Blackberry ENTERPRISE SOLUTION SECURITY - SECURITY FOR DEVICES WITH BLUETOOTH WIRELESS TECHNOLOGY - TECHNICAL Uživatelský manuál

BlackBerry Enterprise Server for Microsoft ExchangeVersion: 5.0Feature and Technical Overview

Feature DescriptionThe BlackBerry MDS Application Console supports BlackBerry MDS IntegrationService version 5.0 or later.Support for new BlackBerry®

Component DescriptionBlackBerry Enterprise Server The BlackBerry Enterprise Server provides productivity tools and data from anorganization's app

Component Descriptionwireless service provider A wireless service provider is a telephone company that provides services for BlackBerrydevices.Wi-Fi e

Priority for connections that BlackBerry devices make over a Wi-Fi networkWi-Fi® enabled BlackBerry® devices connect over a Wi-Fi network to the Black

BlackBerryservicesService providerwith GSM®/EDGEnetwork or UMAnetworkWi-Fi network andservice providerwith GSM/EDGEnetworkWi-Fi network andno servicep

BlackBerryservicesService providerwith GSM®/EDGEnetwork or UMAnetworkWi-Fi network andservice providerwith GSM/EDGEnetworkWi-Fi network andno servicep

IEEE 802.11 wireless networking standards that Wi-Fi enabled BlackBerrydevices supportWi-Fi® enabled BlackBerry® devices support the IEEE® 802.11a, IE

Characteristics of the IEEE 802.11g wireless networking standard that Wi-Fi enabledBlackBerry devices supportCharacteristic Descriptionfallback speeds

Glossary7AESAdvanced Encryption StandardAJAXAsynchronous JavaScript® and XMLAPIapplication programming interfaceASCIIAmerican Standard Code for Inform

DRMDigital Rights ManagementECCElliptic Curve CryptographyEDGEEnhanced Data Rates for Global EvolutionGALGlobal Address ListGANgeneric access networkG

JSONJavaScript® Object NotationLANA local area network (LAN) is a computer network shared by a group of computers in a small area, such as an office b

Feature DescriptionView and use contacts in public folders Users with BlackBerry Device Software version 5.0 or later can view and use contactsin publ

Simple Network Management ProtocolSQLStructured Query LanguageSRPServer Routing ProtocolSSLSecure Sockets LayerTCP/IPTransmission Control Protocol/Int

Provide feedback8To provide feedback on this deliverable, visit www.blackberry.com/docsfeedback.Feature and Technical OverviewProvide feedback109

Legal notice9©2009 Research In Motion Limited. All rights reserved. BlackBerry®, RIM®, Research In Motion®, SureType®, SurePress™ andrelated trademark

HEREBY EXCLUDED. YOU MAY ALSO HAVE OTHER RIGHTS THAT VARY BY STATE OR PROVINCE. SOME JURISDICTIONSMAY NOT ALLOW THE EXCLUSION OR LIMITATION OF IMPLIED

thereto. Your use of Third Party Products and Services shall be governed by and subject to you agreeing to the terms of separatelicenses and other agr

Feature DescriptionMonitor the connection status ofBlackBerry Enterprise ServercomponentsThe BlackBerry Monitoring Service monitors the connection sta

BlackBerry Enterprise Server architecture2Architecture: BlackBerry Enterprise ServerA BlackBerry® Enterprise Server consists of various components tha

Feature and Technical OverviewArchitecture: BlackBerry Enterprise Server12

Component DescriptionBlackBerry Administration Service The BlackBerry Administration Service connects to the BlackBerry ConfigurationDatabase. You can

Component DescriptionBlackBerry MDS Connection Service The BlackBerry MDS Connection Service permits users to access web content, theInternet, or your

Component DescriptionBlackBerry Policy Service The BlackBerry Policy Service performs administration services over the wirelessnetwork. It sends IT po

Architecture: Remote BlackBerry Collaboration ServiceYou can install the BlackBerry® Collaboration Service on a computer that is separate from the com

Component DescriptionBlackBerry Configuration Database The BlackBerry Configuration Database contains configuration data that theBlackBerry Collaborat

SWDT305802-524791-0331031644-001

Component DescriptionBlackBerry Administration Service The BlackBerry Administration Service permits you to manage the BlackBerry MDSConnection Servic

Component Descriptionorganization's application servers orcontent serversYour organization's application servers or content server provide p

Component DescriptionBlackBerry Administration Service The BlackBerry Administration Service permits you to manage the BlackBerry MDSIntegration Servi

Component DescriptionBlackBerry Configuration Database The BlackBerry Configuration Database contains configuration data that theBlackBerry Administra

You can install the BlackBerry® Web Desktop Manager with the BlackBerry Administration Service. You can install the BlackBerryWeb Desktop Manager sepa

Architecture: Remote BlackBerry Monitoring ServiceYou can install the BlackBerry® Monitoring Service on a computer that is separate from the computer

Component DescriptionBlackBerry Monitoring Service The BlackBerry Monitoring Service is a web-based application that you can use tomonitor your organi

Component DescriptionBlackBerry Administration Service The BlackBerry Administration Service permits you to manage the BlackBerryAttachment Service in

Architecture: BlackBerry Web Desktop ManagerThe BlackBerry® Web Desktop Manager consists of server-side services that are installed with the BlackBerr

BlackBerry Enterprise Server components and features3BlackBerry messaging and collaboration servicesThe BlackBerry® messaging and collaboration servic

Contents1 Overview: BlackBerry Enterprise Server...

Feature DescriptionYou can turn off wireless email reconciliation.email message filters You or users can create and change email message filters. Emai

Feature DescriptionUsers can send messages with attachments only from supported BlackBerry devicesthat are running BlackBerry® Device Software version

Feature Descriptionfollow up flag Users with BlackBerry devices that are running BlackBerry Device Software version5.0 or later can flag messages from

BlackBerry Collaboration ServiceThe BlackBerry® Collaboration Service provides a connection between your organization's instant messaging server

Feature Descriptionaccess levels Using the latest version of the BlackBerry® Client for use with Microsoft® OfficeCommunications Server 2007, users ca

Feature Descriptionpublic groups Using the latest version of the BlackBerry Client for IBM Lotus Sametime, users canadd public groups to their instant

Synchronization featuresYou can change the settings for synchronization features so that users can manage the user experience and system resourcesin y

BlackBerry Attachment ServiceThe BlackBerry® Attachment Service converts supported message attachments into a format that users can view on theirBlack

BlackBerry MDSThe BlackBerry® Mobile Data System is a flexible framework for application development that you can use to add and manageapplications in

Component Description• BlackBerry® MDS Runtime: runs BlackBerry MDS Runtime Applications• BlackBerry APIs and Java® ME: runs BlackBerry Java Applicati

Managing BlackBerry device security over the wireless network using IT administration commands... 48BlackBerry Monitoring Service

BlackBerry MDS Runtime ApplicationsBlackBerry® MDS Runtime Applications are lightweight, rich-client applications that are created using BlackBerry® M

Type Descriptionbrowser message push applications A message appears in the message list on users' BlackBerry devices to provide alink to new or u

Feature DescriptionYou can use two-factor authentication to create VPN connections between wirelessapplications on BlackBerry devices and your organiz

Feature Descriptioninstallation options You can prevent users from searching for BlackBerry MDS Runtime Applications.You can also require users to ins

In the BlackBerry Administration Service, you create software configurations to specify the versions of the BlackBerry DeviceSoftware and BlackBerry J

Controlling third-party applications on BlackBerry devicesFeature Descriptioncontrol the installation and removal ofthird-party applicationsYou can us

Criteria Descriptionintegrity The BlackBerry Enterprise Solution helps protect each message that a BlackBerry devicesends using one or more message ke

• from the time the BlackBerry Enterprise Server receives a message to the time when the user opens the decrypted messageon the BlackBerry deviceBefor

To offer an additional layer of messaging security between the sender and recipient of an email message or PIN message, youcan turn on S/MIME technolo

Item Description• email addresses• message body• attachmentsmemo list• title• information included in the body of notesOpen Mobile Alliance™ DRM appli

Process flow: Starting an instant messaging session using the BlackBerry Client for Novell GroupWise Messenger...

You can also control access to the BlackBerry Enterprise Server based on specific manufacturers and models of BlackBerry devices.The BlackBerry Admini

Feature Descriptionweb-based administration console You can use the BlackBerry Monitoring Service console to monitor a BlackBerryEnterprise Server in

Feature Description• BlackBerry device statistics, such as the battery level and network coveragethresholds You can define thresholds that you can use

BlackBerry RouterThe BlackBerry® Router connects to the wireless network. It sends data to and receives data from the BlackBerry®Infrastructure for a

Feature DescriptionIT policy assignment You can apply an IT policy to a group or an individual user account.resend options If a BlackBerry Enterprise

Feature Descriptionability to assign users to multiple groups Groups permit you to share administrative roles, IT policies, and other configurationset

Feature Descriptionapplication management Users can use the BlackBerry Web Desktop Manager to install, manage, and removethe applications that are ins

Comparison of BlackBerry Web Desktop Manager and BlackBerry Desktop Manager featuresSupported feature BlackBerry Web Desktop Manager BlackBerry Deskto

Supported feature BlackBerry Web Desktop Manager BlackBerry Desktop Manager• BlackBerry Web Desktop Managerdoes not prompt users if they wantto switch

Supported feature BlackBerry Web Desktop Manager BlackBerry Desktop Manager• users cannot turn off messageredirection while their BlackBerrydevices ar

Direct connections between BlackBerry devices and the BlackBerry Router over an enterprise Wi-Fi network... 99Wi-Fi connection when a VPN connecti

Supported feature BlackBerry Web Desktop Manager BlackBerry Desktop Manager• Show AppLoader• Show Web Linksynchronization over a serial connection use

BlackBerry Enterprise Server high availability4High availability permits you to provide minimum downtime for BlackBerry® services if BlackBerry® Enter

Both BlackBerry Enterprise Server instances in the BlackBerry Enterprise Server pair include, by default, the BlackBerry AttachmentService, BlackBerry

How a primary BlackBerry Enterprise Server demotes itselfAfter the primary BlackBerry® Enterprise Server receives a request to demote itself from a st

Scenario: What happens after the health score of a primary BlackBerryEnterprise Server falls below the failover thresholdThe following scenario assume

BlackBerry Configuration Database mirroringThe following diagram shows how you can configure the BlackBerry® Configuration Database with principal and

The following responses assume that the messaging server and BlackBerry® Infrastructure are available.Response of a primary BlackBerry Enterprise Serv

Component High availability type DescriptionBlackBerry AttachmentServiceload-balancing with primaryand secondary groupsWhen you install two or more Bl

Component High availability type Descriptionresponding, the BlackBerry Enterprise Server assigns theactive connection to another BlackBerry MDS Connec

BlackBerry Enterprise Server process flows5Messaging process flowsProcess flow: Sending a message to a BlackBerry device1. A message arrives in a user

Overview: BlackBerry Enterprise Server1The BlackBerry® Enterprise Server is designed to be a secure, centralized link between an organization's w

Process flow: Sending a message from a BlackBerry deviceThis process flow applies to new messages, reconciled messages (messages that a user moved, de

• If the BlackBerry device is not running BlackBerry® Device Software version 4.2 or later, and if the BlackBerry devicedoes not have a CMIME service

Process flow: Searching an organization's address book from a BlackBerry device1. A user searches for a contact on a BlackBerry® device.2. The Bl

Instant messaging process flowsProcess flow: Starting an instant messaging session using the BlackBerry Client for use withMicrosoft Office Live Commu

The BlackBerry Collaboration Service checks the BlackBerry Configuration Database to verify that the user has permissionto use the collaboration clien

1. A user logs in to a collaboration client on a BlackBerry® device.2. The BlackBerry device compresses and encrypts the user ID and password, and sen

Process flow: Starting an instant messaging session using the BlackBerry Client for IBM LotusSametime1. A user logs in to a collaboration client on a

5. The IBM Lotus Sametime server accepts the login request from the BlackBerry device, starts a dedicated TCP/IP connectionfor the session, and listen

The BlackBerry Collaboration Service checks the BlackBerry Configuration Database to verify that the user has permissionto use the collaboration clien

The BlackBerry Collaboration Service can optimize files for viewing on the BlackBerry device only if it has access to theBlackBerry Attachment Service

Feature DescriptionBlackBerry® Web Desktop Manager The BlackBerry Web Desktop Manager is a web application that permits users tomanage their BlackBerr

Message attachment process flowsProcess flow: Viewing a message attachment1. A user receives a message with an attachment on a BlackBerry® device.2. T

9. The BlackBerry Router sends the first portion of the attachment to the wireless network over port 3101.10. The wireless network verifies that the P

9. The BlackBerry Dispatcher compresses the content, encrypts it using the master encryption key of the BlackBerry device,and sends the encrypted cont

After the BlackBerry Synchronization Service registers a database for wireless data synchronization, it can no longer besynchronized or restored using

The BlackBerry Synchronization Service writes a synchronization request entry to the SynchRequest table of the BlackBerryConfiguration Database, and s

10. The BlackBerry Synchronization Service deletes the synchronization request entry from the SyncRequest table, writes anentry in the SyncRecordState

6. The BlackBerry Router sends the encrypted content to the wireless network over port 3101.7. The wireless network verifies that the PIN belongs to a

7. The BlackBerry Dispatcher compresses the content, encrypts it using the master encryption key of the BlackBerry device,and sends the encrypted cont

5. The BlackBerry Dispatcher compresses the content, encrypts it using the master encryption key of the BlackBerry device,and sends the encrypted cont

3. The BlackBerry MDS Connection Service converts the content so that the user can view it on the BlackBerry device, andsends the content to the Black

Feature DescriptionNew method for installing andmanaging the BlackBerry® DeviceSoftware and BlackBerry Java®ApplicationsYou can use the BlackBerry Adm

4. The BlackBerry Administration Service creates a deployment job.A deployment job represents the objects that must be sent to each user's BlackB

Process flow: Installing a BlackBerry MDS Runtime Application on a BlackBerry device overthe wireless network1. A developer creates a BlackBerry® MDS

The BlackBerry MDS Runtime sends a confirmation message to the BlackBerry MDS Integration Service and retrieves thefiles that are required to install

4. The Browser Push Engine on the BlackBerry MDS Integration Service sends the installation message to the BlackBerry MDSConnection Service using Push

The BlackBerry Enterprise Server and BlackBerry device establish a master encryption key. The BlackBerry Enterprise Serverand BlackBerry device confir

3. The BlackBerry device and BlackBerry Router use the BlackBerry Device Manager to send data to each other over the physicalconnection, behind the fi

Wi-Fi enabled BlackBerry devices6Wi-Fi® enabled BlackBerry® devices permit users with qualifying data plans to access BlackBerry services over a mobil

Type Descriptionhome Wi-Fi networks A home Wi-Fi network uses a single wireless access point to provide Internet accessthrough a broadband gateway. Th

Type DescriptionThin access points with an external controller can provide a more seamless roamingexperience for users with Wi-Fi enabled BlackBerry d

Feature DescriptionThe BlackBerry Enterprise Server is designed to work with the RSA® AuthenticationManager to provide software token support for use