Security over IP: Converging All the Pieces

Security systems, hosted on a PC and linked over a network, have proven they facilitate far more than just easing wiring and connection headaches. They provide a leap in capabilities.

By Scott Stogel

As the SUV approaches the unattended gate, a camera tilts a bit lower to focus on the license plate, while a second camera, with low light capabilities, peers behind the driver to view faces in the back seat.  A loud clear, “Hello, can I help you” instantly informs passengers they are in a monitored area.  At a PC workstation 160 miles away, a security officer views IDs and authorizes gate access.  The integrated, unattended entrance is just one of many monitored by a single operator.  When that operator’s shift ends, all control will be transferred to another operator, in another time zone, in another country.  Security systems like these, hosted on a PC and linked over a network, have proven they facilitate far more than just easing wiring and connection headaches.  They provide a leap in capabilities.  Alarms, sensors, access controls, biometrics and enhanced sound and visual monitoring are commonplace in the designs being specified in 2007.  This mix of technology supports a wide complement of hardware connections that must converge together to be useful for both monitoring and decision-making.  The traditional approach of wiring runs to a single microprocessor control board has moved to a network with Internet Protocol (IP) connectivity and a PC, hosting security application software.

CONNECTING IT TOGETHER

Connecting multiple IP-based security devices does not guarantee the interoperability required for seamless operation.  In fact, most of today’s IP hardware will work together only when the protocols match or a software interface is available.

A complex set of rules must be followed to allow a camera from manufacturer A, an intercom device from manufacturer B, a biometric device from manufacturer C, and an access control from manufacturer D to all work together under a single user interface.

Application Program Interfaces (APIs) are often used to integrate IP equipment to various software applications such as Lenel, and Wonderware.  These solutions allow IP devices performing diverse services to be controlled under a single shell that meets or exceeds the expectations of the operator.  The benefits are substantial, offering enhanced deployment options and a virtual ‘Plug and Play’ flexibility for software and hardware connections.

USING THE PUBLIC HIGHWAY

The Internet is simply a large public network that allows almost continuous connectivity to anywhere on our planet.  In IP-based security systems the trick is to move the data and route the traffic quickly, securely and reliably.

In the past, network latency has been cited as a major concern in security system deployment, but times have changed.  Today it is common to communicate between network points on opposite ends of the earth in less than 300 milliseconds.  In a Local Area Network (LAN) environment the speed is a far faster.  However, data theft and security are still a serious issue.  To insure privacy, encrypted networks, such as VPNs, can provide moderate protection, and end-to-end encryption (3DES and AES) can provide nearly totally secure links.  Note that use of high-end encryption requires consideration of import and export laws in certain countries (including the USA, Europe and Asia).

As speed and privacy issues are solved in modern IP systems, a larger challenge takes the spotlight.  What if the network goes down?

NETWORK RELIABILITY

■What if the network dies?

■How quickly can a backup system be online?

■What if our main command center is no longer operational?

■What if we need multiple teams working together in a hurry?

System deployment using networking backbones can be a simple CAT5 cable between two devices.  It can also involve spans between buildings, cities and countries with vast, dynamic independent network paths.  In such cases a lost connection link might be difficult to diagnose, and nearly impossible to access for repair.  The good news is because the network is complicated it is also clever.  System design can be used to take advantage of the great features inherent in TCP/IP connectivity to actually solve potential downtime issues.

Any network device can be assigned to a single specific connection destination.  For example, a camera could connect directly to a PC in just one operations center.  However, good planning must accommodate alternate scenarios, such as automatic reconnection schemes.  Ideally, endpoints should be smart and able to connect directly to multiple IP addresses, rather than a fixed, dedicated distribution head-end.  Reliance on a single hardwired nerve center is far less desirable than individual cameras, intercoms and sensors working without dependencies.  In a best-case scenario, communication redundancy could be deployed with Fail-Forwarding, IP addresses on each IP device.  This would enable every endpoint device a means for loading dynamic sets of ‘alternate host’ IP addresses to be used to establish control in the event of a primary connection failure.  The Fail-Forward contact points might include a simple standby workstation or a series of redundant disaster command centers.  Providing multiple host consoles is another means of safe and reliable backup protection.  Careful software selection and system planning is needed to address this issue.  Buyers should require transfer capability and software flexibility that supports multi-user environments.  This not only provides redundancy capability, but also eases planning and deployment of the human operators who monitor and supervise entire systems.

THE HUMAN FACTOR

Given the fact that IP provides connectivity anywhere in the world, there is no longer a requirement for operators at a single common location.  One or more monitoring centers may be used and have command and control that is transferable, desk-to-desk or city-to-city.  This permits guards and security staff to be located anywhere in the world and share tasks with other operators located off-site.   In a small system, this simply permits night desk transfer.  In a larger system, a concept of ‘follow the sun’ command centers can adopt IP addressing changes to transfer control to various centers and locations around the globe.  The cost and complexity of deploying such systems is a perfect fit for IP.

SAVE IT FOR A RAINY DAY

In the analog domain, data backup and reliable recovery is a project within a project, requiring interfaces and recording equipment to be used in multiple locations.  This is further complicated because companies are simultaneously archiving data in multiple secure sites.  Once again, IP offers a seamless modern solution.  A true IP backbone supports integrated, accurate and encrypted archiving that is free, limited only by data storage costs.  Events, camera DVR storage, audio conversations and other activities may be saved, transferred and archived in real time, and in multiple locations, with little or no computing overhead.  In expanded systems storage may also be encryption for secure record keeping.

BANDWIDTH

An important consideration in all IP topologies is data rate capability or bandwidth.  The common reference to “10/100” systems refers to 10M.bits/sec or 100M/bits/sec.  Security systems should incorporate an end-to-end data rate of at least 100MB when cameras are involved.  To further reduce camera-based traffic limitations, video and image compression must be incorporated.

The Table shows the need for video compression and other security system components, which have impact of network bandwidth utilization.  When designing IP systems the key calculation is combined peak security system usage + peak ambient traffic must not exceed 80% of most limited speed crossroad in the system.  For example a 1 GB/sec network line has limited benefit if it routes though an older 10mb 8- port system switch, or travels over a VPN/DSL connection.

WHAT TO LOOK FOR IN AN IP-BASED SYSTEM

When shopping for a system there is more to consider than simply looking for an RJ45 network connection on a security product.  Each device needs to connect independently, and integrate to a common control host seamlessly.  Included here is a brief list to consider before you specify or buy.

·Video Scalability: Flexible fps per camera with high compression

·High quality digital audio, with a 2 way capacity for paging, intercom and monitoring

·Flexible powering options including network Power Over Ethernet (PoE) capabilities

·When required, integrated real time Encryption using secure 3DES or AES standards

·Software and application support for convergence to single and/or multiple security workstations through a common program, or API programmer interface

·Peripheral support for relays, sensors, and future add-ins

·Support for non-legacy and non IP-based devices via connectors or terminal access point

·Bandwidth usage specifications that meet required total system network capabilities

·Diagnostic capabilities via common protocols such as USB RS-232, I2C® or SPI®  

Here is a quick review of some 3-letter abbreviations you’ll need to understand before you shop:

·TCP/IP: Common protocol used in network connections and transmissions

·AES/3DES: Secure data encryption algorithm used to protect network

·API/SDK: A software component used by programmers for seamless integration of multiple IP devices to a specific converged solution

·PoE: Power Over Ethernet standards transmit up to 14 watts of electrical power, within the network cable connection wiring.

AUDIO OVER IP

Audio distribution and paging has proven to be a perfect match for IP-based security systems.

The banking, parking, education and military markets have all adopted digital audio 2-way communications for monitoring, notification and emergency services.  Special enhancements, enabled by IP control, provide additional capabilities including room monitoring, paging and voice logging operated over multiple enterprise workstations, tied to cameras, access controls and sophisticated biometrics.  IP audio systems also provide a great path to upgrade outdated communication systems and tie to new technologies coming to market. 

IP audio upgrade modules, such as Digital Acoustics ii3-Intercoms, are used to migrate aging analog systems, mix them with new audio stations and dynamically connect them to centralize security and mass notification systems in a building, across town or around the country.  In the coming years, IP intercoms, video and biometric systems and paging solutions will be at the forefront of technology in security systems undergoing modernization and in virtually all new project specifications.

Scott Stogel is Co-founder and Vice President Engineering of Digital Acoustics (www.digitalacoustics.com).

     Millennium, A Singular Sensation in Single-door Technology

     The Ingredients of a Successful Sale