Installation guide

BlackBerry Enterprise Solution 28

Database Message storage method

BlackBerry profiles

• stores important configuration information for each BlackBerry device user,

including the BlackBerry device identification information and master encryption

key

• stores a link to a user’s BlackBerry state database and stores other information

that the BlackBerry Enterprise Server uses to manage the flow of messages to

and from the BlackBerry device

IT policy signing and storage on the BlackBerry device

An IT policy is a collection of one or more IT policy rules. An IT administration command is a function that the

BlackBerry Enterprise Server administrator can send over the wireless network to immediately control access to

or change ownership information on the BlackBerry device.

After the BlackBerry Enterprise Server installation process creates the BlackBerry Configuration Database, the

BlackBerry Enterprise Server generates a unique private and public key pair to authenticate the IT policy and the

IT administration commands, and digitally signs the Default IT policy before automatically sending it and the IT

policy public key to the BlackBerry device.

The BlackBerry device stores the digitally signed IT policy and the IT policy public key in the NV store in flash

memory, binding the IT policy to that particular BlackBerry device. The NV store persists in flash memory and can

only be overwritten by the BlackBerry device operating system. Third-party application code cannot write to the

NV store.

The BlackBerry Enterprise Server stores the IT policy private key in the BlackBerry Configuration Database. The

BlackBerry Enterprise Server uses the IT policy private key to sign all IT policy packets that it sends to the

BlackBerry device. The BlackBerry device uses the IT policy public key in the NV store to authenticate the digital

signature on the IT policy.

Application password encryption and storage on the BlackBerry device

A BlackBerry device user can use the Password Keeper tool to create and store all of the passwords that they

might use to gain access to applications and web sites on the BlackBerry device. This means that a BlackBerry

device user is required to remember only the Password Keeper master password to retrieve all of their stored

passwords.

The first time that a BlackBerry device user opens the Password Keeper on the BlackBerry device, the user must

create the Password Keeper master password. The Password Keeper encrypts the information (for example,

application and web site passwords and data) that it stores using 256-bit AES, and uses the master password to

decrypt the information when a BlackBerry device user types the master password to gain access to the

Password Keeper tool. The BlackBerry device automatically deletes all of its data if a user types the Password

Keeper master password incorrectly ten times.

In the Password Keeper, a BlackBerry device user can

• type a password and its identifying information (for example, which application the BlackBerry device user

can access using the password) and save the information

• generate random passwords designed to improve password strength

• copy passwords to the clipboard to be pasted into an application or web site password prompt

Protected storage of external memory on the BlackBerry device

The BlackBerry device is designed to encrypt multimedia data that it stores on an external memory device

according to the External File System Encryption Level IT policy rule or the corresponding BlackBerry device

setting.

The BlackBerry device is designed to support the following features: