© Copyright 2010 ASAN Security Technologies Oy
www.asansecurity.com
Footage encryption
The ASANTech NVR 4.0 can encrypt video footage. The footage is encrypted with a 128-bit AES -key, which
changes on every recording event. The AES key is encrypted with a 1024-bit (default, can be changed) RSA key.
The encryption is done via a PKI (Public Key Infrastructure), where the public key is used to encrypt the data.
The encrypted data can be decrypted only with a secret key, which has been generated together with the public
key.
Below is a description how to generate the key pair, activate the encryption on the NVR, and how to manually
or automatically apply the (decryption) secret key when viewing footage.
1) Generating a key pair
To generate a key pair, download the script from the ASANTech NVR’s
/extra
-directory:
. Check that you have the latest Java Runtime installed - the script uses the Java utility
keytool.exe
to generate the keys. When using the script you have to enter a password for the key store file, and
some other information.
The script generates 2 files: the public key
asanCryptCertFile.cer
and the key store file
asanKeystore,
which
includes the password-protected secret key. Save the key store file in a safe place. You will also need the
password later.
2) Activating the encryption
The public key
asanCryptCertFile.cer
is used to encrypt the footage. Copy it with the SCP -program to the NVR’s
directory
/etc/asan/
(create the directory, if it does not exist). After this, restart the recording service with the
Linux command
service asan restart
. You can also restart the entire server over the browser interface. After this,
new footage is encrypted. To ensure encryption is working, try to view something which has been recorded
after activation of encryption with the
Playback Tool
.
34