What's the best way for my app to access a remote Hikvision device?

[jaden park]

hello. This is Jaden. I am a software developer.


I have developed an app in NodeJS. The app runs on Fargate on AWS. It is similar to how it works on a regular PC.

I want my app to detect motion event on hikvision device and download video. I used the Hikvision ISAPI documentation I found somewhere.

- Cam: DS-2CD2143G0-I
- DVR: iDS-7208HUHI-M1/S
- NVR: DS-7616NI-K2/16P

Devices are installed remotely. I'm not sure how to access a remotely installed device. As far as I know, there was a method using DDNS or Hik-connect.

I chose Hik-connect. After registering the device to Hik-connect, I was able to check the IP/Port in the Hik-connect Portal. Connected to the device using ip and port. In that case, port forwarding or uPnP was required.

My software gets IP/Port information from Hik-connect Portal and connects to Hikvision Device.




This works, but I'm not sure if this is the right way to do it.

In my opinion, using the current method or DDNS is a security risk. This is because port forwarding has to be done on the router and the IP and port are exposed to the public internet. Security only relies on the device's ID/PW.




On the other hand, Hik-connect App (Mobile) or iVMS-4200 seems to be able to connect to devices registered in Hik-connect. Without port forwarding. The figure below is what I guessed on how it works without port forwarding.

I guessed that if my Hikvision Devices are registered in Hik-connect, I would be able to connect without port forwarding in my App as well.

But I couldn't find any documentation or guide on this.



1. I want my app to connect to devices connected to Hik-connect. Without port forwarding. Can you give me some help or advice on how to do this?

2. Are there any best practices for the network structure for Hikvision Devices installed remotely like this? The number of devices will continue to increase, but it seems difficult to scale out with the current structure.

3. If you have any other advice, please let me know. I am a beginner in setting up a CCTV network. thank you

 

[Phil]

I think that you've shown a good understanding.

As you say, Hik-Connect enables you to connect remotely, without setting up port forwarding.
But, you are reliant upon routing via their servers.

People who set up direct access to site via port-forwarding tend to experience better performance.
But, usually as they typically have a CCTV security requirement, they then need to face the compromise that they will be 'losing' the Push notifications to the Hik-Connect App that using Hikvision's servers / Hik-connect route also provides them with.

If you go the DDNS / port forwarding route, you may want to consult 'hardening' recommendations to improve security of access - you should be able to find same her (in this forum).

AWS has so many advanced capabilities for those who have the time and understanding to delve.
Some Vivotek cameras offer a form of direct integration with AWS VMD capabilities, which we have also mentioned in the forum previously.

(Soz, too busy to find the links, and can't remember the term for the appropriate AWS service - doh!)

 

[jaden park]

hello Phil

Thanks for your comment.

I'm attaching the link Phil mentioned in case anyone else has the same problem as me.


'hardening' recommendations to improve security of access
-> Tips for hardening Hikvision devices against cyber attacks - my tuppence on Passwords

Vivotek cameras offer a form of direct integration with AWS VMD capabilities
-> :: VIVOTEK ::