Blackbe;rry ENTERPRISE SOLUTION SECURITY - ENTERPRISE SOLUTION - SECURITY... Installation guide

BlackBerry Enterprise Solution
Security Technical Overview
for BlackBerry Enterprise Server Version 4.1 Service Pack 6 and BlackBerry
Device Software Version 4.6
©2009 Research In Motion Limited. All rights reserved. www.blackberry.com

BlackBerry Enterprise Solution
Contents
Wireless security.......................................................................................................................................................6
BlackBerry Enterprise Solution security ...............................................................................................................6
BlackBerry Enterprise Solution security features........................................................................................... 7
New security features.......................................................................................................................................... 8
BlackBerry encryption keys ....................................................................................................................................9
Master encryption keys.......................................................................................................................................9
Message keys.......................................................................................................................................................12
Content protection keys.....................................................................................................................................13
Grand master keys ..............................................................................................................................................15
BlackBerry symmetric key encryption algorithms .............................................................................................15
Standard BlackBerry message encryption......................................................................................................17
Permitting third-party applications to encode BlackBerry device data ........................................................18
BlackBerry wireless messaging security..............................................................................................................18
Receiving an email message on the BlackBerry device................................................................................18
Sending an email message from the BlackBerry device .............................................................................19
Message attachment viewing security features ........................................................................................... 19
PIN-to-PIN messaging......................................................................................................................................20
Text messaging....................................................................................................................................................21
Controlling unsecured messaging ...................................................................................................................21
Extending BlackBerry device messaging security ............................................................................................ 22
PGP Support Package for BlackBerry devices .............................................................................................. 22
PGP encryption................................................................................................................................................... 23
S/MIME Support Package for BlackBerry devices .......................................................................................24
S/MIME encryption............................................................................................................................................25
Decrypting and reading messages on the BlackBerry device using Lotus Notes API 7.0.....................26
Protecting stored data...........................................................................................................................................28
Protecting stored messages on the messaging server ................................................................................28
IT policy signing and storage on the BlackBerry device..............................................................................28
Application password encryption and storage on the BlackBerry device................................................28
Protected storage of external memory on the BlackBerry device .............................................................29
Protected storage of user data on a locked BlackBerry device..................................................................30
Protected storage of master encryption keys on a locked BlackBerry device..........................................31
Protected storage of master encryption keys on a BlackBerry device during a reset.............................31
Clearing the BlackBerry device memory........................................................................................................ 32
©2009 Research In Motion Limited. All rights reserved. www.blackberry.com

BlackBerry Enterprise Solution
BlackBerry architecture component security .................................................................................................... 33
BlackBerry Infrastructure .................................................................................................................................34
BlackBerry Enterprise Server ...........................................................................................................................34
Messaging server ...............................................................................................................................................34
BlackBerry Configuration Database ...............................................................................................................34
Protecting the BlackBerry Enterprise Solution connections...........................................................................36
SRP authentication ............................................................................................................................................ 37
How the BlackBerry Enterprise Server and the BlackBerry Infrastructure handle undeliverable
messages .............................................................................................................................................................38
BlackBerry Router protocol authentication...................................................................................................38
Authentication during wireless enterprise activation .................................................................................39
TCP/IP connection..............................................................................................................................................41
Messaging server to computer email application connection ....................................................................41
Connections between the BlackBerry Desktop Manager and its components .......................................42
BlackBerry MDS connections...........................................................................................................................43
Using two-factor authentication to protect connections to enterprise Wi-Fi networks........................44
How the BlackBerry Enterprise Solution authenticates requests for wireless software upgrades......45
WAP gateway connections ...............................................................................................................................45
Instant messaging server connections...........................................................................................................45
Using segmented network architecture to prevent the spread of malware on your organization’s
network ................................................................................................................................................................46
Protecting Wi-Fi connections to the BlackBerry Enterprise Solution............................................................46
Enterprise Wi-Fi network solution architecture security features.............................................................47
Accessing the BlackBerry Infrastructure .......................................................................................................47
Supported security features of Wi-Fi enabled BlackBerry devices............................................................47
IEEE 802.1X environment components...........................................................................................................48
How the IEEE 802.1x environment controls access to the enterprise Wi-Fi network............................ 49
Administering enterprise Wi-Fi network solution security using IT policy rules.................................... 49
Requiring protected connections to enterprise Wi-Fi networks ............................................................... 49
Using VPNs to protect connections to enterprise Wi-Fi networks.............................................................51
Using enterprise captive portals to protect connections to enterprise Wi-Fi networks or Wi-Fi
hotspots ...............................................................................................................................................................52
Authenticating a BlackBerry device user ...........................................................................................................52
Authenticating a user to a BlackBerry device using a password...............................................................52
Authenticating a BlackBerry device user using a smart card.....................................................................52
Controlling BlackBerry devices............................................................................................................................54
Controlling BlackBerry device behavior using IT policy rules ....................................................................54
©2009 Research In Motion Limited. All rights reserved. www.blackberry.com

BlackBerry Enterprise Solution
Enforcing BlackBerry device and BlackBerry Desktop Software security................................................55
Controlling BlackBerry device access to the BlackBerry Enterprise Server.............................................55
Controlling wireless software upgrades using the BlackBerry Enterprise Server...................................56
Protecting Bluetooth connections on BlackBerry devices ..........................................................................56
Controlling location-based services on the BlackBerry device.................................................................. 57
How the BlackBerry device protects its operating system and the BlackBerry Device Software........58
Protecting the BlackBerry device against malware .....................................................................................58
Protecting lost, stolen, or replaced BlackBerry devices................................................................................... 61
Remotely resetting the password of a content protected BlackBerry device.......................................... 61
Types of remote BlackBerry device wipes......................................................................................................62
Remotely erasing data from BlackBerry device memory and making the BlackBerry device
unavailable ..........................................................................................................................................................63
Remotely resetting a BlackBerry device to factory default settings .........................................................64
Erasing data from BlackBerry device memory and making the BlackBerry device unavailable
(standard security wipe) ...................................................................................................................................64
Unbinding the smart card from the BlackBerry device ...............................................................................65
Related resources.................................................................................................................................................. 66
Appendix A: RIM Crypto API Interface .............................................................................................................. 69
Cryptographic functionality that the RIM Crypto API provides................................................................ 69
Appendix B: TLS and WTLS standards that the RIM Crypto API supports.................................................... 72
Key establishment algorithm cipher suites that the RIM Crypto API supports ...................................... 72
Symmetric algorithms that the RIM Crypto API supports...........................................................................73
Hash algorithms that the RIM Crypto API supports .................................................................................... 73
Appendix C: Previous version of wired master encryption key generation..................................................74
Previous version of wired master encryption key generation process......................................................74
Appendix D: BlackBerry device wipe process.................................................................................................... 75
Memory scrub process for RAM on BlackBerry devices...............................................................................75
Memory scrub process for flash memory on BlackBerry devices...............................................................76
Memory scrub process for flash memory that stores user-saved files on BlackBerry devices .............76
Appendix E: Process for deriving encryption keys that protect the keys used with content protection. 77
Appendix F: Power and electromagnetic side-channel attacks and countermeasures ............................. 78
Masking operation process that the AES implementation uses when content protection is turned on78
Masking operation process that the AES implementation uses when content protection is turned off78
Appendix G: BlackBerry Router protocol ...........................................................................................................80
How the BlackBerry Router protocol uses the Schnorr identification scheme .......................................80
Examples of attacks that the BlackBerry Router protocol is designed to prevent..................................80
Process flow: Using the BlackBerry Router protocol to open an authenticated connection.................81
©2009 Research In Motion Limited. All rights reserved. www.blackberry.com

BlackBerry Enterprise Solution
Process flow: Using the BlackBerry Router protocol to close an authenticated connection................82
Appendix H: Enterprise Wi-Fi security methods that the BlackBerry device supports ..............................83
EAP authentication methods that the BlackBerry device supports...........................................................83
Encryption algorithms that the BlackBerry device supports for use with layer 2 security methods ...84
EAP authentication methods and encryption algorithms with which the BlackBerry device supports
the use of CCKM.................................................................................................................................................85
VPN solution on the Wi-Fi enabled BlackBerry device................................................................................86
Appendix I: Algorithm suites that the BlackBerry device supports for negotiating SSL connections.....86
Appendix J: RSA SecurID software token tokencode generation process....................................................88
Appendix K: Process for content protection initialization ..............................................................................88
Appendix L: Protocol for resetting the password on a content-protected BlackBerry device remotely .89
Cryptosystem parameters.................................................................................................................................89
Protocol process ................................................................................................................................................ 90
©2009 Research In Motion Limited. All rights reserved. www.blackberry.com

BlackBerry Enterprise Solution 6
This document describes the security features of the BlackBerry® Enterprise Solution and provides an overview
of the BlackBerry security architecture.
This document describes the security features that the BlackBerry® Enterprise Server Version 4.1 SP6,
BlackBerry® Desktop Software Version 4.6, and BlackBerry® Device Software Version 4.6 support, unless
otherwise stated. To determine if a feature is supported in an earlier software version, see the documentation for
earlier versions of the BlackBerry Enterprise Server, the BlackBerry Desktop Software, and the BlackBerry Device
Software.
For the full terms substituted by the acronyms in this document, see the BlackBerry Enterprise Solution Security
Acronym Glossary.
Wireless security
Many enterprise organizations realize significant return on investments and productivity gains by extending
access to their enterprise information to mobile employees. With an increased demand for mobile content and
the threat of information theft, organizations have concerns about addressing security needs and requirements
when evaluating wireless solutions. Without an effective security model, your organization might expose
sensitive data, with financial and legal implications.
Powerful personal devices such as mobile phones and personal digital assistants can access and store sensitive
data. Controlling access to these devices is an important issue. Leaving devices with remote access to sensitive
data accessible to potentially malicious users might be dangerous.
The BlackBerry Enterprise Solution (consisting of a BlackBerry device, BlackBerry Device Software, BlackBerry
Desktop Software, and the BlackBerry Enterprise Server) is designed to protect your organization from data loss
or alteration in the event of
•malicious interception of data on your organization’s network, while a BlackBerry device user is sending and
receiving messages and accessing your organization’s data over the wireless network using the BlackBerry
device
•an attack intended to steal your organization’s data, using malicious application code (for example, a virus)
•theft of the BlackBerry device
BlackBerry Enterprise Solution security
The BlackBerry Enterprise Solution implementation of symmetric key cryptography is designed to provide
confidentiality, integrity, and authenticity implicitly.
Concept Description BlackBerry Enterprise Solution implementation
confidentiality permits only the intended
message recipient to view
the contents of a message
Use encryption, which is data scrambling based on a secret
key, to make sure that only the intended recipient can view
the contents of the message.
integrity enables a message
recipient to detect if a third
party altered the message
data in transit between the
message sender and the
message recipient
•Protect each message that the BlackBerry device sends
with one or more message keys comprised of random
information, which is designed to prevent third-party
decryption or alteration of the message data.
•Enable only the BlackBerry Enterprise Server and the
BlackBerry device to know the value of the master
encryption key, recognize the format of the decrypted
and decompressed message, and automatically reject a
message either one receives that is encrypted with the
wrong master encryption key and therefore does not
produce the required message format upon decryption.
www.blackberry.com

BlackBerry Enterprise Solution 7
Concept Description BlackBerry Enterprise Solution implementation
authenticity enables the message
recipient to identify and
trust the identity of the
message sender
Require that the BlackBerry device authenticate itself to the
BlackBerry Enterprise Server to prove that it knows the
master encryption key before the BlackBerry Enterprise
Server can send data to the BlackBerry device.
The BlackBerry Enterprise Solution is designed so that data remains encrypted (in other words, it is not
decrypted) at all points between the BlackBerry device and the BlackBerry Enterprise Server. Only the
BlackBerry Enterprise Server and the BlackBerry device can access the data that they send between them. Thus,
third-parties, including service providers, cannot access potentially sensitive organization information in a
decrypted format.
If the BlackBerry device cannot recognize the message format that the BlackBerry Enterprise Server decryption
process produces, it does not receive the message; if the BlackBerry Enterprise Server receives a message
encrypted with the wrong master encryption key, it does not send the message to the BlackBerry device. If
message failure occurs, the BlackBerry device prompts the BlackBerry device user to generate a new master
encryption key.
BlackBerry Enterprise Solution security features
Feature Description
protect data •Encrypt data traffic in transit between the BlackBerry
Enterprise Server and the BlackBerry device.
•Encrypt data traffic in transit between your organization’s
messaging and collaboration server and a BlackBerry device
user’s computer email application.
•Use secure protocols to connect the BlackBerry Enterprise
Server to the BlackBerry Infrastructure.
•Encrypt data on the BlackBerry device.
•Encrypt data in the BlackBerry Configuration Database.
•Authenticate a BlackBerry device user to the BlackBerry
device using a smart card with a password or passphrase.
•Verify the authenticity and integrity of the BlackBerry
device operating system and BlackBerry Device Software
automatically.
protect encryption keys •Encrypt encryption keys on the BlackBerry device.
control BlackBerry device connections •Control which BlackBerry devices can connect to the
BlackBerry Enterprise Server.
•Control Bluetooth® connections to and from the BlackBerry
device.
•Control BlackBerry Smart Card Reader connections.
•Control Wi-Fi® enabled BlackBerry device connections to
enterprise Wi-Fi networks.
www.blackberry.com

BlackBerry Enterprise Solution 8
Feature Description
control BlackBerry device and BlackBerry
Desktop Software functionality
•Send wireless commands to turn on and turn off BlackBerry
device functionality, delete information from BlackBerry
devices, and lock BlackBerry devices.
•Send IT policies to BlackBerry devices to customize security
settings for BlackBerry device users or groups of BlackBerry
device users on a BlackBerry Enterprise Server.
•Send application control policies to BlackBerry devices to
control third-party application availability and connections.
•Enforce BlackBerry device and BlackBerry Smart Card
Reader passwords.
New security features
Feature Software versions supported Description
Allowing the S/MIME
Support Package for
BlackBerry devices to use
password-based encryption
when sending an S/MIME-
protected email or PIN
message
•BlackBerry Enterprise
Server Version 4.1 SP6 or
later
•BlackBerry Device Software
Version 4.6 or later
On supported BlackBerry devices that have
the S/MIME Support Package for
BlackBerry devices installed and turned on,
the S/MIME Support Package for
BlackBerry devices can use a shared
password known to the message sender and
recipient to encrypt messages.
Allowing the PGP Support
Package for BlackBerry
devices to use PGP key-
only encryption when
sending a PGP protected
email or PIN message
•BlackBerry Enterprise
Server Version 4.1 SP6 or
later
•BlackBerry Device Software
Version 4.6 or later
On supported BlackBerry devices that have
the PGP Support Package for BlackBerry
devices installed and turned on, the PGP
Support Package for BlackBerry devices can
use the PGP key-only, or both types of PGP
encryption, to encrypt messages.
Requiring authentication to
enable the BlackBerry
Device Software to permit
tools to run on BlackBerry
devices
•BlackBerry Device Software
Version 4.6 or later
The RIM tool authentication server enables
the BlackBerry Device Software to permit
tools to run on BlackBerry devices.
BlackBerry devices and the RIM tool
authentication server use a
challenge/response process that is
designed to authenticate communication
between them and prevent users or systems
that do not have authenticated access to
the server from using a USB connection to a
device to run tools.
Verifying that the RIM
bootROM is permitted to
run on BlackBerry devices
•BlackBerry Enterprise
Server Version 4.1 SP6 or
later
•BlackBerry Device Software
Version 4.6 or later
When a user turns on a BlackBerry device,
the processor runs internal ROM code that
reads the RIM bootROM from flash memory
and verifies the digital signature of the
bootROM code using the public keys that
the processor stores. If the verification
process is successful, the bootROM is
permitted to run on the BlackBerry device.
If the verification process fails, the
processor stops running.
www.blackberry.com

BlackBerry Enterprise Solution 9
BlackBerry encryption keys
By default, the BlackBerry Enterprise Solution generates the master encryption key and message key that the
BlackBerry Enterprise Server and BlackBerry devices use to encrypt and decrypt all data traffic between them.
The BlackBerry Enterprise Server administrator can also enable the BlackBerry device to generate and use the
content protection key to encrypt BlackBerry device user data while the BlackBerry device is locked, and
generate and use the grand master key to encrypt the master encryption key while the BlackBerry device is
locked.
Encryption key relationships on the BlackBerry device
Master encryption keys
The master encryption key is unique to the BlackBerry device. To send and receive messages, the master
encryption key stored on the BlackBerry Enterprise Server and on the BlackBerry device must match. If the
stored keys do not match, the BlackBerry device and the BlackBerry Enterprise Server cannot decrypt and must
therefore discard messages that they receive.
Where master encryption keys are stored
The BlackBerry Configuration Database, the messaging server, and the BlackBerry device flash memory store
encryption keys, including the current BlackBerry device master encryption key.
Messaging server platform Messaging server
storage location
BlackBerry device
storage location
BlackBerry Enterprise
Server storage location
IBM® Lotus® Domino® the BlackBerry profiles
database
a key store database in
flash memory
the BlackBerry
Configuration Database
Microsoft® Exchange the computer email
application user mailbox
a key store database in
flash memory
the BlackBerry
Configuration Database
Novell® GroupWise® not stored a key store database in
flash memory
the BlackBerry
Configuration Database
The BlackBerry Configuration Database stores master encryption keys alongside the BlackBerry device user data
that they protect. The BlackBerry Configuration Database, the messaging server, and the BlackBerry device flash
www.blackberry.com

BlackBerry Enterprise Solution 10
memory can also retain previous and pending master encryption keys. It is critical to protect the BlackBerry
Configuration Database and the platform-specific master encryption key storage location on the messaging
server. For more information, see “Messaging server to computer email application connection” on page 41 and
“Protecting the BlackBerry Configuration Database” on page 34.
Key storage on the BlackBerry device
On the BlackBerry device, the shared key is stored in a database in flash memory (the key store). This key storage
method is designed to prevent an attacker from extracting the key data from flash memory successfully by
backing up the data from the BlackBerry device onto a computer.
Key state Description
previous key(s) The master encryption key(s) that the BlackBerry device used before the current key was
generated.
The BlackBerry device stores multiple previous keys in flash memory for 7 days, the
maximum amount of time that the BlackBerry Enterprise Server queues a pending
message for delivery, in case the BlackBerry device user creates a new key on the
BlackBerry device multiple times while messages are still queued on the BlackBerry
Enterprise Server.
The messaging server and the BlackBerry Configuration Database store only the most
recent previous key.
pending key The master encryption key that the BlackBerry Enterprise Server administrator
generates in the BlackBerry Manager to replace the current master encryption key.
Only the messaging server and the BlackBerry Configuration Database store the
pending key. The BlackBerry Desktop Software sends the pending key to the BlackBerry
device when the BlackBerry device user connects the BlackBerry device to the computer.
The current key then becomes the new previous key, and the pending key becomes the
new current key.
How the messaging server storage location stores the master encryption keys
The Microsoft Exchange server stores the master encryption keys in a hidden folder named
BlackBerryHandheldInfo within a root folder of the BlackBerry device user's computer email application mailbox.
The BlackBerryHandheldInfo folder stores the following data:
•a message of class RIM.BlackBerry.Handheld.Config containing the BlackBerry device user's configuration
information, including the master encryption key data
•the master encryption keys in binary form with tags that indicate their state: 0x6002 (pending), 0x6003
(current), and 0x6004 (previous)
The IBM Lotus Domino server stores the master encryption keys in a database named BlackBerryProfiles.nsf that
contains configuration information for every BlackBerry device user within the /Data directory. The BlackBerry
Profiles database stores an account record containing the field RIMCurrentEncryptionKeyText, which stores the
master encryption keys in alphanumeric representation of a hexadecimal string, for every BlackBerry device user.
How master encryption keys are generated
Both the BlackBerry Enterprise Server administrator and a BlackBerry device user can generate and regenerate
master encryption keys. By default, the BlackBerry Enterprise Server sends a request to the BlackBerry Desktop
Software every 31 days to prompt users to regenerate the master encryption key on their BlackBerry devices. If
the user sets the Generate keys manually option in the BlackBerry Desktop Manager, the BlackBerry Enterprise
Server still sends a key regeneration request to the BlackBerry Desktop Software automatically.
www.blackberry.com