A live-view camera platform with no third party in the video path
A self-hosted peer-to-peer streaming stack with per-device PKI, built for an Indian camera OEM selling into government and industrial deployments. A clause-level route to STQC certification, not a questionnaire. The same foundation satisfies EN 18031 in Europe.
[SRTP · DTLS] [WebRTC direct · relay observable]Where the pain concentrates
An OEM selling into Indian government and industrial deployments does not have a product problem. They have a certification problem. STQC IoTSCS-P01 is enforced before a connected device can be sold, not after. A camera that works beautifully cannot be purchased by the buyer who wants it unless it clears certification first, and licensing a third-party P2P SDK makes the trusted-source question permanently unanswerable.
Certification gates the sale
STQC is enforced before a connected device can be sold, not after. A device not assessed cannot be purchased, however good it is.
Licensed P2P is a supply-chain problem
A third-party SDK puts someone else in the connection path permanently and makes the trusted-source question unanswerable, because the OEM cannot verify what sits between the camera and the viewer.
Shared secrets fail key management
The clauses ask for per-device uniqueness and a documented lifecycle. A fleet-wide credential is an architectural decision, not a config value. One leaked key compromises the whole fleet.
NAT decides whether video arrives
Carrier-grade NAT and factory networks behave nothing like a home router. Fallback has to be deliberate and observable, so operators know when a camera is sitting on a relay.
What the architecture commits to
Self-hosted end to end, certifiable by assessment
The platform is operated end to end on infrastructure the OEM owns. WebRTC peer-to-peer for the media path, with TURN relay only when the network blocks a direct path. ECDSA P-256 per-device identity, issued by an internal CA at provisioning. No licensed P2P service. No third-party SDK in the firmware or the app.
Control plane, media plane and PKI travel separate paths. The signaling service exchanges session descriptions and never carries video. Certificate issuance sits behind the backend rather than being exposed to the public internet. Connection state is tracked apart from provisioning state, so an offline camera and an unconfigured camera read differently in the dashboard.
STQC IoTSCS-P01 is assessed clause by clause, from code and configuration rather than a questionnaire. 18 platform-level and 3 device-level clauses are in scope. 6 covered at first pass. A 7-step effort-sized path for the remainder. The OEM walks into the accredited lab's evaluation with a clause map, a code trail and a running system, not a promise.
Signaling, STUN, TURN and media ingress all run on OEM-operated infrastructure. The OEM can answer the trusted-source question with the deployment diagram in hand.
Five building blocks, one certifiable stack
Each block carries a specific job between the camera at the site and the viewer app, with the trusted-source question answerable at every layer. Together they make clause-level STQC assessment possible from code and configuration.
Self-hosted signaling, TURN and media
Signaling, STUN, TURN and the media ingress all run on infrastructure the OEM operates. No licensed P2P service. No third-party SDK in the firmware or the app. The OEM can answer the trusted-source question with the deployment diagram in hand.
Per-device certificate identity
Each camera carries its own ECDSA P-256 key pair, generated on the device, and a leaf certificate issued by an internal CA at provisioning. No two cameras share a credential. A compromised unit is revocable on its own without touching the rest of the fleet.
Direct P2P, relay on fallback
WebRTC negotiates a direct path first. The TURN relay engages only where the network blocks it. Connection mode is surfaced in the app, so relay usage is measurable rather than assumed. The common case stays cheap. The hard case still works.
Split control and media planes
The app, the backend, the signaling service and the media route are independent at the ingress, each with its own middleware. Media never transits the signaling service. Certificate issuance sits behind the backend. A compromise of one plane does not propagate.
STQC-ready, by assessment not by claim
The platform is assessed against STQC IoTSCS-P01 clause by clause, from code and configuration rather than a questionnaire. 18 platform-level and 3 device-level clauses in scope. 6 covered at first pass. A 7-step effort-sized path to submission for the remainder.
Provision
Operator scans a QR code at the camera. The camera generates its own key pair and receives a scoped-lifetime leaf certificate from the internal CA.
Register
The device registers with the OEM backend. Device identity and registry record are linked by the certificate.
Request
The viewer app authenticates against the backend, receives TURN credentials and initiates the signaling exchange.
Negotiate
The signaling service exchanges SDP and ICE candidates. A direct path is tried first.
Stream
When the network permits, media flows peer-to-peer over SRTP, encrypted by DTLS-SRTP. No third party sees the frames.
Fall back
When CGNAT or firewalls block the direct path, the TURN relay engages. The app surfaces the connection mode so operators see it.
Observe
Connection state and provisioning state are tracked apart. The dashboard distinguishes offline from unconfigured.
Update
OTA updates are signed, anti-rollback, and delivered through the OEM-operated channel. The STQC OTA clause group is handled end to end.
Before, delivered, basis
| Dimension | Before | Delivered | Basis |
|---|---|---|---|
| Media path ownership | Third-party P2P model | Fully self-hosted | Architectural |
| Device credential | Not established | ECDSA P-256, per device | Code review |
| STQC clauses assessed | Unassessed | 18 + 3 device-level | Aug 2026 |
| Clauses covered at first pass | n/a | 6 | Aug 2026 |
| Open items, effort-sized | Open-ended | 7-step path | Aug 2026 |
Performance figures pending instrumented measurement. Capability and compliance outcomes above; not audited financial ROI. STQC-ready position as assessed. Certification is issued by an accredited lab following evaluation.
Extending the certifiable surface
Instrumented performance measurement
Latency to first frame, direct vs relay ratio by site profile, SRTP throughput under representative CGNAT conditions, reported on the same dashboard operators already use.
Clause-covered OTA automation
Full signing, anti-rollback and delivery lifecycle automated and documented against the STQC OTA clause group, with evidence auto-captured per update.
Hardware root-of-trust binding
Bind the ECDSA P-256 key to a secure element on the camera, so the device identity cannot be lifted off a compromised unit even with disk access.
EN 18031 submission package
Extend the clause map and evidence set from STQC to EN 18031, delivered as a submission-ready package for European market entry.
Multi-OEM pattern
Package the self-hosted stack and the compliance assessment service for other Indian camera OEMs facing the same STQC gate.
Edge inference channel
Separate inference traffic from live view traffic, with its own policy and observability, so AI features do not share a plane with control or media.
Three principles we are taking into the next engagement
Certification is an architecture question, not a questionnaire
STQC asks for per-device identity, signed updates, anti-rollback and split planes. These are decisions you make before you write the firmware, not clauses you answer after. Clause-level assessment from code and configuration is the only credible path.
Shared secrets are a liability by design
A fleet-wide credential makes every compromise a fleet-wide compromise. ECDSA P-256 per device, issued by an internal CA at provisioning, with revocation at the unit level, is what the clauses actually require and what the architecture should enforce.
Fallback has to be observable
A direct P2P path that silently fails over to relay without surfacing it in the app leaves operators guessing. Making connection mode visible turns relay usage into a measurable, cost-aware operational variable rather than a mystery.
Shipping a connected product into a certification-gated market?
ScroBits assesses running systems against STQC IoTSCS-P01 clause by clause, from code and configuration rather than a questionnaire, and hands back an effort-sized path to submission. Talk to our IoT security engineers.