these occasions please
apply stronger temporal or spatial filtering and/or reduce sharpness.
•
When resolution 3840x2160 or 3584x2016 is selected, no B frames are supported and the
GOP structure is always IP despite B frames can be configured in the encoder profile.
•
ROI PTZ combined with IDNR enabled may blur image when no motion is present in the
scene.
•
When the camera runs in HDR mode, the analog output menu cannot be used by pressing the
local menu button. In this mode, pressing the menu button on the camera will switch on the
analog output, pressing it once again will switch the analog output off. Aspect ratio and zoom
and focus changes can only be done via IP in the FW configuration.
8 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
IVA
•
IVA and flow need at least 12.5 frames per second video input frame rate. If IVA or Flow are
configured, minimum frame rate of 12.5 must be set in ALC mode.
•
There is only one configuration for IVA. When analysis type is changed, e.g. from IVA to IVA
Flow, the former configuration is lost. Due to this, it is not possible to change the analysis type
in a VCA profile switch.
•
If a VCA configuration using a rule engine is switched to a VCA configuration without using a
rule engine, e.g. MOTION+ or IVA default configuration, the saved configuration is invalid.
Forensic search with this configuration may lead to undesired search results.
•
Due to a limitation of the script language that is used in the background, the delay timer for
event-triggered VCA starts immediately when the configuration is set. A trigger event during
this period does not restart the timer. Once the timer has elapsed, operation is as desired.
•
On devices with VCA FPGA an outgoing IPv6 connection fails when device is initiator, e.g.
trying to resolve a time server domain name,
•
After firmware upgrade to version 6.10 the minimum object size seems being reset when
editing 'motion in field' task. As a proposed workaround check minimum object size and
correct value as applicable.
•
IVA configuration is lost during upgrade from FW 5.9x to FW 6.1x.
MOTION+
•
An alarm recording configured to be triggered by MOTION+ with masks may not be
operational after reboot. Saving MOTION+ configuration without any changes recovers from
that. Alternatively masks may not be used with MOTION+.
Network
•
QoS values are set according to group Video/Audio/Control for UDP packets, but for TCP
packets, only the QoS value for Video is inserted.
•
IP addresses 172.20.1.0/30 which include 172.20.1.0 to 172.20.1.3 are reserved for internal
communication and must not be used as device addresses. Products without internal
communication ignore this restriction and allow the use of this range.
•
Link-local addresses from the Auto-IP range (169.254.1.0/16) must not be entered manually.
•
Reboot will not be performed automatically after uploading a SSL certificate or SSL key; must
be done manually.
9 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
Recording
•
LUN size for local recording via “Direct iSCSI” is limited to 2 TB.
•
VRM version 2.12 or higher is required.
•
In some cases formatting errors on external iSCSI drives may occur, which might need
multiple tries to overcome.
•
In rare cases it may happen that the owner of an iSCSI LUN is not displayed correctly.
Recording is not affected, just previous owner remains displayed.
•
If a device had primary and secondary recording running on SD card and is then added to a
VRM system, the blocks used for primary recording will not be re-used, reducing the available
recording space for the ANR recording. This can be solved by re-formatting the SD card.
•
Throughput limit for simultaneous recording and local replay at 100% playback speed is:
o maximum total recording bit rate of 7 Mbps for external iSCSI recording
o maximum total recording bit rate of 10 Mbps for SD card recording, depending on
SD card performance
•
SD card recording performance is highly dependent on the speed (class) and performance of
the SD card.
•
With I-frame-only recording and audio also enabled for recording, audio will be fragmented or
not audible during replay. Please disable audio recording in case of I-frame-only recording.
•
Numbering of the recorded files on the replay page is not always contiguous.
If snippets across block borders belong together, like pre-alarm and alarm recording, the
snippets become logically united and only the lower file number is presented in the list.
•
SDXC cards are formatted to FAT32 file system and not using the exFAT file system as being
mandatory for SDXC standard compliance but fully recognized and accessible.
The maximum size of 2TB is also supported with FAT32, once SD cards of that size might
become available.
FAT32 also increases portability to other than Windows platforms.
•
If a local media is exchanged, existing former recordings are only discovered after rebooting
the device.
•
Physically removing the local storage media while recording causes the device to reboot.
Recording must be stopped before removal.
•
Changing audio format while audio is being recorded may cause unknown behaviour of the
device and must be avoided.
•
5MP and larger JPEG streaming via RTSP is only possible with decoders supporting the
ONVIF extensions.
JPEG streaming via RTSP is based on RFC 2435. This RFC only allows for a maximum JPEG
size of 2048 by 2048.
With ONVIF, the original, larger JPEG headers can also be transmitted via RTP header
extensions. Unfortunately, this only works with decoders using these extensions, i.e. it does
not work with a standard VLC.
•
The storage system indicator status must be ignored during formatting of an SD card.
10 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
•
Forcing the camera into an overload situation may cause undesired behaviour and in worst
cases even recording gaps. It should always be ensured that the CPU load is not consistently
around or at its maximum. This can be achieved by adapting encoder settings or avoiding too
many tasks, e.g. client sessions, in parallel.
•
Triggered recording (backup) tasks in buffered recording configuration are not persistent over
a power cycle. Pending backups to central recording will be lost when a device reboots.
•
When local SD-card recording is active, both live Stream1 and the recorded stream will use
Encoder Profile parameters of Profile 3. The default profile 3 parameters may in certain
conditions lead to encoding artefacts in the recorded stream and live Stream1. In this case,
consider the following changes: Lower the resolution, lower the frame rate, lower the
sharpness and/or raise temporal/spatial filtering.
•
Physically removing the local storage media while recording causes the device to reboot.
Recording must be stopped before removal.
•
Sporadically occurring incorrect time zone info in recording packets may lead to gaps
displayed in the playback timeline. The video footage within the gap cannot be replayed but
becomes accessible via exporting the affected period. This may happen with firmware 6.32
below built 111.
Export
•
FTP exported files which include audio in a format other than AAC must be renamed from
.mp4 to .m4a to allow correct playback in QuickTime.
•
With JPEG Posting active when device is booting, the first posted JPEG image may be a nocam logo.
•
FTP posting with resolution 1080p delivers JPEG with size of 1920x1072 pixels due to 16
pixel macroblock boundary of the JPEG encoder.
•
If FTP export files contain only a few frames some players might not correctly replay such a
file, or the replay is too quick to recognize something. The exported file is not corrupt though it
might seem so.
•
Files exported using continuous FTP backup for Rec. 2 where stream 2 is set to I-frames only
mode contain wrong timing information and play back too fast.
•
After modifying account settings, e.g. FTP server address, to get the changes applied either
switching posting off and on or restarting the device is required.
•
FTP export file size is always 100 MB if resolution change occurred in exported time span.
•
Getting the file list from Dropbox may fail if there are too many objects (files and folders).
Limit is approximately higher than 500 objects but also dependent on file name length etc.
11 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
Miscellaneous
•
The camera date/time will be set to default (Year 2000) after power loss exceeding the buffer
period. It is important to ensure that the date/time is correct for recording. An incorrect
date/time setting could prevent from correct recording.
•
After firmware upload while daylight saving time checkbox is activated the time zone must be
adjusted.
•
After reboot, the system time re-synchronisation may be delayed up to 9 seconds for SNTP
respectively up to 14 seconds for time server protocol.
•
A printout was added to telnet when sending an e-mail failed.
A more detailed printout was added for the three error cases 'could not connect to server',
'authentication failed' and 'recipient not accepted'.
•
AAC audio timestamps for UDP live video streams as well as for recording streams are based
on 90 kHz instead of 16 kHz to ensure compatibility with Video SDK.
AAC audio timestamps for TCP live video streams are based on the standard 16 kHz
timestamps. Standard players should connect to live video with AAC audio using TCP.
•
After changing the selectable camera mode via alarm input the switch back to a previous
mode doesn't work anymore.
•
Firmware upload stops recording when it fails or is terminated.
•
After a firmware upload it may happen that the Privacy Masks and settings from Installer Menu
are set to default. Make sure to check if Privacy Masks and Installer Menu settings are still
valid after uploading new firmware.
•
After downgrade configuration integrity cannot be ensured and settings need to be checked or
re-configured.
•
When a configuration file is loaded to an incompatible camera, e.g. a configuration file from a
HD camera loaded onto a VGA camera, encoder settings might become invalid and need to
be re-configured.
•
Uploading a configuration file from a different camera platform may result in unpredictable
behaviour.
•
If it shall be checked if the image is not frozen, use milliseconds timestamp to verify.
•
After changing the application variant in the Installer menu, the camera reboots and starts
counting down time until it tries to reconnect to the rebooted camera, IE doesn't always
reconnect so it keeps showing only the waiting circle (named hourglass in earlier times) In this
case resetting the browser with ctrl+F5 will re-establish connection with the camera..
•
Please take note that, whenever you change the application variant, the camera resets to
factory defaults.
•
Analogue output does not support 90° and 270° rotation.
•
FLEXIDOME IP panoramic 7000 and AVIOTEC cameras only support 180° rotation.
•
Maintenance log file creation and download requires some time, though there is no progress
indication, and needs to be waited for completion.
•
Millisecond stamping on 60 fps cameras is refreshed with 30 Hz only, updating only every
second frame.
12 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
•
Product Management
27.07.2017
JPEGs with VCA overlay are not fully synchronized. Shapes might be slightly off.
DIVAR IP 2000 / 5000
•
Due to its improved security features, firmware 6.40 is not fully backward compatible with
DIVAR IP 2000 and DIVAR IP 5000. Upgrading cameras to FW 6.40 without to-be-released
firmware upgrades for DIVAR IP 2000 and DIVAR IP 5000 may cause configuration problems
and possibly stop recording.
DIVAR hybrid / network
•
Cameras running FW 6.40 are only compatible with DIVAR network / hybrid FW 1.2.1 and
higher. With earlier DIVAR network / hybrid firmware versions, the I-frame distance needs to
be adapted to 30 or less.
Please check the respective release letter of a camera for further device-specific restrictions.
13 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
7
Previous Revisions
7.1
New Features
27.07.2017
Security
•
Strengthened password policy:
o
New passwords must now be a minimum of 8 characters including special characters.
o
Passwords are continuously demanded; message cannot be hidden anymore.
•
For full support of HSTS, an option “HSTS plus HTTP redirection” has been added.
•
Fallback to TLS 1.0 can be disabled.
VCA
•
6000 series cameras support Essential Video Analytics.
•
7000 series cameras support Intelligent Video Analytics.
•
JPEG with VCA overlay is now also available in full screen view.
For details on VCA 6.30 please refer to the release notes of Essential Video Analytics or Intelligent
Video Analytics.
Miscellaneous
•
Improved user interface for 802.1x settings. Interface shows an EAP-MD5 password field and
lists the EAP-TLS certificates with a link to the certificate store.
•
Security coprocessor (TPM) version is listed in system overview.
•
Preposition widget on Live page can be completely disabled in Web appearance settings.
14 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
7.2
Product Management
27.07.2017
Changes
•
Limited frame rate stream capability names are presenting the frame rate as “skip” value,
which is used as divisor in relation to the base frame rate.
A value “skip 5” results e.g. in 12 fps if base frame rate is set to 60 fps, or in 5 fps if base
frame rate is set to 25 fps.
•
In preparation for ONVIF Profile Q support, planned for next major firmware release, the
default setting for Automatic IPv4 address assignment has changed from “On” to “On plus
Link-Local”, a setting that had already been in the option list before.
Though this might seem a small change, it may have an impact:
The former default IP address 192.168.0.1 will virtually become obsolete.
Instead, the camera will assign itself an auto-IP address out of the range 169.254.1.0 to
169.254.254.255 as long as there is no other IP address assigned by a DHCP server.
(https://en.wikipedia.org/wiki/Link-local_address)
The advantage is that there are no more duplicate IP addresses, which is considered
prohibited in a network.
•
VCA overlays are drawn after scaling to improve visibility.
•
An issue has been fixed where the maintenance log could not be downloaded.
•
An issue has been fixed where the wrong SD card recording status was displayed.
•
A security leak, which allowed to extract critical data from the device, has been fixed.
•
A problem with incorrect time zone info in recording packets causing gaps in timeline has
been fixed.
7.3
New Features with FW 6.30.0140
Imaging
•
Flexible video input orientation handling has been added, including mirror and rotate (90°,
180° and 270°). This allows corridor view applications using full resolution.
•
[CPP4] Flexible video input orientation handling has been added, including mirroring and 180°
rotation. This allows to correct the view of e.g. panoramic cameras if wall-mounted headfirst.
•
FLEXIDOME IP panoramic 7000 cameras now allow reduced base frame rate of 12.5 fps to
increase streaming capabilities for the second stream.
•
[CPP4] A 1.3 MP application variant is now selectable for DINION IP bullet 4000 cameras.
•
[CPP7] Built-in gyro sensor is supported for automatic orientation detection.
Security
•
The user management has been extended to allow free assignment of usernames.
Each user can be assigned a user group representing live, user, or service level.
15 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
•
New user management system allows to dynamically create a user for whom the password
can be treated as token. Also timeout before user account expires is possible.
•
Token-based authentication implemented to allow user management based on communication
with Microsoft Active Directory Federation Services.
•
Secure FTP connection (FTP over TLS) is implemented.
•
ICMP redirect messages are not accepted anymore by default. Acceptance can be re-enabled
via RCP+ command, if needed.
•
Video authentication is now also possible on RTSP streaming. It can be enabled with CGI
parameter ‘auth=1’ which requests picture info packets (payload type 97).
Recording
•
Recording to iSCSI now supports LUN size up to 64 TB.
•
A PTZ preposition can be stored in a recording profile, allowing to record only a ‘region of
interest’ (ROI) of the full image.
ONVIF
•
ONVIF encoder profile settings can be verified via http://<ipaddress>/onvif_encoder_profiles.
•
Manual focus and iris control is now supported via ONVIF command.
•
Tamper detection alarms are now forwarded to and included in ONVIF event services.
Video Fire Detection
•
Automatic mask detection has been added to AVIOTEC IP starlight 8000 camera.
•
Relay 1 automatically follows video fire detection alarm on AVIOTEC IP starlight 8000 camera.
VCA
•
Web page layout has been improved for better usability and larger video for configuration.
•
Video analytics now fully support 16 tasks in RCP+ and IVA Task Script Language.
•
Intelligent Tracking is now also available on cameras 2 and 3 of FLEXIDOME IP panoramic
7000 cameras in dewarping mode.
•
JPEGs can now include VCA overlays in Live page, alarm e-mails and JPEG Posting.
For JPEG snapshot a new query parameter ‘VCAOverlay’ can be added to the URL, e.g.
http://<ipaddress>/snap.jpg?VCAOverlay=1.
•
Video can now be paused during VCA configuration.
•
Reference image is now stored as JPEG instead of TIFF for broader compatibility.
16 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
•
Product Management
27.07.2017
Tamper detection “too bright / too dark” was no more functional due to too high dynamic on
our cameras.
To solve this issue, sliders for the brightness level have been added for manual adjustment.
For details on VCA 6.30 please refer to the release notes of Essential Video Analytics or Intelligent
Video Analytics.
Miscellaneous
•
HTML5 video tag is used to display a continuous MP4 video file from the camera on browsers
not supporting NPAPI plug-ins (MPEG-ActiveX) like Firefox, Chrome and MS Edge.
•
A “Links” section in the main navigation (blue top bar) has been added, leading to a
DownloadStore page providing latest tools, apps and supportive software.
•
Unicode characters are now also possible on all configuration strings.
•
Time server IP address can be accepted to be overwritten by DHCP.
•
Display of preposition widget on Live page can be configured.
17 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
7.4
Product Management
27.07.2017
Changes with FW 6.30.0140
•
Due to the introduction of image rotation, the high-resolution/low-framerate capability for
stream 2 is conflicting and thus no more available on FLEXIDOME IP panoramic 7000
cameras.
•
“Image too noisy” is removed as it never occurs due to the high dynamic of image processing.
•
Downscaled images 4CIF/CIF are now encoded as PAL resolution (704x576 resp. 352x288)
when camera is set to 25/50 fps base frame rate.
•
Fixed a potential recording issue which could cause recording to stop due to insufficient
storage error handling under rare error conditions, like e.g. massive irregular network
connection interrupts to storage system.
•
Removed non-supported mirroring option from FLEXIDOME IP panoramic 7000 MP cameras
in dewarping mode.
7.5
New Features with FW 6.22.0008
•
7.6
A high-resolution/limited-frame-rate capability has been introduced for stream 2 on various
cameras.
Changes with FW 6.22.0008
•
Writing to ONVIF MaxFrameRate is now possible to improve compatibility with clients not
using encoding interval. Written values are presented in same format when read.
•
The microphone can be permanently blocked, irreversibly for users, via a global license key to
allow use of the cameras in countries where audio input is legally not permitted.
License type 2:
o
12-01.63.01-380AAC7E-B71E0D3D-6ADCC50C-6F296E08-F3AFBB71
The permanent block can only be lifted by releasing this license via our service organization.
If not legally required to completely disable the audio function, audio can simply be switched
off, or the microphone sensitivity set to zero, always reversible through configuration.
The global license type 1 as being presented with release notes of FW 6.00.0079 is not
functional on CPP6 platform devices.
18 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
7.7
Product Management
27.07.2017
New Features with FW 6.21.0008
•
7.8
DINION IP panoramic 7000 has been enhanced with a high-resolution/low-frame-rate mode
for stream 2, providing 2640x2640 pixels at 5 frames per second while the first stream
provides the same resolution at full frame rate.
Changes with FW 6.21.0008
•
An issue with fragmented EAP-TLS transfer has been fixed, allowing support for Microsoft
Windows NPS and RADIUS.
•
An issue with ONVIF Analytics Service has been fixed.
•
GUI translations and some embedded help files have been updated.
•
Wrong wording on time protocol settings has been fixed.
Note:
To avoid a potential timing issue with older bootloader firmware that, in combination with the
actual FW 6.21 load pattern, may very rarely lead to a camera reboot, this firmware release
includes an updated bootloader that is applied if an outdated bootloader is being detected
during firmware upgrade, opening a short window of approximately one second of vulnerability
against power loss.
Be especially careful that the camera does not lose power during firmware upgrade.
19 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
7.9
Product Management
27.07.2017
New Features with 6.20.0089
Cameras
•
P-iris control for DINION IP 8000 cameras supported.
•
Support for Video Fire Detection camera.
Security
•
Support of TLS 1.2 with updated cypher suites including AES 256 encryption.
•
Device access security has been improved by:
o
Implementation of signed time synchronization
o
Signature-protected password unlock procedure
o
Telnet over HTML5 web sockets in browser, using secure TLS connection
o
Throttling of wrong password entries
o
Urging user towards setting a device password, strength meter provided
•
Firmware, which is signed with a private certificate, is authenticated before transfer to Flash to
ensure a secure firmware upload.
•
Certificate handling has been enhanced by:
o
Auto-generation of self-signed certificates for SSL
o
User-defined creation of self-signed certificates
o
Possible upload of certificates with encrypted private keys
o
Improved recorded video authentication without PKI required
o
Storage and retrieval of certificate in recording for verifying signed video
•
Web GUI security has been improved to prevent Cross-Site-Scripting in Browser.
•
Use of secure connections can be advertised via support of HSTS.
7.10 Changes with 6.20.0089
•
56-bit encryption disabled for secure connections to increase minimum security level.
•
Telnet service (system console) is now disabled by default.
20 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
7.11 New Features with 6.11.0019
Imaging Enhancements
•
On FLEXIDOME IP panoramic 7000 cameras user can choose via application variant in
installer menu between edge dewarping inside the camera or client-side dewarping on an
external platform.
•
On-board dewarping on FLEXIDOME IP panoramic 7000 cameras with realization of virtual
cameras, providing different types of dewarped scene representations: ePTZ, Panoramic,
Double Panoramic, Quad, and Corridor
ONVIF
•
Conformance was tested using recent ONVIF test tool 14.12.
7.12 Changes with 6.11.0019
•
Adding small improvements and error corrections.
•
Replay not working in BVC and BVMS clients for negative time zones has been fixed.
21 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
7.13 New Features with 6.10.0129
Graphical User Interface
•
Tours re-arranged onto single page and scheduler for preset tour and alarm rules added for
moving cameras.
•
Encoder quality regions can be configured on moving cameras’ preset positions with up to 8
regions.
•
Video export format can be preselected from Bosch format including metadata and generic
MP4 format on LIVE page.
Imaging Enhancements
•
Digital Zoom mode added to lens settings page.
•
Setting migration keeps all the previous imaging settings after camera upgraded to new
firmware. Please note: This is only applicable after firmware 6.10.
Security Enhancements
•
Certificate Store for management and assignment of client and server side certificates.
•
Preparation for Public Key Infrastructure (PKI), enabled via special license, has been added.
•
56-Bit DES cipher suite is disabled for TLS connection.
IVA Enhancements
•
Object classification of object types “upright person”,” bike”, “car”, “truck” replaces head
detection.
•
Improved robustness to moving background (water, branches), shaking, bad weather, fast
illumination changes, low-light conditions, mutual object occlusions and to detection of idle /
removed objects. Scene conditions are automatically determined.
•
Geolocation allows setting a camera’s global coordinates. The position of the tracked objects
in the respective coordinate system is added to metadata. Camera viewers can show the
tracked objects on a map.
•
Usability improvements allow for easier calibration and easier drawing of elements and masks,
including support of polygons.
•
MOTION+ configuration has been reworked. Eight MOTION+ alarm fields with up to 16 nodes
can now be set. Areas can be removed from processing via VCA masks, which will then
suppress metadata generation in these areas.
Note: For details and complete overview refer to release notes of IVA 6.10.
22 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
ONVIF Enhancements
•
IVA events can be received via ONVIF messages.
•
Overlay metadata can be received in ONVIF XML format.
•
AUX commands can be sent via ONVIF messages.
•
Conformance was tested using recent ONVIF test tool 14.12.
Miscellaneous
• Missing time zones added for Caracas, Newfoundland, Kathmandu, Yangon, Samoa and
Kiritimati Island.
•
Internal storage can be disabled and hidden via special license for certain LATAM countries.
This license can only be cleared via technical service and support.
•
An additional area in the flash memory, holding a file system to store specific files or data, has
been implemented. This area can hold such like the enhanced Chinese character table or the
FPGA image for IVA cameras running in 5:4 setup, certificates or configuration data.
With FW 6.10 necessary files can be installed by uploading a supplementary firmware file.
For successive firmware versions the sections will be recombined.
•
A customer logo up to 128x128 pixels with a depth of 256 colors can be uploaded as BMP file
to be displayed in the camera name block. Options for placement are left, right or logo only.
7.14 Changes with 6.10.0129
•
IPv6 operational improvements, e.g. netmask extended to 64 bit.
•
Reference image is deleted when device is set to factory default.
•
Larger font used for display stamping creates better visibility on large resolution.
•
Fix for recording status while pre-alarm recording in RAM.
23 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
7.15 Changes with 6.01.0008
•
Various small bug fixes and improvements.
•
ONVIF conformance was tested using recent ONVIF test tool 14.12SR1.
7.16 Features with 6.00.0079
Image Processing
•
Support of FLEXIDOME IP panoramic 7000 12MP 360° and 180° cameras.
New Web browser user interface
•
A new style and new colors are being introduced, according to the latest Bosch User Interface
Style Guide for Software User Interfaces. Together with usability improvements this provides a
completely new and improved user experience.
•
Easier navigation is possible due to the main topics in the blue bar in the header of the Web
pages as well as icon-supported navigation through the configuration pages.
•
Live and replay pages have been enhanced with more intuitive controls and a new timeline
which is easier to handle and better recognizable.
•
Live video preview is shown on most configuration pages whenever sufficient space available.
•
Privacy masks, encoder quality regions and IVA fields can be drawn as polygons instead of
rectangles, all with the same controls.
•
No Java applets are used on the Web pages anymore.
IVA
•
Object classification added with the classes "upright person", "bike", "car", "truck".
•
Mounting position and angle of panoramic cameras can be added to aid calibration for
dewarping in the client software.
•
Geolocation parameters can be added which are passed into metadata. This allows
management systems to directly position the camera, or objects tracked by this camera into a
map.
24 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
Recording
•
Automated Network Replenishment (ANR) 2.0 has been enhanced to provide more
robustness against SD card failures, including the possibility to add alternative storages.
•
ANR can be configured through the Web interface with a single click.
•
In ANR mode, SD card fill level is shown on recording status page.
•
SD cards are automatically detected, prepared for use, and recording started without
configuration required. SD card is added to managed storage media even if not inserted.
•
A storage system indicator icon has been added to the Web page’s title, providing a quick
indication about the health status of SD card recording by green, yellow, or red color.
•
An alarm is created if recording stops, usable in Alarm Task Scripting.
Network
•
Auto-IP assignment for IPv4 (aka Link local, APIPA) has been added as an alternative setting
to pure DHCP. In this mode, if no DHCP server is responding after 10 seconds, a link-local
address will be chosen.
•
IPv6 stateless auto-configuration has been enabled to allow IPv6 routability. The Auto-IPv6
address is displayed in Web browser menu below the manual IPv6 address, but is not
configurable.
•
802.1x has been enhanced by EAP/TLS using specific certificate. Certificates for client and
server side can be uploaded to be used for authentication.
•
After a network link is re-established EAPOL communication is initiated to restart 802.1x
authentication even if the switch does not initiate this.
•
Secure SMTP over Transport Layer Security (TLS/SSL) is supported according to RFC-3207.
Connection is established using plain text on port 25; then TLS is negotiated with “StartTLS”
command.
ONVIF conformance
•
A timeout range for continuous move has been added.
•
ONVIF GetDigitalInputs is now implemented.
•
CONF_ONVIF_STREAM_URI_EX allows storing a stream URI extension that is appended to
the ONVIF stream URI.
•
ONVIF can be switched off, advantageous in installations that have native RCP integration to
avoid accidental access through ONVIF clients. ONVIF remains enabled by default, of course.
25 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Security Systems
From
Nuremberg
ST-VS/MKP1
Product Management
27.07.2017
Miscellaneous
•
Platform type (CPP) is now displayed in System Overview page.
•
The microphone can be permanently blocked via a global license key to allow use of the
cameras in countries where audio input is legally not permitted.
o
02-01.63.01-1E034A4F-B9A37665-B468CBAD-D8945403-6891D511
The permanent block can be lifted by releasing this license via our support organization.
•
Filename definition in ATSL has been enhanced. Date elements can now be maintained
separately.
26 of 26
BOSCH and the symbol are registered trademarks of Robert Bosch GmbH, Germany
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertisement