RE: Excellent article13 Jun 2018 23:45
Tech Trends: A$$1Gn1ng $afe Cam3r@ Pa$$w0rd$
by Ray Coulombe On Jun 13, 2018
Camera Password Provisioning Strategies
I recently attended Axis Communications’ annual A&S Summit in the Bahamas and learned about a new approach to the weak password epidemic – the KeyScaler product from a company called Device Authority, who demonstrated it on Axis cameras via the AXIS Camera Application Platform (ACAP), an open application platform that enables members of its development partner program to develop applications that can be downloaded and installed on Axis network cameras and video encoders.
KeyScaler has two significant provisioning elements – certificates and passwords. Both are provided for in the Axis application, and here’s how it works:
From the Axis Device Manager Utility, the Device Authority agent is loaded onto the camera. This would typically be performed by an authorized integrator, or perhaps a distributor.
The agent connects to a KeyScaler server for secure device registration. Registration control records create a device whitelist and authorize specific cameras for registration into the system. The server also enforces established policies for changing certificates and passwords.
A unique certificate, signed by the certificate authority, is delivered to the camera and stored as an encrypted file on persistent storage. The certificate is used to authenticate the camera to third-party applications, such as a Milestone VMS.
Default passwords for the Root and user accounts are changed and managed per the policy. Note that the passwords are not transmitted over the network or even stored in the camera; instead, the camera stores the “recipe” for creating the password. The initial recipe is based on certain device properties and settings at time of initial registration, and subsequent recipes use a different combination of elements. That is, every time the 44-character password is changed, the means for generating it is changed as well. Device Authority calls this process Dynamic Device Key Generation (DDKG).
There are several attractive elements of this process. Every camera has a strong, unique password. It can be automatically updated per schedule or upon an event – such as a technician leaving the company – in a computationally unique way. There is no password stored on the camera (note that encrypted weak passwords can still be easily hacked through brute force attacks.
Importantly, the whole process can be automated and can be scaled to an entire installation of supported cameras. “Passwords are the weakest link – as you have the three-part problem of weak credentials to start with, storing passwords securely, and the sharing of potentially well-known passwords across an enterprise,” explains Rao Cherukuri, Device Authority’s CTO.
For certificate management, the KeyScaler platform also has built-in, automated integrity checks that can det
Sign In
Follow the stocks
