Blackbe;rry ENTERPRISE SOLUTION SECURITY - ENFORCING ENCRYPTION OF INTERNAL AND EXTERNAL FILE SYSTEMS ON ... Manuale utente

Enforcing encryption of internal and external

file systems on BlackBerry devices

Technical Overview

Enforcing encryption of internal and external file systems on BlackBerry devices

Contents

Data that BlackBerry devices encrypt by default ................................................................................................ 1

System requirements for file encryption on BlackBerry devices....................................................................... 1

Using encryption to protect stored files on BlackBerry devices ....................................................................... 1

IT policy requirements for encryption of stored files on BlackBerry devices................................................. 3

Data that the BlackBerry device can encrypt in internal memory................................................................... 3

Protecting user data stored on a locked BlackBerry device.............................................................................. 4

Turning on protected storage of BlackBerry device data in internal memory........................................... 4

Guidelines for setting the internal memory encryption level....................................................................... 4

Protecting files stored in external memory on the BlackBerry device ............................................................ 4

Setting the external memory encryption level................................................................................................ 5

Turning on external memory encryption.......................................................................................................... 5

Transferring encrypted media files................................................................................................................... 5

Moving the media card to a different BlackBerry device.............................................................................. 5

Controlling access to objects in external memory .........................................................................................6

Protecting master encryption keys on a locked BlackBerry device.................................................................6

Enforcing encryption of internal and external file systems on BlackBerry devices 1

Data that BlackBerry devices encrypt by default

The BlackBerry® Enterprise Solution encrypts data traffic in transit between the BlackBerry® Enterprise Server

and the BlackBerry devices automatically. By default, the BlackBerry Enterprise Solution generates the master

encryption key and message key that the BlackBerry Enterprise Server and BlackBerry devices use to encrypt and

decrypt all data traffic between them.

For more information about how the BlackBerry Enterprise Solution encrypts data traffic in transit, see the

BlackBerry Enterprise Solution Security Technical Overview.

System requirements for file encryption on BlackBerry devices

Internal files External files Master encryption keys

Java® based BlackBerry devices

that run BlackBerry® Device

Software Version 4.0 or later

•BlackBerry Enterprise Server

Version 4.0 SP6 or later

•Java based BlackBerry devices

that support external file

storage using a media card

(BlackBerry devices that run

BlackBerry Device Software

Version 4.2 or later)

•BlackBerry Enterprise Server

Version 4.0 SP3 or later

•Java based BlackBerry devices

that run BlackBerry Device

Software Version 4.1 or later

Using encryption to protect stored files on BlackBerry devices

You can configure the following options on the BlackBerry Enterprise Server to turn on encryption of stored files

on supported BlackBerry devices.

Internal files External files Master encryption keys

To require BlackBerry devices on

the organization’s BlackBerry

Enterprise Servers to encrypt user

and application data that the

BlackBerry devices store in

internal memory using content

protection, turn on the content

protection process on BlackBerry

devices using the Content

Protection Strength IT policy rule

in the BlackBerry Manager.

To require BlackBerry devices to

encrypt files stored on media

cards, turn on encryption on the

external memory cards using the

External File System Encryption

Level IT policy rule.

To require BlackBerry devices to

encrypt the master encryption

keys that they use to encrypt data

stored in internal file systems, set

the Force Content Protection of

Master Keys IT policy rule.

Note: When you turn on content

protection of master encryption

keys, the BlackBerry device uses

the same encryption key strength

that it uses to encrypt internal file

systems when encrypting the

master encryption keys.

2Enforcing encryption of internal and external file systems on BlackBerry devices

Users can configure the following options to turn on encryption of stored files on their supported BlackBerry

devices.

Internal files External files Master encryption keys

Turn on the Content

Protection option

(Options > Security

Options > General

Settings).

1. Turn on Media Card Support (Options >

Media Card or Options > Memory > Media

Card Support).

2. Set the encryption mode for the external file

system. The BlackBerry device encrypts files

stored in the /BlackBerry/documents/ folder

and any user-created folders on the media

card.

3. Choose whether to encrypt media files in

external memory only on the device.

•BlackBerry Device Software version 4.7 or

later: If you set the Encrypt Media Files

option to Yes, the BlackBerry device

encrypts all files that have an audio,

image, or video MIME type, excluding

OMA DRM file types (.dcf, .odf, .o4a and

.o4v).

•BlackBerry Device Software version

earlier than 4.7: If you set the Encrypt

Media Files option to Yes, the BlackBerry

device encrypts files according to the

folders they are stored in on the media

card (/BlackBerry/videos/,

/BlackBerry/music/,

/BlackBerry/pictures/,

/BlackBerry/ringtones/ and

/BlackBerry/voicenotes/).

Note: The BlackBerry device does not encrypt files

transferred using USB while the Mass Storage

Mode Support option is turned on, or OMA DRM

files. OMA DRM files are protected using the OMA

DRM standard.

This option is not available

for control by BlackBerry

device users.

For more information about how BlackBerry devices can encrypt stored data, see the BlackBerry Enterprise

Solution Security Technical Overview.

Enforcing encryption of internal and external file systems on BlackBerry devices 3

IT policy requirements for encryption of stored files on BlackBerry devices

Internal files External files Master encryption keys

Set the Content Protection

Strength IT policy rule to the

minimum strength level required.

The user can set the Content

Protection Strength option to a

higher level on the BlackBerry

device.

•Set the External File System

Encryption Level IT policy rule

to the minimum encryption

level required. The user can

set the Encryption Mode

option to a higher level on the

BlackBerry device.

•Set the Disable USB Mass

Storage IT policy rule to True

to prevent the user from

turning on Mass Storage

Mode on the BlackBerry

device. The BlackBerry device

does not encrypt external file

on the media card when mass

storage mode is turned on.

Note: The Disable External

Memory IT policy rule should be

unchanged from the default value,

or explicitly set to False.

Set the Force Content Protection

of Master IT policy rule to the

minimum strength level required.

See the Policy Reference Guide for more information about using IT policy rules.

Data that the BlackBerry device can encrypt in internal memory

When you or BlackBerry device users turn on content protection on BlackBerry devices, the BlackBerry devices

encrypt the following user data items:

Item Description

AutoText all text that automatically replaces the text a BlackBerry device user types

BlackBerry Browser •content that web sites or third-party applications push to the

BlackBerry device

•web sites that the user saves on the BlackBerry device

•browser cache

calendar •subject

•location

•organizer

•attendees

•notes included in the appointment or meeting request

contacts (in the address book) all information except the contact title and category

Note: Set the Force Include Address Book In Content Protection IT policy

rule to True to prevent the BlackBerry device user from turning off the

Include Address Book option on the BlackBerry device. The BlackBerry

device permits the Caller ID and Bluetooth Address Book transfer features

to work when content protection is turned on and the BlackBerry device is

locked.

4Enforcing encryption of internal and external file systems on BlackBerry devices

Item Description

Email •subject

•email addresses

•message body

•attachments

memo list •title

•information included in the body of the note

OMA DRM applications a key identifying the BlackBerry device and a key identifying the SIM card

(if available) that the BlackBerry device adds to DRM forward-locked

applications

RSA SecurID Library the contents of the .sdtid file seed stored in flash memory

tasks •subject

•information included in the body of the task

Protecting user data stored on a locked BlackBerry device

If content protection is turned on, on BlackBerry devices, user data that the BlackBerry devices store is always

protected with the 256-bit AES encryption algorithm. Content protection of BlackBerry device user data is

designed to perform the following actions:

•use a 256-bit AES content protection key to encrypt stored data when the BlackBerry device is locked

•use an ECC public key to encrypt data that the BlackBerry device receives when it is locked

Turning on protected storage of BlackBerry device data in internal memory

You turn on protected storage of data on the BlackBerry device by setting the Content Protection Strength IT

policy rule. You should choose a strength level that corresponds to the desired ECC key strength.

If a BlackBerry device user turns on content protection on the BlackBerry device, in the BlackBerry device

Security Options, the BlackBerry device user can set the content protection strength to the same levels that you

can set using the Content Protection Strength IT policy rule.

Guidelines for setting the internal memory encryption level

When the content-protected BlackBerry device decrypts a message that it received while locked, the BlackBerry

device uses the ECC private key in the decryption operation. The longer the ECC key, the more time the ECC

decryption operation adds to the BlackBerry device decryption process. Choose a content protection strength

level that optimizes either the ECC encryption strength or the decryption time.

If you set the content protection strength to Stronger (to use a 283-bit ECC key) or to Strongest (to use a 571-bit

ECC key), consider setting the Minimum Password Length IT policy rule to enforce a minimum BlackBerry device

password length of 12 characters or 21 characters, respectively. These password lengths maximize the encryption

strength that the longer ECC keys are designed to provide. The BlackBerry device uses the BlackBerry device

password to generate the ephemeral 256-bit AES encryption key that the BlackBerry device uses to encrypt the

content protection key and the ECC private key. A weak password produces a weak ephemeral key.

Protecting files stored in external memory on the BlackBerry device

The BlackBerry device is designed to prevent a third-party device from using the media card by encrypting

multimedia data that it stores on an external memory device according to the External File System Encryption

Level IT policy rule setting, or the corresponding BlackBerry device setting.

The BlackBerry device is designed to support the following features:

Enforcing encryption of internal and external file systems on BlackBerry devices 5

•external file encryption by encrypting specific files on the external memory device using AES

Note: The external file system encryption does not apply to files that the BlackBerry device user manually

transfers to external memory (for example, from a USB mass storage device).

•access control to objects on the external memory device using code signing with 1024-bit RSA

The external memory device stores encrypted copies of the file keys that the BlackBerry device is designed to use

to decrypt and encrypt files on the external memory device. The BlackBerry device is designed to use a randomly

generated device key stored in the NV store in BlackBerry device RAM, the BlackBerry device password, or both

to encrypt the external memory file keys.

Setting the external memory encryption level

The administrator can use the External File System Encryption Level IT policy rule to enforce a minimum level of

encryption for the external file system. If the IT policy rule is set, the BlackBerry device user can set the

encryption mode to any encryption level stronger than the minimum.

Encryption mode Description

Device The BlackBerry device uses a randomly generated device key to encrypt the

external file system to encrypt the external file system.

Security Password The BlackBerry device uses the BlackBerry device password to encrypt the

external file system. Turning on this option turns on the password prompt on

the BlackBerry device automatically. The BlackBerry device then requires the

user to set a BlackBerry device password if one does not exist already.

Security Password & Device The BlackBerry device uses the randomly generated device key and the

BlackBerry device password to encrypt the external file system. Turning on

this option requires the user to set a BlackBerry device password if one does

not exist already.

Turning on external memory encryption

When the BlackBerry device user stores a file in external memory for the first time after the BlackBerry Enterprise

Server administrator turns on or the BlackBerry device user turns on mass storage mode, the BlackBerry

device decrypts the external memory file encryption key and uses it to automatically encrypt the stored file.

Transferring encrypted media files

The user can connect the BlackBerry device to the computer to transfer files between the device and the

computer, or use Bluetooth® technology to send media files to or receive media files from a Bluetooth enabled

device.

Turning on the mass storage mode option on the BlackBerry device allows the user to transfer files quickly over a

USB connection between the media card and the computer without using the media manager tool of the

BlackBerry Desktop Manager. When the user transfers files to the media card using mass storage mode, the

device does not encrypt the transferred files using mass storage mode even if the BlackBerry device is set to

encrypt files stored on the media card. If the user transfers encrypted files from the media card using mass

storage mode, the computer cannot decrypt the transferred files using mass storage mode.

Moving the media card to a different BlackBerry device

If the user removes the media card from the BlackBerry device and places it in a new BlackBerry device, the new

BlackBerry device cannot decrypt any files that the first BlackBerry device encrypted on the media card using a

randomly generated device key. If the first BlackBerry device encrypted the files on the media card using the

BlackBerry device password, when the user removes the media card from the BlackBerry device and places it in a

new BlackBerry device, the new BlackBerry device prompts the user for the password used on the first BlackBerry

device to access the files on the new device.

6Enforcing encryption of internal and external file systems on BlackBerry devices

Controlling access to objects in external memory

The BlackBerry device is designed to permit code signing keys in the header information of each encrypted file

on the external memory device. The BlackBerry device is designed to check the code signing keys when the

BlackBerry device opens the input or output streams of the encrypted files.

The BlackBerry device, any computer platform, and other devices that use the external memory device can

modify encrypted files (for example, truncate files) on the external memory device. The BlackBerry device is not

designed to perform integrity checks on the encrypted file data.

Protecting master encryption keys on a locked BlackBerry device

If you turn on content protection of master encryption keys, the BlackBerry device uses the grand master key to

encrypt the master encryption keys stored in flash memory and encrypts the grand master key using the content

protection key. When the BlackBerry device receives data encrypted with a master encryption key while it is

locked, it uses the decrypted grand master key to decrypt the required master encryption key in flash memory,

and uses the decrypted master encryption key to decrypt and receive the data.

The BlackBerry device stores the decrypted master encryption keys and the decrypted grand master key in RAM

only. When you, the BlackBerry device user, or a set password timeout locks the BlackBerry device, the wireless

transceiver remains on and the BlackBerry device does not clear the RAM associated with these keys. The

BlackBerry device is designed to prevent the decrypted grand master keys and the decrypted master encryption

keys from appearing in flash memory.

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Blackbe;rry Software

Blackbe;rry

Blackbe;rry PROFESSIONAL SOFTWARE FOR IBM LOTUS DOMINO Manuale di installazione e funzionamento

Blackbe;rry

Blackbe;rry TICKETMASTER - LEARN MORE Manuale utente

Blackbe;rry

Blackbe;rry INTERNET SERVICE - FEATURE AND TECHNICAL OVERVIEW... Manuale utente

Blackbe;rry

Blackbe;rry APP WORLD STOREFRONT 2.0 - RELEASE NOTES Manuale di istruzioni

Blackbe;rry

Blackbe;rry S-MIME SUPPORT PACKAGE VERSION 4.1 - Manuale utente

Blackbe;rry

Blackbe;rry 9000 - Bold Manuale utente

Blackbe;rry

Blackbe;rry WINDOWS LIVE MESSENGER FOR SMARTPHONES Manuale utente

Blackbe;rry

Blackbe;rry Sales Client for SAP CRM Manuale di istruzioni

Blackbe;rry

Blackbe;rry Windows Live Messenger for BlackBerry Smartphones... Manuale di istruzioni

Blackbe;rry

Blackbe;rry CLIENT FOR IBM LOTUS SAMETIME Manuale utente

Blackbe;rry

Blackbe;rry CLIENT FOR IBM LOTUS SAMETIME - V2.5 Manuale utente

Blackbe;rry

Blackbe;rry FACEBOOK FOR BLACKBERRY SMARTPHONES 1.9 - RELEASE... Manuale di istruzioni

Blackbe;rry

Blackbe;rry PRD-10459-016 - Enterprise Server For MS... Manuale utente

Blackbe;rry

Blackbe;rry WALLET 1.2 - RELEASE NOTES Manuale utente

Blackbe;rry

Blackbe;rry CLIENT FOR USE WITH MICROSOFT OFFICE COMMUNICATIONS SERVER... Manuale utente

Blackbe;rry

Blackbe;rry smartphone Manuale utente

Blackbe;rry

Blackbe;rry JAVA DEVELOPMENT ENVIRONMENT - - MULTIMEDIA - DEVELOPMENT... Manuale utente

Blackbe;rry

Blackbe;rry PROFESSIONAL SOFTWARE FOR MICROSOFT EXCHANGE Manuale di installazione e funzionamento

Blackbe;rry

Blackbe;rry CLIENT FOR USE WITH MICROSOFT OFFICE COMMUNICATIONS SERVER 2007 - KNOWN ISSUES... Manuale utente

Blackbe;rry

Blackbe;rry AH0Q2ML - Lotus Domino Utility Server... Manuale utente

Blackbe;rry

Blackbe;rry CHALK PUSHCAST PLAYER Manuale utente

Blackbe;rry

Blackbe;rry JAVA DEVELOPMENT ENVIRONMENT Manuale utente

Blackbe;rry

Blackbe;rry JAVA DEVELOPMENT ENVIRONMENT - - DEVICE APPLICATIONS INTEGRATION - DEVELOPMENT... Guida rapida alla configurazione

Blackbe;rry

Blackbe;rry Infinity B1367WD Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente