Profile V – Frequently Asked Questions (FAQ)
• General
• For manufacturers
• For system integrators
• For end users
General
What is ONVIF Profile V?
Profile V is the ONVIF standard for cloud-based video surveillance. It defines how Profile V conformant cameras, encoders, and cloud video management systems (VMS) or Video Surveillance as a Service (VSaaS) work together to provide secure live video and audio streaming, encrypted video and audio for recording to cloud storage, and event notifications.
At what stage is Profile V, and when will it be finalized?
Profile V is at the Release Candidate stage. The draft specification is available now for review and testing by ONVIF members, and ONVIF expects to finalize it at the end of the year. Products can be certified as conformant only after the specification is finalized and they pass ONVIF conformance testing.
Why is ONVIF standardizing cloud video surveillance?
Cloud video surveillance systems have generally been built on proprietary connections between a vendor’s devices and that vendor’s cloud service. Profile V defines a standard way for conformant products from different manufacturers to work together in a cloud system, so a conformant device or client can be replaced with another conformant product.
How does a Profile V system work?
A conformant device, which can be an IP camera, video encoder, or video streaming application, makes a secure outbound connection to a cloud-based conformant client such as a video management system or VSaaS. No port forwarding or VPN configuration is typically needed to reach a device behind a local firewall. Once the connection is established, the conformant client configures the device, and the device can stream live video and, if applicable, audio and send event notifications. The device can also encrypt video and, if applicable, audio for recording to cloud storage. Authorized users of the conformant client, or a web client that supports the required protocols, can access live video and, if applicable, audio from the device, speak through the device if audio output is supported, and receive alerts. Recordings may be accessible from the conformant client or from a cloud storage provider.
What is the Profile V Security Add-on, and why is it separate from the profile?
The Profile V Security Add-on is a companion specification that every Profile V conformant product must implement. It covers authentication, using the OAuth 2.0 framework so that only authorized devices, clients, and cloud services can connect and exchange data, and it specifies how recorded video and audio are encrypted on their way to cloud storage. Keeping the security requirements in an add-on (separate from the profile) allows ONVIF to update them as security needs change without changing Profile V itself. Under ONVIF Profile Policy, the elements of a profile cannot be changed once it is published.
For Manufacturers
What must a Profile V conformant device support?
Among other requirements, a conformant device must:
- Establish a secure Uplink connection to a conformant client using the WSS protocol
- Support authentication methods based on mutual TLS (mTLS) and access tokens
- Stream H.264-encoded video over WebRTC
- Encrypt and push video and audio (where supported) to cloud storage (such as Amazon AWS S3 or Microsoft Azure Blob Storage) for recording
- Send pull-point event notifications over Uplink or JSON event notifications over MQTTS protocol
- Support bidirectional audio streaming over WebRTC (if audio hardware is present)
What must a Profile V conformant client support?
A conformant client, such as a cloud video management system or VSaaS, must, among other things:
- Configure or manage an ONVIF Profile V conformant device remotely and securely
- Support the Uplink setup request using WSS protocol
- Support authentication methods based on mutual TLS (mTLS) and access tokens
- Initiate and receive H.264-encoded video over WebRTC
- Configure the device to push video and audio (where supported) to cloud storage (such as Amazon AWS S3 or Microsoft Azure Blob Storage) for recording
- Receive pull-point event notifications over Uplink or JSON-based notifications over MQTTS protocol
- Support bidirectional audio streaming over WebRTC (if there is native support for audio)
What does the Profile V Security Add-on require my products to implement?
Conformant devices and clients must support authentication with cloud services such as storage providers, WebRTC signaling servers, and Uplink servers. Supported authentication methods should be based on mTLS and access tokens. Conformant devices must also support the specified encryption methods and MP4/CMAF container formats to securely and efficiently send video and audio for cloud recording.
How can I influence what goes into Profile V?
ONVIF specifications and profiles are developed by full- and contributing-level member companies in working groups. While feature additions to Profile V cannot be considered at this time, feedback on the Release Candidate specifications can be sent to the Profile V Working Group.
Where can I find the Profile V specifications?
The specifications for Profile V, as well as the Profile V Security Add-on, are accessible for eligible ONVIF members on the Member Portal.
For Systems Integrators
What changes for the systems I install?
Profile V lets you build a cloud video surveillance system from conformant products made by different manufacturers. A conformant component can be replaced with another conformant product without redesigning the whole system, so the design does not depend on one vendor’s cloud platform.
Do I need to open inbound ports or set up a VPN to reach devices behind a firewall?
Profile V enables a conformant device to make a secure outbound connection to the conformant client (e.g., cloud VMS) over the WSS protocol, so there is generally no need for port forwarding or VPN configuration to reach a device behind a local firewall. To be sure, check with vendors regarding network or non-standard requirements.
How would live video/audio and event notifications be delivered to viewers?
After a secure connection is established, a Profile V conformant device streams live video and audio (if applicable) over WebRTC. Authorized users access live streaming and receive event notifications through an ONVIF client or a modern web client. For live streaming, the client must support WebRTC. For event notifications, the client must support the Uplink specification and/or the MQTTS protocol.
How does recording work, and can I control bandwidth and storage requirements?
The device encrypts video and audio (if applicable) and pushes them to cloud storage such as Amazon AWS S3 or Microsoft Azure Blob Storage. Bandwidth and storage usage can be managed by uploading shorter recording segments and by optimizing, for example, the streaming configuration and the recording mode (e.g., the client can instruct the camera to record on a schedule or when an access control system detects door entry).
Can Profile V work alongside other ONVIF profiles?
Yes. Profile V can be combined with other ONVIF video and access control profiles in integrated or hybrid systems that use both on-site and cloud components.
For Consultants
How should I reference Profile V in a specification, and how is ONVIF conformance different from a vendor’s interoperability claim that they support ONVIF?
Once the specification is finalized and conformant products are available, you can specify ONVIF Profile V conformance for cloud video components. ONVIF conformance is verified using ONVIF test tools. A product is conformant to a particular profile only when it is listed in the ONVIF conformant product database. Without proof of conformance, claims of support cannot be substantiated.
What can I tell clients about cloud security under Profile V?
Profile V requires the Profile V Security Add-on, which provides a standardized framework for secure authentication between an ONVIF conformant device and client. The security add-on specification supports authentication with cloud services, such as storage providers, WebRTC signaling servers, and Uplink servers. The access and configuration channel is secured through the OAuth 2.0 framework, utilizing mutual TLS (mTLS) for identity verification and access tokens for cloud communication. Profile V conformant devices must support encryption methods and MP4/CMAF container formats to securely and efficiently send video and audio for recording in the cloud. Because these requirements are in an add-on, ONVIF can update them as security requirements change without rewriting the profile.
For End Users
What does Profile V give me?
Profile V lets you run a cloud-based video surveillance system using conformant products from different manufacturers. A remote server reduces or replaces on-premises hardware, simplifies maintenance, and supports remote access and scalable storage. Because Profile V conformant products follow a common standard, you can change or add conformant products from different vendors over time.
Do I still need on-site servers?
Not necessarily. Profile V supports cloud-based video management systems where a remote server reduces or replaces on-premises hardware. Some deployments may still use a hybrid mix of on-site and cloud components.
Is my video secure in the cloud?
Profile V conformant products must implement the Profile V Security Add-on, which mandates that devices and clients use secure access and configuration methods, and that video and audio are encrypted for recording to cloud storage. As with any system, overall security also depends on how your provider and integrator configure and operate it.
Can I buy Profile V products today?
Not yet. Profile V is at the Release Candidate stage. Once it is finalized, manufacturers can implement it and declare conformance to it. Products that pass ONVIF conformance tests will be listed in the ONVIF conformant product database.
How do I know a product is genuinely conformant?
Look for the product in the ONVIF conformant product database. ONVIF conformance is verified by ONVIF test tools, so a listing reflects tested conformance and not simply a vendor’s claim of ONVIF support.