For client-server communication, we use 128 bit AES encryption in combination with Diffie-Hellman key exchange. By default, the key is updated every 5 minutes. This is true for all data except video stream, audio stream and blob (map images, etc…) data.
For server-camera/device communication, the encryption is camera dependent and does not use SSL. We use HTTP Basic or HTTP Digest Authentication for all data except video and audio streams.
Using the <host>/api URL, it will take you to the ESM deprecated landing page. If you do not have a session in ESM, you can see these landing page and discover endpoints.
You are not able to use the endpoints, but we want to password protect landing pages too.
“Legacy Authentication” refers to the less secure connection methods used prior to our current authentication mode introduced in exacqVision Server/Client version 6.8. This article explains how to enable legacy authentication mode, so newer clients using advanced authentication methods can connect to older server software versions.
<br>
Some Vivotek cameras require Basic Authentication. This should be indicated in the Notes section of the cameras test record. The camera will not connect if digest authentication is selected.
Important: The camera seems to require a reboot to fully apply the change in authentication mode.
Cause: The setspn command was not run on all Active Directory Servers, or there is a duplicate SPN.
Solution: On the DC, run the setspn command as directed in the appropriate ExacqVision Active Directory setup guide, or run setspn -X to check for duplicates. If a duplicate is found, remove the SPN attribute from all but one of the accounts.
Cause: Windows 2000 or earlier Active Directory Domain Functional Level.
Solution: Upgrade the Functional Level of your Domain to Windows 2003 or higher.
See How to raise Active Directory domain and forest functional levels for details.
Alternate Solution:
Cause: The Binding DN is incorrect.
Solution: Complete the following procedure:
While there are other possible causes, it’s common for a ‘Binding DN’ to be an extended string that is easy to mistype. For instance the following Distinguished Name will work, but must be typed exactly:
CN=exacqSVC,OU=ServiceAccounts,OU=SecurityGroups,OU=Indiana,OU=US,DC=exacqts,DC=local
Any incorrect spacing or punctuation will not allow proper setting of the SPN and you will see the following Server log:
StreamPI Warning LDAP: Bind DN was not found. Unable to create SPN.
You can also try the Username instead. In this instance, the username (UPN) for that account is:
exacqSVC@exacqts.local
<br>
The validation standard used in ExacqVision is known as HMAC, for Hashed Message Authentication Code, and uses a cryptographic hash and secret cryptographic key. HMAC is used by ExacqVision to verify the integrity of exported video.
The ExacqVision Client software calculates and writes out the message authentication code (MAC) during file export. The ExacqVision ePlayer later calculates a hash and verifies the MAC during authentication using SHA-256. The methodology ensures no alteration of the data as the hashed calculations are compared to be certain the hashes match.
To authenticate video in the ExacqVision ePlayer, select Authenticate from the Tools menu.
The following image shows a successful authentication:
Video may only be authenticated using the ExacqVision ePlayer. The ePlayer application is used to playback ExacqVision native files in .PS or .PSX file formats. It is also packaged in self-playing .EXE file exports. For more information on the features of exported file formats, refer to Article 1894.
<br>