Blackbe;rry ENTERPRISE SOLUTION SECURITY - ENTERPRISE SOLUTION

BlackBerry Enterprise Solution

Security Technical Overview

for BlackBerry Enterprise Server Version 4.1 Service Pack 6 and BlackBerry

Device Software Version 4.6

BlackBerry Enterprise Solution

Contents

Wireless security.......................................................................................................................................................6

BlackBerry Enterprise Solution security ...............................................................................................................6

BlackBerry Enterprise Solution security features........................................................................................... 7

New security features.......................................................................................................................................... 8

BlackBerry encryption keys ....................................................................................................................................9

Master encryption keys.......................................................................................................................................9

Message keys.......................................................................................................................................................12

Content protection keys.....................................................................................................................................13

Grand master keys ..............................................................................................................................................15

BlackBerry symmetric key encryption algorithms .............................................................................................15

Standard BlackBerry message encryption......................................................................................................17

Permitting third-party applications to encode BlackBerry device data ........................................................18

BlackBerry wireless messaging security..............................................................................................................18

Receiving an email message on the BlackBerry device................................................................................18

Sending an email message from the BlackBerry device .............................................................................19

Message attachment viewing security features ........................................................................................... 19

PIN-to-PIN messaging......................................................................................................................................20

Text messaging....................................................................................................................................................21

Controlling unsecured messaging ...................................................................................................................21

Extending BlackBerry device messaging security ............................................................................................ 22

PGP Support Package for BlackBerry devices .............................................................................................. 22

PGP encryption................................................................................................................................................... 23

S/MIME Support Package for BlackBerry devices .......................................................................................24

S/MIME encryption............................................................................................................................................25

Decrypting and reading messages on the BlackBerry device using Lotus Notes API 7.0.....................26

Protecting stored data...........................................................................................................................................28

Protecting stored messages on the messaging server ................................................................................28

IT policy signing and storage on the BlackBerry device..............................................................................28

Application password encryption and storage on the BlackBerry device................................................28

Protected storage of external memory on the BlackBerry device .............................................................29

Protected storage of user data on a locked BlackBerry device..................................................................30

Protected storage of master encryption keys on a locked BlackBerry device..........................................31

Protected storage of master encryption keys on a BlackBerry device during a reset.............................31

Clearing the BlackBerry device memory........................................................................................................ 32

BlackBerry Enterprise Solution

BlackBerry architecture component security .................................................................................................... 33

BlackBerry Infrastructure .................................................................................................................................34

BlackBerry Enterprise Server ...........................................................................................................................34

Messaging server ...............................................................................................................................................34

BlackBerry Configuration Database ...............................................................................................................34

Protecting the BlackBerry Enterprise Solution connections...........................................................................36

SRP authentication ............................................................................................................................................ 37

How the BlackBerry Enterprise Server and the BlackBerry Infrastructure handle undeliverable

messages .............................................................................................................................................................38

BlackBerry Router protocol authentication...................................................................................................38

Authentication during wireless enterprise activation .................................................................................39

TCP/IP connection..............................................................................................................................................41

Messaging server to computer email application connection ....................................................................41

Connections between the BlackBerry Desktop Manager and its components .......................................42

BlackBerry MDS connections...........................................................................................................................43

Using two-factor authentication to protect connections to enterprise Wi-Fi networks........................44

How the BlackBerry Enterprise Solution authenticates requests for wireless software upgrades......45

WAP gateway connections ...............................................................................................................................45

Instant messaging server connections...........................................................................................................45

Using segmented network architecture to prevent the spread of malware on your organization’s

network ................................................................................................................................................................46

Protecting Wi-Fi connections to the BlackBerry Enterprise Solution............................................................46

Enterprise Wi-Fi network solution architecture security features.............................................................47

Accessing the BlackBerry Infrastructure .......................................................................................................47

Supported security features of Wi-Fi enabled BlackBerry devices............................................................47

IEEE 802.1X environment components...........................................................................................................48

How the IEEE 802.1x environment controls access to the enterprise Wi-Fi network............................ 49

Administering enterprise Wi-Fi network solution security using IT policy rules.................................... 49

Requiring protected connections to enterprise Wi-Fi networks ............................................................... 49

Using VPNs to protect connections to enterprise Wi-Fi networks.............................................................51

Using enterprise captive portals to protect connections to enterprise Wi-Fi networks or Wi-Fi

hotspots ...............................................................................................................................................................52

Authenticating a BlackBerry device user ...........................................................................................................52

Authenticating a user to a BlackBerry device using a password...............................................................52

Authenticating a BlackBerry device user using a smart card.....................................................................52

Controlling BlackBerry devices............................................................................................................................54

Controlling BlackBerry device behavior using IT policy rules ....................................................................54

BlackBerry Enterprise Solution

Enforcing BlackBerry device and BlackBerry Desktop Software security................................................55

Controlling BlackBerry device access to the BlackBerry Enterprise Server.............................................55

Controlling wireless software upgrades using the BlackBerry Enterprise Server...................................56

Protecting Bluetooth connections on BlackBerry devices ..........................................................................56

Controlling location-based services on the BlackBerry device.................................................................. 57

How the BlackBerry device protects its operating system and the BlackBerry Device Software........58

Protecting the BlackBerry device against malware .....................................................................................58

Protecting lost, stolen, or replaced BlackBerry devices................................................................................... 61

Remotely resetting the password of a content protected BlackBerry device.......................................... 61

Types of remote BlackBerry device wipes......................................................................................................62

Remotely erasing data from BlackBerry device memory and making the BlackBerry device

unavailable ..........................................................................................................................................................63

Remotely resetting a BlackBerry device to factory default settings .........................................................64

Erasing data from BlackBerry device memory and making the BlackBerry device unavailable

(standard security wipe) ...................................................................................................................................64

Unbinding the smart card from the BlackBerry device ...............................................................................65

Related resources.................................................................................................................................................. 66

Appendix A: RIM Crypto API Interface .............................................................................................................. 69

Cryptographic functionality that the RIM Crypto API provides................................................................ 69

Appendix B: TLS and WTLS standards that the RIM Crypto API supports.................................................... 72

Key establishment algorithm cipher suites that the RIM Crypto API supports ...................................... 72

Symmetric algorithms that the RIM Crypto API supports...........................................................................73

Hash algorithms that the RIM Crypto API supports .................................................................................... 73

Appendix C: Previous version of wired master encryption key generation..................................................74

Previous version of wired master encryption key generation process......................................................74

Appendix D: BlackBerry device wipe process.................................................................................................... 75

Memory scrub process for RAM on BlackBerry devices...............................................................................75

Memory scrub process for flash memory on BlackBerry devices...............................................................76

Memory scrub process for flash memory that stores user-saved files on BlackBerry devices .............76

Appendix E: Process for deriving encryption keys that protect the keys used with content protection. 77

Appendix F: Power and electromagnetic side-channel attacks and countermeasures ............................. 78

Masking operation process that the AES implementation uses when content protection is turned on78

Masking operation process that the AES implementation uses when content protection is turned off78

Appendix G: BlackBerry Router protocol ...........................................................................................................80

How the BlackBerry Router protocol uses the Schnorr identification scheme .......................................80

Examples of attacks that the BlackBerry Router protocol is designed to prevent..................................80

Process flow: Using the BlackBerry Router protocol to open an authenticated connection.................81

BlackBerry Enterprise Solution

Process flow: Using the BlackBerry Router protocol to close an authenticated connection................82

Appendix H: Enterprise Wi-Fi security methods that the BlackBerry device supports ..............................83

EAP authentication methods that the BlackBerry device supports...........................................................83

Encryption algorithms that the BlackBerry device supports for use with layer 2 security methods ...84

EAP authentication methods and encryption algorithms with which the BlackBerry device supports

the use of CCKM.................................................................................................................................................85

VPN solution on the Wi-Fi enabled BlackBerry device................................................................................86

Appendix I: Algorithm suites that the BlackBerry device supports for negotiating SSL connections.....86

Appendix J: RSA SecurID software token tokencode generation process....................................................88

Appendix K: Process for content protection initialization ..............................................................................88

Appendix L: Protocol for resetting the password on a content-protected BlackBerry device remotely .89

Cryptosystem parameters.................................................................................................................................89

Protocol process ................................................................................................................................................ 90

BlackBerry Enterprise Solution 6

This document describes the security features of the BlackBerry® Enterprise Solution and provides an overview

of the BlackBerry security architecture.

This document describes the security features that the BlackBerry® Enterprise Server Version 4.1 SP6,

BlackBerry® Desktop Software Version 4.6, and BlackBerry® Device Software Version 4.6 support, unless

otherwise stated. To determine if a feature is supported in an earlier software version, see the documentation for

earlier versions of the BlackBerry Enterprise Server, the BlackBerry Desktop Software, and the BlackBerry Device

Software.

For the full terms substituted by the acronyms in this document, see the BlackBerry Enterprise Solution Security

Acronym Glossary.

Wireless security

Many enterprise organizations realize significant return on investments and productivity gains by extending

access to their enterprise information to mobile employees. With an increased demand for mobile content and

the threat of information theft, organizations have concerns about addressing security needs and requirements

when evaluating wireless solutions. Without an effective security model, your organization might expose

sensitive data, with financial and legal implications.

Powerful personal devices such as mobile phones and personal digital assistants can access and store sensitive

data. Controlling access to these devices is an important issue. Leaving devices with remote access to sensitive

data accessible to potentially malicious users might be dangerous.

The BlackBerry Enterprise Solution (consisting of a BlackBerry device, BlackBerry Device Software, BlackBerry

Desktop Software, and the BlackBerry Enterprise Server) is designed to protect your organization from data loss

or alteration in the event of

•malicious interception of data on your organization’s network, while a BlackBerry device user is sending and

receiving messages and accessing your organization’s data over the wireless network using the BlackBerry

device

•an attack intended to steal your organization’s data, using malicious application code (for example, a virus)

•theft of the BlackBerry device

BlackBerry Enterprise Solution security

The BlackBerry Enterprise Solution implementation of symmetric key cryptography is designed to provide

confidentiality, integrity, and authenticity implicitly.

Concept Description BlackBerry Enterprise Solution implementation

confidentiality permits only the intended

message recipient to view

the contents of a message

Use encryption, which is data scrambling based on a secret

key, to make sure that only the intended recipient can view

the contents of the message.

integrity enables a message

recipient to detect if a third

party altered the message

data in transit between the

message sender and the

message recipient

•Protect each message that the BlackBerry device sends

with one or more message keys comprised of random

information, which is designed to prevent third-party

decryption or alteration of the message data.

•Enable only the BlackBerry Enterprise Server and the

BlackBerry device to know the value of the master

encryption key, recognize the format of the decrypted

and decompressed message, and automatically reject a

message either one receives that is encrypted with the

wrong master encryption key and therefore does not

produce the required message format upon decryption.

www.blackberry.com

BlackBerry Enterprise Solution 7

Concept Description BlackBerry Enterprise Solution implementation

authenticity enables the message

recipient to identify and

trust the identity of the

message sender

Require that the BlackBerry device authenticate itself to the

BlackBerry Enterprise Server to prove that it knows the

master encryption key before the BlackBerry Enterprise

Server can send data to the BlackBerry device.

The BlackBerry Enterprise Solution is designed so that data remains encrypted (in other words, it is not

decrypted) at all points between the BlackBerry device and the BlackBerry Enterprise Server. Only the

BlackBerry Enterprise Server and the BlackBerry device can access the data that they send between them. Thus,

third-parties, including service providers, cannot access potentially sensitive organization information in a

decrypted format.

If the BlackBerry device cannot recognize the message format that the BlackBerry Enterprise Server decryption

process produces, it does not receive the message; if the BlackBerry Enterprise Server receives a message

encrypted with the wrong master encryption key, it does not send the message to the BlackBerry device. If

message failure occurs, the BlackBerry device prompts the BlackBerry device user to generate a new master

encryption key.

BlackBerry Enterprise Solution security features

Feature Description

protect data •Encrypt data traffic in transit between the BlackBerry

Enterprise Server and the BlackBerry device.

•Encrypt data traffic in transit between your organization’s

messaging and collaboration server and a BlackBerry device

user’s computer email application.

•Use secure protocols to connect the BlackBerry Enterprise

Server to the BlackBerry Infrastructure.

•Encrypt data on the BlackBerry device.

•Encrypt data in the BlackBerry Configuration Database.

•Authenticate a BlackBerry device user to the BlackBerry

device using a smart card with a password or passphrase.

•Verify the authenticity and integrity of the BlackBerry

device operating system and BlackBerry Device Software

automatically.

protect encryption keys •Encrypt encryption keys on the BlackBerry device.

control BlackBerry device connections •Control which BlackBerry devices can connect to the

BlackBerry Enterprise Server.

•Control Bluetooth® connections to and from the BlackBerry

device.

•Control BlackBerry Smart Card Reader connections.

•Control Wi-Fi® enabled BlackBerry device connections to

enterprise Wi-Fi networks.

www.blackberry.com

BlackBerry Enterprise Solution 8

Feature Description

control BlackBerry device and BlackBerry

Desktop Software functionality

•Send wireless commands to turn on and turn off BlackBerry

device functionality, delete information from BlackBerry

devices, and lock BlackBerry devices.

•Send IT policies to BlackBerry devices to customize security

settings for BlackBerry device users or groups of BlackBerry

device users on a BlackBerry Enterprise Server.

•Send application control policies to BlackBerry devices to

control third-party application availability and connections.

•Enforce BlackBerry device and BlackBerry Smart Card

Reader passwords.

New security features

Feature Software versions supported Description

Allowing the S/MIME

Support Package for

BlackBerry devices to use

password-based encryption

when sending an S/MIME-

protected email or PIN

message

•BlackBerry Enterprise

Server Version 4.1 SP6 or

later

•BlackBerry Device Software

Version 4.6 or later

On supported BlackBerry devices that have

the S/MIME Support Package for

BlackBerry devices installed and turned on,

the S/MIME Support Package for

BlackBerry devices can use a shared

password known to the message sender and

recipient to encrypt messages.

Allowing the PGP Support

Package for BlackBerry

devices to use PGP key-

only encryption when

sending a PGP protected

email or PIN message

•BlackBerry Enterprise

Server Version 4.1 SP6 or

later

•BlackBerry Device Software

Version 4.6 or later

On supported BlackBerry devices that have

the PGP Support Package for BlackBerry

devices installed and turned on, the PGP

Support Package for BlackBerry devices can

use the PGP key-only, or both types of PGP

encryption, to encrypt messages.

Requiring authentication to

enable the BlackBerry

Device Software to permit

tools to run on BlackBerry

devices

•BlackBerry Device Software

Version 4.6 or later

The RIM tool authentication server enables

the BlackBerry Device Software to permit

tools to run on BlackBerry devices.

BlackBerry devices and the RIM tool

authentication server use a

challenge/response process that is

designed to authenticate communication

between them and prevent users or systems

that do not have authenticated access to

the server from using a USB connection to a

device to run tools.

Verifying that the RIM

bootROM is permitted to

run on BlackBerry devices

•BlackBerry Enterprise

Server Version 4.1 SP6 or

later

•BlackBerry Device Software

Version 4.6 or later

When a user turns on a BlackBerry device,

the processor runs internal ROM code that

reads the RIM bootROM from flash memory

and verifies the digital signature of the

bootROM code using the public keys that

the processor stores. If the verification

process is successful, the bootROM is

permitted to run on the BlackBerry device.

If the verification process fails, the

processor stops running.

www.blackberry.com

BlackBerry Enterprise Solution 9

BlackBerry encryption keys

By default, the BlackBerry Enterprise Solution generates the master encryption key and message key that the

BlackBerry Enterprise Server and BlackBerry devices use to encrypt and decrypt all data traffic between them.

The BlackBerry Enterprise Server administrator can also enable the BlackBerry device to generate and use the

content protection key to encrypt BlackBerry device user data while the BlackBerry device is locked, and

generate and use the grand master key to encrypt the master encryption key while the BlackBerry device is

locked.

Encryption key relationships on the BlackBerry device

Master encryption keys

The master encryption key is unique to the BlackBerry device. To send and receive messages, the master

encryption key stored on the BlackBerry Enterprise Server and on the BlackBerry device must match. If the

stored keys do not match, the BlackBerry device and the BlackBerry Enterprise Server cannot decrypt and must

therefore discard messages that they receive.

Where master encryption keys are stored

The BlackBerry Configuration Database, the messaging server, and the BlackBerry device flash memory store

encryption keys, including the current BlackBerry device master encryption key.

Messaging server platform Messaging server

storage location

BlackBerry device

storage location

BlackBerry Enterprise

Server storage location

IBM® Lotus® Domino® the BlackBerry profiles

database

a key store database in

flash memory

the BlackBerry

Configuration Database

Microsoft® Exchange the computer email

application user mailbox

a key store database in

flash memory

the BlackBerry

Configuration Database

Novell® GroupWise® not stored a key store database in

flash memory

the BlackBerry

Configuration Database

The BlackBerry Configuration Database stores master encryption keys alongside the BlackBerry device user data

that they protect. The BlackBerry Configuration Database, the messaging server, and the BlackBerry device flash

www.blackberry.com

BlackBerry Enterprise Solution 10

memory can also retain previous and pending master encryption keys. It is critical to protect the BlackBerry

Configuration Database and the platform-specific master encryption key storage location on the messaging

server. For more information, see “Messaging server to computer email application connection” on page 41 and

“Protecting the BlackBerry Configuration Database” on page 34.

Key storage on the BlackBerry device

On the BlackBerry device, the shared key is stored in a database in flash memory (the key store). This key storage

method is designed to prevent an attacker from extracting the key data from flash memory successfully by

backing up the data from the BlackBerry device onto a computer.

Key state Description

previous key(s) The master encryption key(s) that the BlackBerry device used before the current key was

generated.

The BlackBerry device stores multiple previous keys in flash memory for 7 days, the

maximum amount of time that the BlackBerry Enterprise Server queues a pending

message for delivery, in case the BlackBerry device user creates a new key on the

BlackBerry device multiple times while messages are still queued on the BlackBerry

Enterprise Server.

The messaging server and the BlackBerry Configuration Database store only the most

recent previous key.

pending key The master encryption key that the BlackBerry Enterprise Server administrator

generates in the BlackBerry Manager to replace the current master encryption key.

Only the messaging server and the BlackBerry Configuration Database store the

pending key. The BlackBerry Desktop Software sends the pending key to the BlackBerry

device when the BlackBerry device user connects the BlackBerry device to the computer.

The current key then becomes the new previous key, and the pending key becomes the

new current key.

How the messaging server storage location stores the master encryption keys

The Microsoft Exchange server stores the master encryption keys in a hidden folder named

BlackBerryHandheldInfo within a root folder of the BlackBerry device user's computer email application mailbox.

The BlackBerryHandheldInfo folder stores the following data:

•a message of class RIM.BlackBerry.Handheld.Config containing the BlackBerry device user's configuration

information, including the master encryption key data

•the master encryption keys in binary form with tags that indicate their state: 0x6002 (pending), 0x6003

(current), and 0x6004 (previous)

The IBM Lotus Domino server stores the master encryption keys in a database named BlackBerryProfiles.nsf that

contains configuration information for every BlackBerry device user within the /Data directory. The BlackBerry

Profiles database stores an account record containing the field RIMCurrentEncryptionKeyText, which stores the

master encryption keys in alphanumeric representation of a hexadecimal string, for every BlackBerry device user.

How master encryption keys are generated

Both the BlackBerry Enterprise Server administrator and a BlackBerry device user can generate and regenerate

master encryption keys. By default, the BlackBerry Enterprise Server sends a request to the BlackBerry Desktop

Software every 31 days to prompt users to regenerate the master encryption key on their BlackBerry devices. If

the user sets the Generate keys manually option in the BlackBerry Desktop Manager, the BlackBerry Enterprise

Server still sends a key regeneration request to the BlackBerry Desktop Software automatically.

www.blackberry.com

This manual suits for next models

Table of contents

Other Blackbe;rry Software manuals

Blackbe;rry

Blackbe;rry ENTERPRISE SERVER FOR MICROSOFT EXCHANGE - CALENDAR SYNCHRONIZATION TOOL - TECHNICAL... User manual

Blackbe;rry

Blackbe;rry AOL INSTANT MESSENGER SERVICE FOR... User manual

Blackbe;rry

Blackbe;rry CLIENT FOR IBM LOTUS SAMETIME - V2.5 User manual

Blackbe;rry

Blackbe;rry INTERNET SERVICE - FEATURE AND TECHNICAL OVERVIEW... Installation guide

Blackbe;rry

Blackbe;rry CLIENT FOR USE WITH MICROSOFT OFFICE LIVE COMMUNICATIONS SERVER 2005 - KNOWN ISSUES... User manual

Blackbe;rry

Blackbe;rry TWITTER - LEARN MORE User manual

Blackbe;rry

Blackbe;rry MEDIA SYNC - - RELEASE NOTES Instruction Manual

Blackbe;rry

Blackbe;rry ENTERPRISE SOLUTION SECURITY - ERASING FILE SYSTEMS ON DEVICES -... Installation guide

Blackbe;rry

Blackbe;rry FACEBOOK FOR BLACKBERRY SMARTPHONES 1.9 - RELEASE... User manual

Blackbe;rry

Blackbe;rry WALLET - LEARN MORE User manual

Blackbe;rry

Blackbe;rry AMAZON MP3 - V1.0 User manual

Blackbe;rry

Blackbe;rry ICQ - RELEASE NOTES V2.5 Instruction Manual

Blackbe;rry

Blackbe;rry MAIL - BROWSING SMARTPHONE User manual

Blackbe;rry

Blackbe;rry GOOGLE TALK - LEARN MORE User manual

Blackbe;rry

Blackbe;rry AOL INSTANT MESSENGER - SPORT CASE User manual

Blackbe;rry

Blackbe;rry GOOGLE TALK FOR BLACKBERRY SMARTPHONES 2.5 - RELEASE... Instruction Manual

Blackbe;rry

Blackbe;rry S-MIME SUPPORT PACKAGE VERSION 4.1 - Instruction Manual

Blackbe;rry

Blackbe;rry 9000 - Bold User manual

Blackbe;rry

Blackbe;rry CLIENT FOR USE WITH MICROSOFT OFFICE COMMUNICATIONS SERVER 2007 2.5.40 -... Instruction Manual

Blackbe;rry

Blackbe;rry WINDOWS LIVE MESSENGER - LEARN MORE User manual

Blackbe;rry

Blackbe;rry CLIENT FOR USE WITH MICROSOFT OFFICE COMMUNICATIONS SERVER... User manual

Blackbe;rry

Blackbe;rry ENHANCED GOOGLE MAIL PLUG IN - LEARN MORE User manual

Blackbe;rry

Blackbe;rry CLIENT FOR IBM LOTUS SAMETIME - S V.2.5.20 Instruction Manual

Blackbe;rry

Blackbe;rry Messenger User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual

Blackbe;rry ENTERPRISE SOLUTION SECURITY - ENTERPRISE SOLUTION - SECURITY... Installation guide

Popular Software manuals by other brands