AXIS Secure Remote Access v2

An easy, secure and reliable way to access cameras remotely is a priority for many users of surveillance systems. However, connecting to remote cameras can be a challenge, especially when the cameras are located behind routers or firewalls. To give the user an easy and secure way of accessing cameras remotely, Axis has developed the Axis Secure Remote Access v2 technology.

With Axis Secure Remote Access v2 technology, Axis provides a solution to the problem of connecting remotely to servers and devices behind firewalls without the need of manual router configuration. An easy, secure, and reliable way to remotely access the surveillance system.

This white paper describes Axis Secure Remote Access v2 and gives examples of the technology when used in AXIS Camera Station Pro, AXIS Camera Station Edge, and My Systems.

Axis Secure Remote Access v2 makes it possible for a smartphone, tablet, browser, or PC client to access Axis network cameras when the client and the cameras are located on different local networks. Using external mediator servers, the client and the camera can find each other and establish a secure peer-to-peer connection. As a fallback, the communication is automatically relayed through the mediator servers, when direct communication cannot be established.

• Easy to setup: Axis Secure Remote Access v2 significantly simplifies the installation of remote access to surveillance systems. It is automatically configured when onboarding a camera or registering a server with an organization and removes the need of manual port- forwarding or router configuration.

• Secure communication: Secure communication is in the core of Axis Secure Remote Access v2. It uses multiple levels of authentication to establish an encrypted communication between a client and the cameras in the surveillance system.

• Availability and geolocation of services: To keep the response time to a minimum, and reduce latency, Axis Secure Remote Access v2 is supported by multiple mediator servers setup around the world: in western EU, eastern US, & Australia. The redundant environment also secures the availability of the system.

AXIS Camera Station Pro software is the ideal solution to meet the needs for active and efficient surveillance of retail shops, hotels, schools, and manufacturing sites. It is designed to perfectly match Axis' wide range of network video products and product features to optimize system reliability.

• System setup: To use Axis Secure Remote Access v2, all users must have a MyAxis account. This account organizes users’ sites and cameras and make them accessible from different clients. The AXIS Camera Station Pro server and the viewing client need internet access. Install AXIS Camera Station Pro and cameras on the local network and register the server with an organization in the server configuration.

• Establish connection: To be accessible remotely, the server registers contact information with the mediator servers during server registration. When a client wants to contact the server and cameras, it uses the mediator servers to find out how and where to contact the server. The client and the server establish a connection via the mediator server, verify each other's identities, and establish a secure, direct, peer-to-peer communication.

• Fallback to relayed communication: In some scenarios, for example, complex network configurations, it is not possible to set up a peer-to-peer connection. For maximal availability, Axis Secure Remote Access v2 has a fallback option to relay the communication through the mediator servers. This is seamlessly handled by the system.

• Secure communication: The data transferred via Axis mediator servers and over peer-to-peer connection is end-to-end encrypted which means that the data communicated can only be decrypted by the client and server. All data is encrypted with AES 256 (256 bit) end-to-end encryption using 2048-bit certificates and TLS 1.2.

• Data limitations: If the communication is done using relay services (mediator servers), there is a set data limit.

AXIS Camera Station Edge software provides a seamless camera-to-cloud experience with no server registration required. It allows flexible control of your devices from anywhere through a mobile app, desktop client, or web client.

• System setup: To use Axis Secure Remote Access v2 in AXIS Camera Station Edge, all users must have a MyAxis account. This account organizes users’ sites and cameras and make them accessible from different clients.

  AXIS Camera Station Edge and the cameras should be located on the same network. The setup wizard takes you through the necessary installation steps. After the setup, the cameras become accessible remotely using your MyAxis account and camera or site credentials.

• Establish connection: To be accessible remotely, the camera keeps an open connection to its nearest mediator server. When a client wants to contact the cameras, it uses the mediator servers to find out how and where to contact the camera. The client and the camera establish a connection via the mediator server, verify each other's identities, and establish a secure, direct, peer-to-peer communication.

• Fallback to relayed communication: In some scenarios, for example, complex network configurations, it is not possible to set up a peer-to-peer connection. For maximal availability, Axis Secure Remote Access v2 has a fallback option to relay the communication through the mediator servers. This is seamlessly handled by the system.

• Secure communication: The data transferred via Axis mediator servers and over peer-to-peer connection is end-to-end encrypted which means that the data communicated can only be decrypted by the client and server. All data is encrypted with AES 256 (256 bit) end-to-end encryption using 2048-bit certificates and TLS 1.2.

• Data limitations: Axis Secure Remote Access v2 is provided free-of-charge for AXIS Camera Station Edge users. While not limited by amount of data allowance, AXIS Camera Station Edge is in control of the streams and their quality. The video stream quality reduces after 5 minutes from stream activation.