Blackberry ENTERPRISE SOLUTION SECURITY - ENTERPRISE SOLUTION - SECURITY TECHNICAL Manuale Utente

Feature and Technical OverviewBlackBerry Enterprise Server for Microsoft ExchangeVersion: 4.1 | Service Pack: 6

BlackBerry Enterprise Server architecture2Architecture: BlackBerry Enterprise ServerThe BlackBerry® Enterprise Server consists of various components t

Component DescriptionBlackBerry Attachment Service The BlackBerry Attachment Service converts supported message attachmentsinto a format that users ca

Component DescriptionBlackBerry Configuration Database The BlackBerry Configuration Database is a relational database that containsconfiguration data

Component DescriptionStudio® developer tools. You can use the BlackBerry Manager to manage theBlackBerry MDS Runtime Applications that are stored in t

Component DescriptionData traffic from BlackBerry devices bypasses the wireless network whileBlackBerry devices are connected to users' computers

Sample architecture with a remote BlackBerry MDS Connection ServiceFeature and Technical OverviewArchitecture: BlackBerry Enterprise Server remote com

Sample architecture with a remote BlackBerry MDS Integration ServiceComponent DescriptionBlackBerry Manager A remote BlackBerry Manager enables you to

Component DescriptionYou can install only one type of BlackBerry Collaboration Service (for example,IBM® Lotus® Sametime®), and users can use only one

BlackBerry Enterprise Server components and features3BlackBerry messaging and collaboration servicesThe BlackBerry® messaging and collaboration servic

SWDT305802-456536-0708052501-001

Feature DescriptionAdministrators can turn off wireless email reconciliation.email message filters Users and BlackBerry Enterprise Server administrato

Feature Description• If an attachment exceeds 64 KB, the BlackBerry device sends theattachment in multiple data packets.Users can send messages with a

Instant messaging featuresUsing the collaboration clients on their BlackBerry® devices, users can use many of the same features that are available int

Feature Descriptionsynchronized contact lists The instant messaging contact lists on users' BlackBerry devices aresynchronized with the contact l

Feature Descriptionannouncements Using the latest version of the BlackBerry Client for IBM Lotus Sametime or theBlackBerry Client for Novell GroupWise

Feature Descriptioninitial synchronization When the BlackBerry® Enterprise Server sends service books to BlackBerrydevices to turn on wireless data sy

The BlackBerry Attachment Service enables users to play supported audio attachments on supported BlackBerry devicesthat are running BlackBerry Device

Component Description• BlackBerry MDS Integration Service: The BlackBerry MDS IntegrationService enables BlackBerry® MDS Runtime Applications to inter

BlackBerry ApplicationsBlackBerry® devices support BlackBerry® Browser Applications, BlackBerry Java® Applications, and BlackBerry® MDSRuntime Applica

Type BlackBerry® Mobile Data System components usedBlackBerry devices run the applications using:• BlackBerry BrowserBlackBerry Java® Applications Dev

Contents1 New in this release...

The BlackBerry MDS Connection Service also receives and responds to web requests from the BlackBerry® Browser and otherBlackBerry Applications, so tha

Feature Descriptionaccess control You can configure push initiators and push rules that define which server-sidepush applications can send application

Feature Descriptiontroubleshooting tools The BlackBerry Manager displays a series of error messages when unexpectedbehavior occurs, such as when an ap

You can use the wireless activation process, with message prepopulation and automatic wireless backup, to provide a userwho is away from the office wi

Feature Descriptioncontrol the resources that third-partyapplications can accessCreate application control policies or BlackBerry MDS Integration Serv

Master encryption keysThe BlackBerry® Enterprise Server and the BlackBerry device each store a copy of the unique master encryption key of theBlackBer

How the BlackBerry Enterprise Solution uses a Triple DES encryption algorithmThe BlackBerry® Enterprise Solution uses a two-key Triple DES encryption

Options for encrypting stored dataYou can configure the BlackBerry® Enterprise Solution to encrypt the user data and the encryption keys on a locked B

Item Descriptionmemo list• title• information included in the body of the noteOpen Mobile Alliance™ DRMapplicationsa key that identifies the BlackBerr

You can also control access to the BlackBerry Enterprise Server based on specific manufacturers and models of BlackBerrydevices. The BlackBerry Manage

Process flow: Sending a message from a BlackBerry device... 4

The BlackBerry® Enterprise Server uses the BlackBerry Policy Service to send IT policies to BlackBerry devices. An IT policyis made up of rules that d

Feature DescriptionYou can configure IT polices that define security settings for BlackBerrydevices and the BlackBerry® Desktop Software. For example,

BlackBerry Enterprise Server process flows4Messaging process flowsProcess flow: Sending a message to a BlackBerry device1. A new message arrives in a

Process flow: Sending a message from a BlackBerry deviceThis process flow applies to new messages, reconciled messages (messages that are moved, delet

1. A user attaches a file to a message on a BlackBerry® device and sends the message.• If the BlackBerry device is not running BlackBerry® Device Soft

Process flow: Searching an organization's address book on a BlackBerry device1. A user performs a contact lookup on a BlackBerry® device.2. The B

Instant messaging process flowsProcess flow: Starting an instant messaging session using the BlackBerry Client for use withMicrosoft Office Live Commu

6. On the computer that hosts the BlackBerry Collaboration Service, the MSMQ software version 3.0 or later sends therequest in XMPP format, encrypted

4. The BlackBerry Collaboration Service checks the BlackBerry Configuration Database to find out if the maximum numberof sessions has been reached, an

5 Glossary...

Process flow: Starting an instant messaging session using the BlackBerry Client for use withMicrosoft Office Communications Server 20071. A user logs

The BlackBerry Collaboration Service opens the connection using HTTPS over port 443. The administrator can alsoconfigure the connection to use HTTP, t

3. The BlackBerry Dispatcher sends the request to the BlackBerry Collaboration Service over port 3200. If the BlackBerryCollaboration Service is locat

Process flow: Starting an instant messaging session using the BlackBerry Client for NovellGroupWise Messenger1. A user logs in to a collaboration clie

6. The Novell GroupWise Messenger server accepts the login request from the BlackBerry device, opens a dedicated SSLconnection for the session, and st

8. The recipient's client sends a content request packet to the BlackBerry Collaboration Service.9. The BlackBerry Collaboration Service requests

If the format is not valid and the user’s BlackBerry device is Java® based, the Open Attachment menu item does notappear on the user’s BlackBerry devi

Process flow: Viewing an attachment through a link1. A user clicks the Get Link menu item to view an attachment on a BlackBerry® device.2. The BlackBe

Process flow: Synchronizing organizer data for the first time on a BlackBerry device1. A user activates a new BlackBerry® device or upgrades an existi

If the user changes data on the BlackBerry device or in the organizer application on the user's computer during the initialsynchronization proces

6. The BlackBerry device sends a delivery confirmation to the BlackBerry Synchronization Service for each record that itreceives.7. The BlackBerry Syn

8. The BlackBerry Messaging Agent sends a delivery confirmation to the BlackBerry Dispatcher.9. The BlackBerry Dispatcher sends the delivery confirmat

6. The BlackBerry Router sends the encrypted content to the wireless network over port 3101.7. The wireless network verifies that the PIN belongs to a

9. The wireless network verifies that the PIN belongs to a valid BlackBerry device that is registered with the wirelessnetwork and sends the encrypted

9. The BlackBerry device sends a delivery confirmation to the BlackBerry Router, and decrypts and decompresses thecontent so that the user can view it

8. The BlackBerry device sends a delivery confirmation to the BlackBerry Router.If the BlackBerry MDS Connection Service does not receive a delivery c

9. In the BlackBerry MDS Control Center on the BlackBerry device, the user views the list of BlackBerry MDS RuntimeApplications that are available to

7. The BlackBerry Enterprise Server sends the IT policy to the BlackBerry device. If the BlackBerry device cannot acceptthe IT policy, the activation

Process flow: Sending an application to a BlackBerry device over the wireless network1. A BlackBerry® Enterprise Server administrator adds a BlackBerr

Glossary5AESAdvanced Encryption StandardAJAXAsynchronous JavaScript® and XMLAPIapplication programming interfaceASCIIAmerican Standard Code for Inform

New in this release1Feature DescriptionRich-content email messages BlackBerry® Enterprise Server version 4.1 SP6 supports HTML and rich-contentemail m

The gateway message envelope (GME) protocol is a Research In Motion proprietary protocol that allows the transfer ofcompressed and encrypted data betw

RTCreal-time communicationsSIMSubscriber Identity ModuleS/MIMESecure Multipurpose Internet Mail ExtensionsSRPServer Routing ProtocolSSLSecure Sockets

Legal notice6©2008 Research In Motion Limited. All rights reserved. BlackBerry®, RIM®, Research In Motion®, SureType® and relatedtrademarks, names, an

PROVINCE. SOME JURISDICTIONS MAY NOT ALLOW THE EXCLUSION OR LIMITATION OF IMPLIED WARRANTIES ANDCONDITIONS. TO THE EXTENT PERMITTED BY LAW, ANY IMPLIE

The terms of use of any RIM product or service are set out in a separate license or other agreement with RIM applicablethereto. NOTHING IN THIS DOCUME

Feature DescriptionThe collaboration client that was previously named BlackBerry® InstantMessaging for Novell® GroupWise® Messenger is now named the B

Feature DescriptionFor example, if an organization's environment has 2000 users and 100 recordsin the message state database, the computer that h