Data Center edition: security overviewIn development

“J&J Sentinel™ Data Center Edition: works with a vetted list of camera and recorder brands, checked at every connection. By J&J Technical Services.”

The Data Center edition is a separate edition of J&J Sentinel NVR, built from the same code as the standard edition, for sites that need tight control over which hardware is allowed to connect. The standard edition is unchanged and keeps working with all major camera brands.

Hardware control

• Limited to a vetted brand list chosen by J&J Technical Services. Only cameras and recorders on that list can connect. Anything else is refused. Customers can't switch this off.
• Checked at every connection. Each device is checked when it shows up in camera search, when it's tested, added or imported from a recorder (before any login is tried or any camera seat is used), when Sentinel starts or is upgraded, every time a camera stream reconnects, and in a full re-check every 15 minutes.
• Identified from several independent signs, including what the device reports about itself and its network identity. One weak sign on its own never decides.
• Calm, clear messages. A refused device shows “Blocked: unsupported hardware” or “Not on the vetted brand list”. Admins can see why each device was refused.
• Footage is kept. If a camera that's already installed is refused, its live view, recording and S.I. stop, but its earlier recordings stay viewable and exportable and are never deleted automatically. Its camera seat is freed, and admins get an alert and an Audit log entry.
• Nothing extra in the box. Drivers, model presets and setup data for brands that aren't supported are left out of the Data Center installer, and a build check confirms they're gone.

Built on Sentinel's standard security

These are part of Sentinel today, and the Data Center edition keeps them:

• S.I. runs on site, on the Sentinel server, with no cloud calls.
• Every page, recording and live stream needs a signed-in session. There are no anonymous stream links.
• Roles (admin, operator, viewer), a forced password change at first sign-in and an optional login policy for password strength, expiry and reuse.
• Camera and NVR password rotation (Patent Pending) on a schedule, with an exportable audit.
• Camera and email passwords encrypted at rest, and kept out of logs and the Audit log.
• An Audit log of logins, setting changes, searches, exports, deletions and purges.
• Signed updates with a database backup before each install and automatic rollback. Data Center installs accept only Data Center updates.
• Remote viewing through a private encrypted tunnel, never a forwarded port.

Data center hardware

• Graphics cards: the edition detects supported graphics cards, runs S.I. on the best one available and falls back to the processor. It spreads cameras across several cards, rebalances if a card fails, and shows each card's use, memory and cameras. Performance figures are sample data until we finish testing on real data center hardware.
• Data Centers industry pack (available in Sentinel today): tailgating at server-room and cage doors, people in restricted aisles after hours, loitering at cage doors, rack-row line crossing, and doors held or propped open.

Planned

• Air-gapped operation (see Air-gapped install).
• Signed updates to the vetted brand list without a software change.
• A central console for many servers, with one login and roles across them, a combined live wall, alerts, search and health.
• Failover, where a standby server takes over cameras if one goes down.
• Single sign-on with Active Directory and audit export.

Interested in a pilot? Call (254) 978-5534.