Blackbe;rry ENTERPRISE SOLUTION SECURITY - ENFORCING ENCRYPTION OF INTERNAL AND EXTERNAL FILE SYSTEMS ON ... User manual

Enforcing encryption of internal and external
file systems on BlackBerry devices
Technical Overview
©2008 Research In Motion Limited. All rights reserved. www.blackberry.com

Enforcing encryption of internal and external file systems on BlackBerry devices
Contents
Data that BlackBerry devices encrypt by default ................................................................................................ 1
System requirements for file encryption on BlackBerry devices....................................................................... 1
Using encryption to protect stored files on BlackBerry devices ....................................................................... 1
IT policy requirements for encryption of stored files on BlackBerry devices................................................. 3
Data that the BlackBerry device can encrypt in internal memory................................................................... 3
Protecting user data stored on a locked BlackBerry device.............................................................................. 4
Turning on protected storage of BlackBerry device data in internal memory........................................... 4
Guidelines for setting the internal memory encryption level....................................................................... 4
Protecting files stored in external memory on the BlackBerry device ............................................................ 4
Setting the external memory encryption level................................................................................................ 5
Turning on external memory encryption.......................................................................................................... 5
Transferring encrypted media files................................................................................................................... 5
Moving the media card to a different BlackBerry device.............................................................................. 5
Controlling access to objects in external memory .........................................................................................6
Protecting master encryption keys on a locked BlackBerry device.................................................................6
©2008 Research In Motion Limited. All rights reserved. www.blackberry.com

Enforcing encryption of internal and external file systems on BlackBerry devices 1
Data that BlackBerry devices encrypt by default
The BlackBerry® Enterprise Solution encrypts data traffic in transit between the BlackBerry® Enterprise Server
and the BlackBerry devices automatically. By default, the BlackBerry Enterprise Solution generates the master
encryption key and message key that the BlackBerry Enterprise Server and BlackBerry devices use to encrypt and
decrypt all data traffic between them.
For more information about how the BlackBerry Enterprise Solution encrypts data traffic in transit, see the
BlackBerry Enterprise Solution Security Technical Overview.
System requirements for file encryption on BlackBerry devices
Internal files External files Master encryption keys
Java® based BlackBerry devices
that run BlackBerry® Device
Software Version 4.0 or later
•BlackBerry Enterprise Server
Version 4.0 SP6 or later
•Java based BlackBerry devices
that support external file
storage using a media card
(BlackBerry devices that run
BlackBerry Device Software
Version 4.2 or later)
•BlackBerry Enterprise Server
Version 4.0 SP3 or later
•Java based BlackBerry devices
that run BlackBerry Device
Software Version 4.1 or later
Using encryption to protect stored files on BlackBerry devices
You can configure the following options on the BlackBerry Enterprise Server to turn on encryption of stored files
on supported BlackBerry devices.
Internal files External files Master encryption keys
To require BlackBerry devices on
the organization’s BlackBerry
Enterprise Servers to encrypt user
and application data that the
BlackBerry devices store in
internal memory using content
protection, turn on the content
protection process on BlackBerry
devices using the Content
Protection Strength IT policy rule
in the BlackBerry Manager.
To require BlackBerry devices to
encrypt files stored on media
cards, turn on encryption on the
external memory cards using the
External File System Encryption
Level IT policy rule.
To require BlackBerry devices to
encrypt the master encryption
keys that they use to encrypt data
stored in internal file systems, set
the Force Content Protection of
Master Keys IT policy rule.
Note: When you turn on content
protection of master encryption
keys, the BlackBerry device uses
the same encryption key strength
that it uses to encrypt internal file
systems when encrypting the
master encryption keys.
©2008 Research In Motion Limited. All rights reserved. www.blackberry.com

2Enforcing encryption of internal and external file systems on BlackBerry devices
Users can configure the following options to turn on encryption of stored files on their supported BlackBerry
devices.
Internal files External files Master encryption keys
Turn on the Content
Protection option
(Options > Security
Options > General
Settings).
1. Turn on Media Card Support (Options >
Media Card or Options > Memory > Media
Card Support).
2. Set the encryption mode for the external file
system. The BlackBerry device encrypts files
stored in the /BlackBerry/documents/ folder
and any user-created folders on the media
card.
3. Choose whether to encrypt media files in
external memory only on the device.
•BlackBerry Device Software version 4.7 or
later: If you set the Encrypt Media Files
option to Yes, the BlackBerry device
encrypts all files that have an audio,
image, or video MIME type, excluding
OMA DRM file types (.dcf, .odf, .o4a and
.o4v).
•BlackBerry Device Software version
earlier than 4.7: If you set the Encrypt
Media Files option to Yes, the BlackBerry
device encrypts files according to the
folders they are stored in on the media
card (/BlackBerry/videos/,
/BlackBerry/music/,
/BlackBerry/pictures/,
/BlackBerry/ringtones/ and
/BlackBerry/voicenotes/).
Note: The BlackBerry device does not encrypt files
transferred using USB while the Mass Storage
Mode Support option is turned on, or OMA DRM
files. OMA DRM files are protected using the OMA
DRM standard.
This option is not available
for control by BlackBerry
device users.
For more information about how BlackBerry devices can encrypt stored data, see the BlackBerry Enterprise
Solution Security Technical Overview.
©2008 Research In Motion Limited. All rights reserved. www.blackberry.com

Enforcing encryption of internal and external file systems on BlackBerry devices 3
IT policy requirements for encryption of stored files on BlackBerry devices
Internal files External files Master encryption keys
Set the Content Protection
Strength IT policy rule to the
minimum strength level required.
The user can set the Content
Protection Strength option to a
higher level on the BlackBerry
device.
•Set the External File System
Encryption Level IT policy rule
to the minimum encryption
level required. The user can
set the Encryption Mode
option to a higher level on the
BlackBerry device.
•Set the Disable USB Mass
Storage IT policy rule to True
to prevent the user from
turning on Mass Storage
Mode on the BlackBerry
device. The BlackBerry device
does not encrypt external file
on the media card when mass
storage mode is turned on.
Note: The Disable External
Memory IT policy rule should be
unchanged from the default value,
or explicitly set to False.
Set the Force Content Protection
of Master IT policy rule to the
minimum strength level required.
See the Policy Reference Guide for more information about using IT policy rules.
Data that the BlackBerry device can encrypt in internal memory
When you or BlackBerry device users turn on content protection on BlackBerry devices, the BlackBerry devices
encrypt the following user data items:
Item Description
AutoText all text that automatically replaces the text a BlackBerry device user types
BlackBerry Browser •content that web sites or third-party applications push to the
BlackBerry device
•web sites that the user saves on the BlackBerry device
•browser cache
calendar •subject
•location
•organizer
•attendees
•notes included in the appointment or meeting request
contacts (in the address book) all information except the contact title and category
Note: Set the Force Include Address Book In Content Protection IT policy
rule to True to prevent the BlackBerry device user from turning off the
Include Address Book option on the BlackBerry device. The BlackBerry
device permits the Caller ID and Bluetooth Address Book transfer features
to work when content protection is turned on and the BlackBerry device is
locked.
©2008 Research In Motion Limited. All rights reserved. www.blackberry.com

4Enforcing encryption of internal and external file systems on BlackBerry devices
Item Description
Email •subject
•email addresses
•message body
•attachments
memo list •title
•information included in the body of the note
OMA DRM applications a key identifying the BlackBerry device and a key identifying the SIM card
(if available) that the BlackBerry device adds to DRM forward-locked
applications
RSA SecurID Library the contents of the .sdtid file seed stored in flash memory
tasks •subject
•information included in the body of the task
Protecting user data stored on a locked BlackBerry device
If content protection is turned on, on BlackBerry devices, user data that the BlackBerry devices store is always
protected with the 256-bit AES encryption algorithm. Content protection of BlackBerry device user data is
designed to perform the following actions:
•use a 256-bit AES content protection key to encrypt stored data when the BlackBerry device is locked
•use an ECC public key to encrypt data that the BlackBerry device receives when it is locked
Turning on protected storage of BlackBerry device data in internal memory
You turn on protected storage of data on the BlackBerry device by setting the Content Protection Strength IT
policy rule. You should choose a strength level that corresponds to the desired ECC key strength.
If a BlackBerry device user turns on content protection on the BlackBerry device, in the BlackBerry device
Security Options, the BlackBerry device user can set the content protection strength to the same levels that you
can set using the Content Protection Strength IT policy rule.
Guidelines for setting the internal memory encryption level
When the content-protected BlackBerry device decrypts a message that it received while locked, the BlackBerry
device uses the ECC private key in the decryption operation. The longer the ECC key, the more time the ECC
decryption operation adds to the BlackBerry device decryption process. Choose a content protection strength
level that optimizes either the ECC encryption strength or the decryption time.
If you set the content protection strength to Stronger (to use a 283-bit ECC key) or to Strongest (to use a 571-bit
ECC key), consider setting the Minimum Password Length IT policy rule to enforce a minimum BlackBerry device
password length of 12 characters or 21 characters, respectively. These password lengths maximize the encryption
strength that the longer ECC keys are designed to provide. The BlackBerry device uses the BlackBerry device
password to generate the ephemeral 256-bit AES encryption key that the BlackBerry device uses to encrypt the
content protection key and the ECC private key. A weak password produces a weak ephemeral key.
Protecting files stored in external memory on the BlackBerry device
The BlackBerry device is designed to prevent a third-party device from using the media card by encrypting
multimedia data that it stores on an external memory device according to the External File System Encryption
Level IT policy rule setting, or the corresponding BlackBerry device setting.
The BlackBerry device is designed to support the following features:
©2008 Research In Motion Limited. All rights reserved. www.blackberry.com

Enforcing encryption of internal and external file systems on BlackBerry devices 5
•external file encryption by encrypting specific files on the external memory device using AES
Note: The external file system encryption does not apply to files that the BlackBerry device user manually
transfers to external memory (for example, from a USB mass storage device).
•access control to objects on the external memory device using code signing with 1024-bit RSA
The external memory device stores encrypted copies of the file keys that the BlackBerry device is designed to use
to decrypt and encrypt files on the external memory device. The BlackBerry device is designed to use a randomly
generated device key stored in the NV store in BlackBerry device RAM, the BlackBerry device password, or both
to encrypt the external memory file keys.
Setting the external memory encryption level
The administrator can use the External File System Encryption Level IT policy rule to enforce a minimum level of
encryption for the external file system. If the IT policy rule is set, the BlackBerry device user can set the
encryption mode to any encryption level stronger than the minimum.
Encryption mode Description
Device The BlackBerry device uses a randomly generated device key to encrypt the
external file system to encrypt the external file system.
Security Password The BlackBerry device uses the BlackBerry device password to encrypt the
external file system. Turning on this option turns on the password prompt on
the BlackBerry device automatically. The BlackBerry device then requires the
user to set a BlackBerry device password if one does not exist already.
Security Password & Device The BlackBerry device uses the randomly generated device key and the
BlackBerry device password to encrypt the external file system. Turning on
this option requires the user to set a BlackBerry device password if one does
not exist already.
Turning on external memory encryption
When the BlackBerry device user stores a file in external memory for the first time after the BlackBerry Enterprise
Server administrator turns on or the BlackBerry device user turns on mass storage mode, the BlackBerry
device decrypts the external memory file encryption key and uses it to automatically encrypt the stored file.
Transferring encrypted media files
The user can connect the BlackBerry device to the computer to transfer files between the device and the
computer, or use Bluetooth® technology to send media files to or receive media files from a Bluetooth enabled
device.
Turning on the mass storage mode option on the BlackBerry device allows the user to transfer files quickly over a
USB connection between the media card and the computer without using the media manager tool of the
BlackBerry Desktop Manager. When the user transfers files to the media card using mass storage mode, the
device does not encrypt the transferred files using mass storage mode even if the BlackBerry device is set to
encrypt files stored on the media card. If the user transfers encrypted files from the media card using mass
storage mode, the computer cannot decrypt the transferred files using mass storage mode.
Moving the media card to a different BlackBerry device
If the user removes the media card from the BlackBerry device and places it in a new BlackBerry device, the new
BlackBerry device cannot decrypt any files that the first BlackBerry device encrypted on the media card using a
randomly generated device key. If the first BlackBerry device encrypted the files on the media card using the
BlackBerry device password, when the user removes the media card from the BlackBerry device and places it in a
new BlackBerry device, the new BlackBerry device prompts the user for the password used on the first BlackBerry
device to access the files on the new device.
©2008 Research In Motion Limited. All rights reserved. www.blackberry.com

6Enforcing encryption of internal and external file systems on BlackBerry devices
Controlling access to objects in external memory
The BlackBerry device is designed to permit code signing keys in the header information of each encrypted file
on the external memory device. The BlackBerry device is designed to check the code signing keys when the
BlackBerry device opens the input or output streams of the encrypted files.
The BlackBerry device, any computer platform, and other devices that use the external memory device can
modify encrypted files (for example, truncate files) on the external memory device. The BlackBerry device is not
designed to perform integrity checks on the encrypted file data.
Protecting master encryption keys on a locked BlackBerry device
If you turn on content protection of master encryption keys, the BlackBerry device uses the grand master key to
encrypt the master encryption keys stored in flash memory and encrypts the grand master key using the content
protection key. When the BlackBerry device receives data encrypted with a master encryption key while it is
locked, it uses the decrypted grand master key to decrypt the required master encryption key in flash memory,
and uses the decrypted master encryption key to decrypt and receive the data.
The BlackBerry device stores the decrypted master encryption keys and the decrypted grand master key in RAM
only. When you, the BlackBerry device user, or a set password timeout locks the BlackBerry device, the wireless
transceiver remains on and the BlackBerry device does not clear the RAM associated with these keys. The
BlackBerry device is designed to prevent the decrypted grand master keys and the decrypted master encryption
keys from appearing in flash memory.
©2008 Research In Motion Limited. All rights reserved. www.blackberry.com