84
9.5
Network Security
There are different levels of security when it comes to securing information being sent over IP
networks. The first is authentication and authorization. The user or device identifies itself to the
network and the remote end by a username and password, which are then verified before the
device is allowed into the system. Added security can be achieved by encrypting the data to
prevent others from using or reading the data. Common methods are HTTPS (also known as SSL/
TLS), VPN and WEP or WPA in wireless networks.
(For more on wireless security, see Chapter 10.)
The use of encryption can slow down communications, depending on the kind of implementa-
tion and encryption used.
9.5.1 Username and password authentication
Using a username and password authentication is the most basic method of protecting data on
an IP network and may be sufficient where high levels of security are not required, or where the
video network is segmented off from the main network and unauthorized users would not have
physical access to the video network. The passwords can be encrypted or unencrypted when they
are sent; the former provides the best security.
Axis network video products provide multi-level password protection. Three levels are available:
Administrator (full access to all functionalities), Operator (Access to all functionalities except
the configuration pages), Viewer (Access only to live video).
9.5.2 IP address filtering
Axis network video products provide IP address filtering, which gives or denies access rights to
defined IP addresses. A typical configuration is to configure the network cameras to allow only
the IP address of the server that is hosting the video management software to access the net-
work video products.
9.5.3 IEEE 802.1X
Many Axis network video products support IEEE 802.1X, which provides authentication to
devices attached to a LAN port. IEEE 802.1X establishes a point-to-point connection or prevents
access from the LAN port if authentication fails. IEEE 802.1X prevents what is called “port
hi-jacking”; that is, when an unauthorized computer gets access to a network by getting to a
network jack inside or outside a building. IEEE 802.1X is useful in network video applications
since network cameras are often located in public spaces where an openly accessible network
jack can pose a security risk. In today’s enterprise networks, IEEE 802.1X is becoming a basic
requirement for anything that is connected to a network.
In a network video system, IEEE 802.1X can work as follows: 1) A network camera sends a request
for network access to a switch or access point; 2) the switch or access point forwards the query to
an authentication server; for instance, a RADIUS (remote authentication dial-in user service) serv-
er such as a Microsoft Internet Authentication Service server; 3) if authentication is successful, the
CHAPTER 9 - NETWORk TECHNOLOGIES
