Architecture and Data Flows Reference Guide

Transcription

1 Arhiteture nd Dt Flows Referene Guide BES12 Version 12.5

2 Pulished: SWD

3 Contents Aout this guide... 5 Arhiteture: BES12 EMM solution... 6 BES12 omponents...8 Components used to mnge BlkBerry OS devies BES12 nd Good Dynmis omponents BES12 nd Good Dynmis distriuted instlltion Ativting devies...22 Dt flow: Ativting BlkBerry 10 devie Dt flow: Ativting n Android devie...24 Dt flow: Ativting devie to use KNOX Workspe Dt flow: Ativting devie to use Android for Work Dt flow: Ativting devie to use Android for Work with work spe only Dt flow: Ativting n ios devie...33 Dt flow: Ativting n OS X devie...36 Dt flow: Ativting Windows 10 devie Dt flow: Ativting Windows Phone 8.1 devie...39 Dt flow: Ativting BlkBerry OS devie...41 Sending nd reeiving work dt...44 Sending nd reeiving work dt using the BlkBerry Infrstruture Dt flow: Aessing n pplition or ontent server using enterprise onnetivity Dt flow: Sending emil from BlkBerry 10, ios, or Android devie...48 Dt flow: Reeiving emil on BlkBerry 10 or Android devie...49 Dt flow: Reeiving emil on n ios devie Dt flow: Sending emil from n ios devie using the BlkBerry Seure Gtewy Servie...51 Dt flow: Reeiving emil on n ios devie using the BlkBerry Seure Gtewy Servie...52 Dt flow: Reeiving enterprise push updtes on BlkBerry 10 devie...53 Dt flow: Aessing n pplition or ontent server using BlkBerry Seure Connet Plus Dt flow: Sending n instnt messge from the BlkBerry Enterprise IM pp... 56

4 Sending nd reeiving work dt using VPN or work Wi-Fi network Dt flow: Sending emil from devie using VPN or work Wi-Fi network Dt flow: Reeiving emil on devie using VPN or work Wi-Fi network Dt flow: Aessing n pplition or ontent server using VPN or work Wi-Fi network...60 Reeiving devie onfigurtion updtes Dt flow: Reeiving onfigurtion updtes on BlkBerry 10 devie...61 Dt flow: Reeiving onfigurtion updtes on n Android devie Dt flow: Reeiving onfigurtion updtes on n ios devie Dt flow: Reeiving onfigurtion updtes on n OS X devie Dt flow: Reeiving onfigurtion updtes on Windows Phone 8.1 or Windows 10 devie Dt flow: Reeiving onfigurtion updtes on Windows Phone 8.0 devie Glossry Legl notie...71

5 Aout this guide Aout this guide 1 BES12 helps you mnge BlkBerry 10, ios, Android, Windows, OS X, nd BlkBerry OS (version 5.0 to 7.1) devies for your orgniztion. This guide explins the BES12 rhiteture nd how dt flows etween the devies mnged y BES12 nd your orgniztion's network. This guide is intended for senior IT professionls who re responsile for evluting the produt nd plnning its deployment, s well s nyone who's interested in lerning more out BES12. After you red this guide, you should understnd the funtion of eh omponent used in the BES12 EMM solution. 5

6 Arhiteture: BES12 EMM solution Arhiteture: BES12 EMM solution 2 Component BES12 BlkBerry Infrstruture Desription BES12 is multipltform EMM solution tht provides omprehensive devie, pplition, nd ontent mngement with integrted seurity nd onnetivity. The BlkBerry Infrstruture registers user informtion for devie tivtion nd vlidtes liensing informtion for BES12. All the dt tht trvels etween the BlkBerry Infrstruture nd BES12 is uthentited nd enrypted to provide seure ommunition hnnel into your orgniztion for devies outside the firewll. Devies BES12 supports BlkBerry 10, ios, OS X, Android, Windows, nd BlkBerry OS (version 5.0 to 7.1) devies. Notifition servies BES12 sends notifitions to devies to ontt BES12 for updtes nd to report informtion for your orgniztion s devie inventory. These notifitions re sent to the BlkBerry Infrstruture, where they re sent to the devies using the pproprite notifition servie: APNs is servie tht Apple provides to send notifitions to ios nd OS X devies. GCM is servie tht Google provides to send notifitions to Android devies. Windows Push Notifition Servies (WNS) is servie tht Mirosoft provides to send notifitions to Windows devies. 6

7 Arhiteture: BES12 EMM solution Component Desription Routing omponents By defult, BES12 mkes diret onnetion to the BlkBerry Infrstruture over port 3101, nd you do not need to instll more routing omponents. However, if your orgniztion's seurity poliy requires tht internl systems nnot mke onnetions diretly to the Internet, you n instll the BlkBerry Router or TCP proxy server. The BlkBerry Router ts s proxy server for onnetions over the BlkBerry Infrstruture etween BES12 nd ll devies. The BlkBerry Router n support SOCKs v5 with no uthentition. If your orgniztion lredy hs TCP proxy server instlled or requires one to meet networking requirements, you n use TCP proxy server insted of the BlkBerry Router. The TCP proxy server n support SOCKs v5 with no uthentition. Third-prty pplition nd ontent servers Good Dynmis nd BlkBerry plug-ins Additionl ontent server or pplition servers in your orgniztion's environment, inluding the ompny diretory, mil server, ertifite uthorities, nd so on. BES12 works with dditionl BlkBerry enterprise produts suh s Good Dynmis, Enterprise Identity y BlkBerry, Strong Authentition y BlkBerry, WthDox y BlkBerry, nd WorkLife y BlkBerry to llow you to extend EMM pilities in your orgniztion. 7

8 BES12 omponents BES12 omponents 3 The digrm shows the BES12 omponents tht re used to mnge BlkBerry 10, Android, ios, OS X, nd Windows devies. Component nme BES12 Core Desription The BES12 Core is the entrl omponent of BES12. It hs severl suomponents tht re responsile for: Logging, monitoring, reporting, nd mngement funtions Authentition nd uthoriztion servies for the BES12 Core lol diretory nd ompny diretories Sheduling nd sending ommnds, IT poliies, nd profiles to devies If there re multiple instlltions of BES12 in the domin, ll of the BES12 Core instnes re tive nd eh of them n onnet to the BlkBerry Infrstruture nd proess trffi. After you instll BES12 on omputer, you n instll the BES12 Core on nother omputer. BES12 dtse The BES12 dtse is reltionl dtse tht ontins user ount informtion nd onfigurtion informtion tht BES12 uses to mnge devies. You n instll the BES12 8

9 BES12 omponents Component nme Desription dtse on the sme omputer s BES12 instne, or on seprte omputer. For redundny or usiness ontinuity, you n onfigure dtse mirroring. BlkBerry Affinity Mnger The BlkBerry Affinity Mnger is responsile for mintining n tive SRP onnetion etween BlkBerry 10 devies nd the BlkBerry Infrstruture when the devies re not using BlkBerry Seure Connet Plus. If there re multiple instlltions of BES12 in the domin, the BlkBerry Affinity Mnger runs on ll instnes ut only one BlkBerry Affinity Mnger instne is tive nd responsile for mintining onnetion to the BlkBerry Infrstruture nd proessing trffi. The BlkBerry Affinity Mnger provides Exhnge AtiveSyn onnetivity nd logging settings for the BlkBerry Work Connet Notifition Servie. It lso ssigns BlkBerry 10 devies to the BlkBerry Dispther using the informtion in the BES12 dtse. If BlkBerry 10 devie is moved to different BES12 instne, the BlkBerry Affinity Mnger performs ll of the steps required to move the user to the new instne so tht the user does not hve to do nything for the devie to mintin BES12 servies. BlkBerry Collortion Servie The BlkBerry Collortion Servie provides n enrypted onnetion etween your orgniztion's instnt messging server nd the BlkBerry Enterprise IM pp on BlkBerry 10 devies so tht users n strt nd mnge instnt messging onverstions on their devies. The BlkBerry Collortion Servie is n optionl omponent nd is ville s seprte instlltion. BlkBerry Dispther The BlkBerry Dispther provides seure onnetivity using IPPP for BlkBerry 10 devies. The BlkBerry Dispther dynmilly updtes the devies tht it hndles sed on the list it reeives from the tive BlkBerry Affinity Mnger. BlkBerry Gtekeeping Servie BlkBerry MDS Connetion Servie BlkBerry Seure Connet Plus The BlkBerry Gtekeeping Servie sends ommnds to Exhnge AtiveSyn to dd devies to n llowed list when devies re tivted on BES12. Unmnged devies tht try to onnet to n orgniztion's mil server n e reviewed, verified, nd loked or llowed through the BES12 mngement onsole y n dministrtor. The BlkBerry MDS Connetion Servie provides seure onnetion etween BlkBerry 10 devies nd your orgniztion's network when the devie is not onneted to your work Wi- Fi network or using VPN onnetion. It is lso responsile for providing enterprise dt push servies for BlkBerry 10 devies. BlkBerry Seure Connet Plus provides seure IP tunnel etween work pps on devies nd your orgniztion's network. One tunnel tht supports stndrd IPv4 (TCP nd UDP) dt is estlished for eh devie through the BlkBerry Infrstruture. 9

10 BES12 omponents Component nme BlkBerry Seure Gtewy Servie BlkBerry Work Connet Notifition Servie Desription The BlkBerry Seure Gtewy Servie provides seure onnetion through the BlkBerry Infrstruture nd BES12 to your orgniztion's mil server for ios devies with MDM ontrols tivtions. The BlkBerry Work Connet Notifition Servie is we servie responsile for providing new nd hnged emil nd orgnizer notifitions to ios devies tht re using Seure Work Spe. ios devies re restrited from running pplitions in the kground, with speifi exeptions suh s the defult mil pplition. This mens Seure Work Spe pplitions nnot reeive new dt suh s emil notifitions unless the pplition is open or unless the notifition omes from the APNs. The BlkBerry Work Connet Notifition Servie sends the emil nd orgnizer notifitions to the BlkBerry Infrstruture, where they re sent to the devie using the APNs. Mngement onsole nd BES12 Self-Servie The mngement onsole is we-sed onsole tht you n use to: Complete postinstlltion onfigurtion settings View nd mnge users, devies, IT poliies, profiles, nd pps View nd mnge system settings, inluding ustomizing the tivtion emil messge nd dding n APNs ertifite Move IT poliies, profiles, groups, nd users to BES12 The mngement onsole lso provides ess to BES12 Self-Servie. Users n ess BES12 Self-Servie to set n tivtion pssword nd send devie ommnds, suh s set pssword, lok devie, nd delete devie dt to their BlkBerry 10, ios, Android, Windows, or OS X devies. After you instll BES12 on omputer, you n instll the mngement onsole on nother omputer. 10

11 Components used to mnge BlkBerry OS devies Components used to mnge BlkBerry OS devies 4 Some BES12 omponents re used only for mnging BlkBerry OS (versions 5.0 to 7.1) devies. This digrm shows the BES12 omponents used for mnging BlkBerry OS devies. Component nme BES12 Core Desription The BES12 Core is the entrl omponent of BES12 rhiteture nd onsists of severl suomponents tht re responsile for: Logging, monitoring, reporting, nd mngement funtions Authentition nd uthoriztion servies for the BES12 Core lol diretory nd ompny diretories Sheduling nd sending ommnds, IT poliies, nd profiles to devies If there re multiple BES12 instnes in the domin, ll the BES12 Core instnes re tive nd eh of them n onnet to the BlkBerry Infrstruture nd proesses trffi. After you instll BES12 on omputer, you n instll the BES12 Core on nother omputer. 11

12 Components used to mnge BlkBerry OS devies Component nme BES12 dtse BlkBerry Administrtion Servie Desription The BES12 dtse is reltionl dtse tht ontins user ount informtion nd onfigurtion informtion tht BES12 uses to mnge devies. You n instll the BES12 dtse on the sme omputer s BES12 instne, or on seprte omputer. For redundny or usiness ontinuity, you n onfigure dtse mirroring. You n use the BlkBerry Administrtion Servie to onfigure BlkBerry OS devie softwre updtes, nd VPN nd Wi-Fi profiles for BlkBerry OS (versions 5.0 to 7.1) devies. The BlkBerry Administrtion Servie onnets to the BES12 dtse. It lso provides onnetion servies for the mngement onsole so tht you n mnge BlkBerry OS devies. BlkBerry Atthment Servie BlkBerry Collortion Servie for BlkBerry OS BlkBerry Controller BlkBerry Dispther for BlkBerry OS The BlkBerry Atthment Servie onverts supported tthments into formt tht n e viewed on BlkBerry OS devies. The BlkBerry Atthment Servie onverts tthments for the BlkBerry Messging Agent, the BlkBerry MDS Connetion Servie for BlkBerry OS, nd the BlkBerry Collortion Servie. The BlkBerry Collortion Servie for BlkBerry OS is n optionl omponent tht provides onnetion etween your orgniztion's instnt messging server nd the ollortion lient on BlkBerry OS devies. The BlkBerry Controller monitors omponents used to mnge BlkBerry OS devies nd restrts these omponents when they stop responding. The BlkBerry Dispther for BlkBerry OS performs the following funtions: Trnsfers dt etween omponents used to mnge BlkBerry OS devies Compresses nd enrypts dt tht is sent to BlkBerry OS devies Derypts nd deompresses dt tht is reeived from BlkBerry OS devies Monitors nd ommunites the helth of BlkBerry OS mngement omponents Strts the proessing of BlkBerry OS devie users on the BlkBerry Messging Agent BlkBerry Mil Store Servie BlkBerry MDS Connetion Servie for BlkBerry OS BlkBerry Messging Agent The BlkBerry Mil Store Servie onnets to the mil servers in your orgniztion's environment nd retrieves the ontt informtion tht the BlkBerry Administrtion Servie requires to serh for user ounts on the mil servers. The BlkBerry MDS Connetion Servie for BlkBerry OS permits pplitions on BlkBerry OS devies to onnet to your orgniztion's pplition or ontent servers for pplition dt nd updtes. The BlkBerry Messging Agent performs the following funtions: 12

13 Components used to mnge BlkBerry OS devies Component nme Desription Connets to the mil server to provide messging servies, lendr mngement, ontt lookups, tthment viewing, nd tthment retrievl for BlkBerry OS devies Allows the BlkBerry Synhroniztion Servie to ess orgnizer dt on the mil server Synhronizes onfigurtion dt etween the BES12 dtse nd BlkBerry OS devie user miloxes on the mil server BlkBerry Poliy Servie BlkBerry Router The BlkBerry Poliy Servie performs dministrtion servies for BlkBerry OS devies over the wireless network, suh s sending IT poliies, devie ommnds, nd servie ooks. The BlkBerry Router ts s proxy server for onnetions over the BlkBerry Infrstruture etween BES12 nd ll devies. For BlkBerry OS (version 5.0 to 7.1) devies, the BlkBerry Router lso sends dt diretly to nd reeives dt from devies tht re onneted to work Wi-Fi network or to omputer tht hs the BlkBerry Devie Mnger. If you upgrde from BES5 version MR10 to BES12, the BlkBerry Router you originlly instlled with your BES5 ontinues to work only for the omponents used to mnge BlkBerry OS devies. If you instll new instne of the BlkBerry Router with BES12, you n onfigure it to work with ll omponents If you use n existing TCP proxy server insted of the BlkBerry Router, BlkBerry OS devies tht re onneted to work Wi-Fi network or to omputer tht hs BlkBerry Devie Mnger instlled nnot ypss the BlkBerry Infrstruture to onnet to your orgniztion's network. BlkBerry Synhroniztion Servie BlkBerry We Desktop Mnger Mngement onsole The BlkBerry Synhroniztion Servie synhronizes orgnizer dt etween BlkBerry OS devies nd your orgniztion's mil server using the BlkBerry Messging Agent. The BlkBerry Synhroniztion Servie lso synhronizes BlkBerry OS devie user dt with the BES12 dtse. BlkBerry OS devie users n ess BlkBerry We Desktop Mnger to set n tivtion pssword, tivte their devies y onneting them to the omputer, nd perform other devie mngement funtions for their BlkBerry OS devies, suh s updting the devie softwre or sending devie ommnds. The mngement onsole is we-sed onsole tht is used to: Complete postinstlltion onfigurtion settings View nd mnge users, devies, poliies, profiles, nd pps View nd mnge system settings, inluding ustomizing the tivtion emil messge nd dding n APNs ertifite 13

14 Components used to mnge BlkBerry OS devies Component nme Desription Move IT poliies, profiles, groups, nd users to BES12 The mngement onsole lso provides ess to BES12 Self-Servie nd llows ios devie users to mnge pps using the Work Apps ion. After you instll BES12 on omputer, you n instll the mngement onsole on nother omputer. 14

15 BES12 nd Good Dynmis omponents BES12 nd Good Dynmis omponents 5 This digrm shows how the BES12 nd Good Dynmis omponents onnet together. 15

16 BES12 nd Good Dynmis omponents Component nme BES12 Core Desription The BES12 Core is the entrl omponent of the BES12 rhiteture. It onsists of severl suomponents tht re responsile for: Logging, monitoring, reporting, nd mngement funtions Authentition nd uthoriztion servies Sheduling nd sending ommnds, IT poliies, nd profiles to devies BES12 dtse BlkBerry Work Connet Notifition Servie BlkBerry MDS Connetion Servie BlkBerry Collortion Servie The BES12 dtse is reltionl dtse tht ontins user ount informtion nd onfigurtion informtion tht BES12 uses to mnge devies. The BlkBerry Work Connet Notifition Servie is we servie tht is responsile for providing new nd hnged emil nd orgnizer notifitions to ios devies tht re using Seure Work Spe. The BlkBerry MDS Connetion Servie provides seure onnetion etween BlkBerry 10 devies nd your orgniztion's network when the devie is not onneted to your work Wi- Fi network or using VPN onnetion. The BlkBerry Collortion Servie provides n enrypted onnetion etween your orgniztion's instnt messging server nd the BlkBerry Enterprise IM pp on BlkBerry 10 devies. BlkBerry Dispther The BlkBerry Dispther provides seure onnetivity using IPPP for BlkBerry 10 devies. BlkBerry Affinity Mnger The BlkBerry Affinity Mnger is responsile for mintining n tive SRP onnetion etween BlkBerry 10 devies nd the BlkBerry Infrstruture when the devies re not using BlkBerry Seure Connet Plus. The BlkBerry Affinity Mnger provides the Exhnge AtiveSyn onnetivity nd logging settings for the BlkBerry Work Connet Notifition Servie. BlkBerry Seure Connet Plus BlkBerry Seure Gtewy Servie BlkBerry Gtekeeping Servie BlkBerry Seure Connet Plus provides seure IP tunnel etween work pps on devies nd your orgniztion's network. One tunnel tht supports stndrd IPv4 (TCP nd UDP) dt is estlished for eh devie through the BlkBerry Infrstruture. The BlkBerry Seure Gtewy Servie provides seure onnetion through the BlkBerry Infrstruture nd BES12 to your orgniztion's mil server for ios devies with MDM ontrols tivtions. The BlkBerry Gtekeeping Servie sends ommnds to Exhnge AtiveSyn to dd devies to n llowed list when devies re tivted on BES12. Unmnged devies tht try 16

17 BES12 nd Good Dynmis omponents Component nme Desription to onnet to n orgniztion's mil server n e reviewed, verified, nd loked or llowed y n dministrtor using the BES12 mngement onsole. Mngement onsole nd BES12 Self-Servie The mngement onsole nd BES12 Self-Servie re we-sed onsoles tht provide dministrtor nd user ess to BES12. Administrtors use the mngement onsole to mnge system settings, users, devies, nd pps. Users use BES12 Self-Servie to set n tivtion pssword nd send ommnds to devies, suh s set pssword, lok devie, nd delete devie dt. Good Control Good Control dtse Good Proxy Good Enterprise Moility Server Good Enterprise Moility Server dtses Good Push Notifitions Good Connet Good Presene Good Dos Good Control is the Good Dynmis mngement nd onfigurtion omponent. Good Control inludes user, poliy, pp, nd role mngement, nd infrstruture onfigurtion. The Good Control dtse is the repository used y Good Control to store user, pp, nd poliy informtion. Good Proxy mintins the seure onnetion etween your orgniztion nd the Good NOC. It lso supports Good Dynmis Diret Connet, whih llows pp dt to ypss the Good NOC. GEMS integrtes the following servies: Good Push Notifitions, Good Connet, Good Presene, nd Good Dos. The GEMS dtses store user, pp, poliy, nd onfigurtion informtion. Good Push Notifitions epts push registrtion requests from ios nd Android devies nd then ommunites with Mirosoft Exhnge to monitor the user's work mil ount for hnges. Good Connet provides seure instnt messging, ompny diretory look-up, nd user presene informtion to ios nd Android devies. Good Presene provides rel-time presene sttus to Good Dynmis pplitions. Good Dos lets your moile workers ess, synhronize, nd shre their work file server nd ShrePoint douments. 17

18 BES12 nd Good Dynmis distriuted instlltion BES12 nd Good Dynmis distriuted instlltion 6 This digrm shows how the BES12 nd Good Dynmis omponents onnet together when the BlkBerry Connetivity Node nd BlkBerry user interfe re instlled seprtely from the primry BES12 omponents. 18

19 BES12 nd Good Dynmis distriuted instlltion Component nme Primry BES12 omponents BES12 Core Desription The primry BES12 omponents inlude the BES12 Core nd ll omponents instlled with it on the sme server. The BES12 Core is the entrl omponent of the BES12 rhiteture. It onsists of severl suomponents tht re responsile for: Logging, monitoring, reporting, nd mngement funtions Authentition nd uthoriztion servies Sheduling nd sending ommnds, IT poliies, nd profiles to devies BlkBerry Work Connet Notifition Servie BlkBerry MDS Connetion Servie BlkBerry Collortion Servie The BlkBerry Work Connet Notifition Servie is we servie responsile for providing new nd hnged emil nd orgnizer notifitions to ios devies tht re using Seure Work Spe. The BlkBerry MDS Connetion Servie provides seure onnetion etween BlkBerry 10 devies nd your orgniztion's network when the devie is not onneted to your work Wi- Fi network or using VPN onnetion. The BlkBerry Collortion Servie provides n enrypted onnetion etween your orgniztion's instnt messging server nd the Enterprise IM pp on BlkBerry 10 devies. BlkBerry Dispther The BlkBerry Dispther provides seure onnetivity using IPPP for BlkBerry 10 devies. BlkBerry Affinity Mnger The BlkBerry Affinity Mnger is responsile for mintining n tive SRP onnetion etween BlkBerry 10 devies nd the BlkBerry Infrstruture when the devies re not using BlkBerry Seure Connet Plus. The BlkBerry Affinity Mnger provides the Exhnge AtiveSyn onnetivity nd logging settings for the BlkBerry Work Connet Notifition Servie. BlkBerry Gtekeeping Servie (primry) The BlkBerry Gtekeeping Servie sends ommnds to Exhnge AtiveSyn to dd devies to n llowed list when devies re tivted on BES12. Unmnged devies tht try to onnet to n orgniztion's mil server n e reviewed, verified, nd loked or llowed through the BES12 mngement onsole y n dministrtor. By defult, BES12 uses the instne of the BlkBerry Gtekeeping Servie instlled with the BES12 Core nd the instne instlled with the BlkBerry Connetivity Node is disled. BES12 dtse BlkBerry user interfe The BES12 dtse is reltionl dtse tht ontins user ount informtion nd onfigurtion informtion tht BES12 uses to mnge devies. The user interfe is we-sed onsole tht provides dministrtor nd user ess to BES12. It n e instlled seprtely. 19

20 BES12 nd Good Dynmis distriuted instlltion Component nme Desription Administrtors n use the mngement onsole to mnge system settings, users, devies, nd pps. Users n ess BES12 Self-Servie to set n tivtion pssword nd send ommnds, suh s set pssword, lok devie, nd delete devie dt, to devies. BlkBerry Connetivity Node The BlkBerry Connetivity Node instlls instnes of the BES12 devie onnetivity omponents to your orgniztion s domin on different server thn the BES12 Core. Eh BlkBerry Connetivity Node ontins these omponents: BlkBerry Cloud Connetor BlkBerry Seure Connet Plus BlkBerry Seure Gtewy Servie BlkBerry Gtekeeping Servie (disled y defult) BlkBerry Cloud Connetor BlkBerry Seure Connet Plus BlkBerry Seure Gtewy Servie BlkBerry Gtekeeping Servie (BlkBerry Connetivity Node) Good Control Good Control dtse Good Proxy The BlkBerry Cloud Connetor llow the BlkBerry Connetivity Node omponents to ommunite with the BES12 Core. Communition etween the BlkBerry Cloud Connetor nd BES12 Core trvels through the BlkBerry Infrstruture. BlkBerry Seure Connet Plus provides seure IP tunnel etween work pps on devies nd your orgniztion's network. One tunnel tht supports stndrd IPv4 (TCP nd UDP) dt is estlished for eh devie through the BlkBerry Infrstruture. The BlkBerry Seure Gtewy Servie provides seure onnetion through the BlkBerry Infrstruture nd BES12 to your orgniztion's mil server for ios devies with MDM ontrols tivtions. BES12 n use the BlkBerry Connetivity Node instne of the BlkBerry Gtekeeping Servie insted of the instne instlled with the BES12 Core. Only one instne of the BlkBerry Gtekeeping Servie n e tive. By defult, BES12 uses the instne of the BlkBerry Gtekeeping Servie instlled with the BES12 Core nd the instne instlled with the BlkBerry Connetivity Node is disled. Good Control is the Good Dynmis mngement nd onfigurtion omponent. Good Control inludes user, poliy, pp, nd role mngement, nd infrstruture onfigurtion. The Good Control dtse is the repository used y Good Control to store user, pp, nd poliy informtion. Good Proxy mintins the seure onnetion etween your orgniztion nd the Good NOC. It lso supports Good Dynmis Diret Connet, whih llows pp dt to ypss the Good NOC. 20

21 BES12 nd Good Dynmis distriuted instlltion Component nme Good Enterprise Moility Server Good Enterprise Moility Server dtses Desription GEMS integrtes the following servies: Good Push Notifitions, Good Connet, Good Presene, nd Good Dos. The GEMS dtses store user, pp, poliy, nd onfigurtion informtion. 21

22 Ativting devies Ativting devies 7 Depending on the devie type nd the tivtion type tht you speify for it, the devie nd BES12 must omplete severl steps during the tivtion proess to uthentite to eh other, seure ommunition hnnel nd, if needed, rete work spe or enrypt the devie efore ny onfigurtion nd work dt is sent to the devie. For instrutions to tivte devies, see "Devie tivtion" in the Administrtion ontent. Devie tivtion types give you different degrees of ontrol over the work nd personl dt on devies, rnging from full ontrol over ll dt to speifi ontrol over work dt only. For more informtion out tivtion types, see "Creting tivtion profiles" in the Administrtion ontent. Dt flow: Ativting BlkBerry 10 devie 1. You perform the following tions: Add user to BES12 s lol user ount or using the ount informtion retrieved from your ompny diretory Assign n tivtion profile to the user Use one of the following options to provide the user with tivtion detils: Automtilly generte devie tivtion pssword nd send n emil with tivtion instrutions for the user 22

23 Ativting devies Set devie tivtion pssword nd ommunite the usernme nd pssword to the user diretly or y emil Don't set devie tivtion pssword nd ommunite the BES12 Self-Servie ddress to the user so tht they n set their own tivtion pssword 2. The user performs the following tions: Types the usernme nd tivtion pssword on the devie For "Work nd personl - Regulted" or "Work spe only" tivtion, epts the orgniztion notie, whih outlines the terms nd onditions tht the user must gree to 3. If the tivtion is "Work spe only" tivtion, the devie deletes ll existing dt nd restrts. For other tivtion types, the Enterprise Mngement Agent on the devie performs the following tions: Estlishes onnetion to the BlkBerry Infrstruture Sends request for tivtion informtion to the BlkBerry Infrstruture 4. The BlkBerry Infrstruture performs the following tions: Verifies tht the user is vlid, registered user Retrieves the BES12 ddress for the user Sends the ddress to the Enterprise Mngement Agent 5. The devie performs the following tions: Estlishes onnetion with BES12 Genertes shred symmetri key tht is used to protet the CSR nd response BES12 using the tivtion pssword nd EC-SPEKE. Cretes n enrypted CSR nd HMAC s follows: Genertes key pir for the ertifite Cretes PKCS#10 CSR tht inludes the puli key of the key pir Enrypts the CSR using the shred symmetri key nd AES-256 in CBC mode with PKCS#5 pdding Computes n HMAC of the enrypted CSR using SHA-256 nd ppends it to the CSR d Sends the enrypted CSR nd HMAC to BES12 6. BES12 performs the following tions: d e f Verifies the HMAC of the enrypted CSR nd derypts the CSR using the shred symmetri key Retrieves the usernme, work spe ID, nd your orgniztion s nme from the BES12 dtse Pkges lient ertifite using the informtion it retrieved nd the CSR tht the devie sent Signs the lient ertifite using the enterprise mngement root ertifite Enrypts the lient ertifite, enterprise mngement root ertifite, nd the BES12 URL using the shred symmetri key nd AES-256 in CBC mode with PKCS#5 pdding Computes n HMAC of the enrypted lient ertifite, enterprise mngement root ertifite, nd the BES12 URL nd ppends it to the enrypted dt 23

24 Ativting devies g Sends the enrypted dt nd HMAC to the devie 7. The devie performs the following tions: Verifies the HMAC Derypts the dt it reeived from BES12 Stores the lient ertifite nd the enterprise mngement root ertifite in its keystore 8. BES12 performs the following tions: d BES12 Core ssigns the new devie to BES12 instne in the domin BES12 Core notifies the tive BlkBerry Affinity Mnger tht new devie is ssigned to the BES12 instne The tive BlkBerry Affinity Mnger notifies the BlkBerry Dispther on tht BES12 instne tht there is new devie The BES12 Core sends onfigurtion informtion, inluding enterprise onnetivity settings to the devie 9. BES12 Core nd the devie generte the devie trnsport key using ECMQV nd the uthentited long-term puli keys from the lient ertifite nd the server ertifite for BES12. This key is used to push IPPP dt nd to initite ommunition using BlkBerry Seure Connet Plus. 10. The devie sends n knowledgment over TLS to BES12 to onfirm tht it reeived nd pplied the IT poliy nd other dt nd reted the work spe. The tivtion proess is omplete. The ellipti urve protools used during the tivtion proess use the NIST-reommended 521-it urve. Dt flow: Ativting n Android devie 24

25 Ativting devies 1. You perform the following tions: Add user to BES12 s lol user ount or using the ount informtion retrieved from your ompny diretory Mke sure the tivtion profile "MDM ontrols," "Work nd personl - full ontrol (Seure Work Spe)," or "Work nd personl - user privy (Seure Work Spe)" is ssigned to the user Use one of the following options to provide the user with tivtion detils: Automtilly generte devie tivtion pssword nd send n emil with tivtion instrutions for the user Set devie tivtion pssword nd ommunite the usernme nd pssword to the user diretly or y emil Don't set devie tivtion pssword nd ommunite the BES12 Self-Servie ddress to the user so tht they n set their own tivtion pssword 2. The user downlods nd instlls the BES12 Client on the devie. After it is instlled, the user opens the BES12 Client nd enters the emil ddress nd tivtion pssword on the devie. 3. The BES12 Client on the devie performs the following tions: Estlishes onnetion to the BlkBerry Infrstruture Sends request for tivtion informtion to the BlkBerry Infrstruture 4. The BlkBerry Infrstruture performs the following tions: Verifies tht the user is vlid, registered user Retrieves the BES12 ddress for the user Sends the ddress to the BES12 Client 5. The BES12 Client estlishes onnetion with BES BES12 prompts the user to ept the BES12 ertifite. This prompt inludes informtion out the SSL ertifite, inluding the Common Nme, fingerprint, nd whether the ertifite is trusted or untrusted. If the ertifite hs een preinstlled on the devie, it is trusted. Otherwise, it is untrusted. 7. The user epts the ertifite. 8. The BES12 Client sends n tivtion request to BES12. The tivtion request inludes the usernme, pssword, devie operting system, nd unique devie identifier. 9. BES12 performs following tions: d e Inspets the redentils for vlidity Cretes devie instne Assoites the devie instne with the speified user ount in the BES12 dtse Adds the enrollment session ID to n HTTP session Sends suessful uthentition messge to the devie 10. The BES12 Client retes CSR using the informtion reeived from BES12 nd sends lient ertifite request to BES12 over HTTPS. 25

26 Ativting devies 11. BES12 performs the following tions: Vlidtes the lient ertifite request ginst the enrollment session ID in the HTTP session Signs the lient ertifite request with the root ertifite Sends the signed lient ertifite nd root ertifite k to the BES12 Client A mutully uthentited TLS session is estlished etween the BES12 Client nd BES The BES12 Client requests ll onfigurtion informtion nd sends the devie nd softwre informtion to BES BES12 stores the devie informtion in the dtse nd sends the requested onfigurtion informtion to the devie. 14. The BES12 Client determines if the devie uses KNOX MDM nd is running supported MDM version. If the devie uses KNOX MDM, the devie onnets to the Smsung infrstruture nd tivtes the KNOX mngement liense. After it is tivted, the BES12 Client pplies the KNOX MDM IT poliy rules from BES The devie sends n knowledgment to BES12 tht it reeived nd pplied the onfigurtion informtion. The tivtion proess is omplete. If the tivtion type for the devie is"work nd personl - full ontrol (Seure Work Spe)," or "Work nd personl - user privy (Seure Work Spe," fter the tivtion is ompleted, the user is prompted to rete work spe pssword. Additionlly, the user my e prompted to instll or my need to mnully instll some or ll of the following pps: Seure Work Spe Work Spe Mnger Douments To Go Dt flow: Ativting devie to use KNOX Workspe 26

27 Ativting devies 1. You perform the following tions: Add user to BES12 s lol user ount or using the ount informtion retrieved from your ompny diretory Mke sure the "Work nd personl - full ontrol (Smsung KNOX)", "Work nd personl - user privy (Smsung KNOX)", or "Work spe only - (Smsung KNOX)" tivtion type is ssigned to the user Use one of the following options to provide the user with tivtion detils: Automtilly generte devie tivtion pssword nd send n emil with tivtion instrutions for the user Set devie tivtion pssword nd ommunite the usernme nd pssword to the user diretly or y emil Don't set devie tivtion pssword nd ommunite the BES12 Self-Servie ddress to the user so tht they n set their own tivtion pssword 2. The user downlods nd instlls the BES12 Client on the devie. After it is instlled, the user opens the BES12 Client nd enters the emil ddress nd tivtion pssword on the devie. 3. The BES12 Client on the devie performs the following tions: Estlishes onnetion to the BlkBerry Infrstruture Sends request for tivtion informtion to the BlkBerry Infrstruture 4. The BlkBerry Infrstruture performs the following tions: Verifies tht the user is vlid, registered user Retrieves the BES12 ddress for the user Sends the ddress to the BES12 Client 5. The BES12 Client estlishes onnetion with BES12. 27

28 Ativting devies 6. BES12 prompts the user to ept the BES12 ertifite. This prompt inludes informtion out the SSL ertifite, inluding the Common Nme, fingerprint, nd whether the ertifite is trusted or untrusted. If the ertifite hs een preinstlled on the devie, it is trusted. Otherwise, it is untrusted. 7. The user epts the ertifite. 8. The BES12 Client sends n tivtion request to BES12. The tivtion request inludes the usernme, pssword, devie operting system, nd unique devie identifier. 9. BES12 performs following tions: d e Inspets the redentils for vlidity Cretes devie instne Assoites the devie instne with the speified user ount in the BES12 dtse Adds the enrollment session ID to n HTTP session Sends suessful uthentition messge to the devie 10. The BES12 Client retes CSR using the informtion reeived from BES12 nd sends lient ertifite request to BES12 over HTTPS. 11. BES12 performs the following tions: Vlidtes the lient ertifite request ginst the enrollment session ID in the HTTP session Signs the lient ertifite request with the root ertifite Sends the signed lient ertifite nd root ertifite k to the BES12 Client A mutully uthentited TLS session is estlished etween the BES12 Client nd BES The BES12 Client requests ll onfigurtion informtion nd sends the devie nd softwre informtion to BES BES12 stores the devie informtion in the dtse nd sends the requested onfigurtion informtion to the devie. 14. The BES12 Client determines if the devie uses KNOX Workspe nd is running supported version. If the devie uses KNOX Workspe, the devie onnets to the Smsung infrstruture nd tivtes the KNOX mngement liense. After it is tivted, the BES12 Client pplies the KNOX MDM nd KNOX Workspe IT poliy rules. 15. The devie sends n knowledgment to BES12 tht it reeived nd pplied the onfigurtion informtion. The tivtion proess is omplete. After the tivtion is omplete, the user is prompted to rete work spe pssword tht is used to set up nd protet the KNOX Workspe. Dt in the KNOX Workspe is proteted using enryption nd method of uthentition suh s pssword, PIN, pttern, or fingerprint. Note: If the devie is tivted with the "Work spe only - (Smsung KNOX)" tivtion type, the personl spe is removed when the KNOX Workspe is set up. 28

29 Ativting devies Dt flow: Ativting devie to use Android for Work 1. You perform the following tions: d Verify tht the user hs Google ount tht is ssoited with the user s work emil ddress. Optionlly, you n onfigure BES12 to rete the Google ount for the user during the tivtion proess. When BES12 retes the ount for the user in Google, the user reeives n emil from the Google domin with their Google ount pssword. Add user to BES12 s lol user ount or using the ount informtion retrieved from your ompny diretory. When you speify the emil ddress, use the emil ddress tht is ssoited with the user's Google ount. Mke sure the "Work nd personl - user privy (Android for Work) or the "Work nd personl - user privy (Android for Work - Premium) tivtion type is ssigned to the user. Use one of the following options to provide the user with tivtion detils: Automtilly generte devie tivtion pssword nd send n emil with tivtion instrutions for the user Set devie tivtion pssword nd ommunite the usernme nd pssword to the user diretly or y emil Don't set devie tivtion pssword nd ommunite the BES12 Self-Servie ddress to the user so tht they n set their own tivtion pssword 29

30 Ativting devies 2. The user downlods BES12 Client from Google Ply nd instlls it on the devie. After it is instlled, the user opens the BES12 Client nd enters their emil ddress nd tivtion pssword. 3. The BES12 Client on the devie performs the following tions: Estlishes onnetion to the BlkBerry Infrstruture Sends request for tivtion informtion to the BlkBerry Infrstruture 4. The BlkBerry Infrstruture performs the following tions: Verifies tht the user is vlid, registered user Retrieves the BES12 ddress for the user Sends the ddress to the BES12 Client 5. The BES12 Client estlishes onnetion with BES BES12 prompts the user to ept the BES12 ertifite. This prompt inludes informtion out the SSL ertifite, inluding the Common Nme, fingerprint, nd whether the ertifite is trusted or untrusted. If the ertifite hs een preinstlled on the devie, it is trusted. Otherwise, it is untrusted. 7. The user epts the ertifite. 8. The BES12 Client sends n tivtion request to BES12. The tivtion request inludes the usernme, pssword, devie operting system, nd unique devie identifier. 9. BES12 performs the following tions: d e f Determines the tivtion type ssigned to the user ount Connets to the mnged Google domin to verify the user informtion Cretes devie instne Assoites the devie instne with the speified user ount Adds the enrollment session ID to n HTTP session Sends suessful uthentition messge to the devie 10. If the devie is not enrypted, the user is prompted to enrypt the devie. 11. The BES12 Client performs the following tions: Prompts the user for the user's Google ount informtion Connets to the mnged Google domin to uthentite the user Cretes CSR using the informtion reeived from BES12 nd sends lient ertifite request to BES12 over HTTPS. 12. BES12 performs the following tions: Vlidtes the lient ertifite request ginst the enrollment session ID in the HTTP session Signs the lient ertifite request with the root ertifite Sends the signed lient ertifite nd root ertifite k to the BES12 Client A mutully uthentited TLS session is estlished etween the BES12 Client nd BES12. 30

31 Ativting devies 13. The BES12 Client requests ll onfigurtion informtion nd sends the devie nd softwre informtion to BES BES12 stores the devie informtion nd sends the requested onfigurtion informtion to the devie. 15. The devie sends n knowledgment to BES12 tht it reeived nd pplied the onfigurtion informtion. The tivtion proess is omplete. Dt flow: Ativting devie to use Android for Work with work spe only 1. You perform the following tions: d e Verify tht the user hs Google ount tht is ssoited with the user s work emil ddress. Optionlly, you n onfigure BES12 to rete the Google ount for the user during the tivtion proess. When BES12 retes the ount for the user in Google, the user reeives n emil from the Google domin with their Google ount pssword. If users hve devies with Android 6.0 or lter, verify tht the Enfore EMM Poliy setting is enled for the Google domin. This setting speifies tht tivted devies re mnged y n EMM provider, suh s BES12. Add user to BES12 s lol user ount or using the ount informtion retrieved from your ompny diretory. When you speify the emil ddress, use the emil ddress tht is ssoited with the user's Google ount. Mke sure tht the "Work spe only (Android for Work) or "Work spe only (Android for Work - Premium) tivtion type is ssigned to the user. Set the user's tivtion pssword. 31

32 Ativting devies 2. For devies with version of Android erlier thn 6.0, BES12 ommunites with the Google domin to generte n tivtion token for the user. The tivtion token nd the user's tivtion pssword re inluded in the tivtion emil tht is sent to the user's work emil ddress. 3. The user resets their devie to the ftory defult settings. 4. The devie restrts nd prompts the user to selet Wi-Fi network nd to dd n ount. 5. The user performs one of the following tions: For devies with version of Android erlier thn 6.0, tps the More utton, tps Setup work devie, nd enters their work emil ddress nd the tivtion token they reeived in their tivtion emil For devies with Android 6.0 nd lter, enters their work emil ddress nd pssword 6. The devie performs one of the following tions: For devies with version of Android erlier thn 6.0, ommunites with the Google domin to vlidte the tivtion token For devies with Android 6.0 nd lter, ommunites with the Google domin to verify tht the user is work user nd hek if the Enfore EMM Poliy setting is enled After the devie performs the pproprite vlidtions, the devie performs the following tions: If the devie is not enrypted, prompts the user to enrypt the devie nd restrts Downlods the BES12 Client from Google Ply nd instlls it 7. The BES12 Client on the devie prompts the user to type their emil ddress nd tivtion pssword. 8. The user types their emil ddress nd tivtion pssword. 9. The BES12 Client on the devie performs the following tions: Estlishes onnetion to the BlkBerry Infrstruture Sends request for tivtion informtion to the BlkBerry Infrstruture 10. The BlkBerry Infrstruture performs the following tions: Verifies tht the user is vlid, registered user Retrieves the BES12 server ddress for the user Sends the server ddress to the BES12 Client 11. The BES12 Client estlishes onnetion with BES BES12 prompts the user to ept the BES12 ertifite. This prompt inludes informtion out the SSL ertifite, inluding the Common Nme, fingerprint, nd whether the ertifite is trusted or untrusted. 13. The user epts the ertifite. 14. The BES12 Client sends n tivtion request to BES12. The tivtion request inludes the usernme, pssword, devie operting system, nd unique devie identifier. 15. BES12 performs the following tions: Determines the tivtion type ssigned to the user ount 32

33 Ativting devies d e f Connets to the Google domin to verify the user informtion Cretes devie instne Assoites the devie instne with the speified user ount Adds the enrollment session ID to n HTTP session Sends suessful uthentition messge to the devie 16. The BES12 Client performs the following tions: Prompts the user for the user's Google ount informtion Connets to the Google domin to uthentite the user Cretes CSR using the informtion reeived from BES12 nd sends lient ertifite request to BES12 over HTTPS 17. BES12 performs the following tions: Vlidtes the lient ertifite request ginst the enrollment session ID in the HTTP session Signs the lient ertifite request with the root ertifite Sends the signed lient ertifite nd root ertifite k to the BES12 Client A mutully uthentited TLS session is estlished etween the BES12 Client nd BES The BES12 Client requests ll onfigurtion informtion nd sends the devie nd softwre informtion to BES BES12 stores the devie informtion nd sends the requested onfigurtion informtion to the devie. 20. The devie sends n knowledgment to BES12 tht it reeived nd pplied the onfigurtion informtion. The tivtion proess is omplete. Dt flow: Ativting n ios devie 33

34 Ativting devies 1. If you pln to use Apple's Devie Enrollment Progrm, you perform the following tions: Mke sure tht BES12 is onfigured to synhronize with DEP. Register the devie in DEP nd ssign it to n MDM server. Assign n enrollment onfigurtion to the devie. 2. You perform the following tions: Add user to BES12 s lol user ount or using the ount informtion retrieved from your ompny diretory. Assign n tivtion profile to the user. Use one of the following options to provide the user with tivtion detils: Automtilly generte devie tivtion pssword nd send n emil with tivtion instrutions for the user Set devie tivtion pssword nd ommunite the usernme nd pssword to the user diretly or y emil Don't set devie tivtion pssword nd ommunite the BES12 Self-Servie ddress to the user so tht they n set their own tivtion pssword 3. If the devie is registered in the Apple DEP, the devie ommunites with the Apple DEP we servie during its initil setup. If you onfigured the devie to instll the Good for BES12 pp, the devie utomtilly downlods nd instlls it. 4. If the devie is not registered in the Apple DEP or if you did not onfigure the devie to instll the Good for BES12 pp, the user mnully downlods nd instlls the Good for BES12 pp on the devie. After it is instlled, the user opens the Good for BES12 pp nd enters the emil ddress nd tivtion pssword on the devie. 5. The Good for BES12 pp performs the following tions: Estlishes onnetion to the BlkBerry Infrstruture 34

35 Ativting devies Sends request for tivtion informtion to the BlkBerry Infrstruture 6. The BlkBerry Infrstruture performs the following tions: Verifies tht the user is vlid, registered user Retrieves the BES12 ddress for the user Sends the ddress to the Good for BES12 pp 7. The Good for BES12 pp estlishes onnetion with BES BES12 prompts the user to ept the BES12 ertifite. This prompt inludes informtion out the SSL ertifite, inluding the Common Nme, fingerprint, nd whether the ertifite is trusted or untrusted. If the ertifite hs een preinstlled on the devie, it is trusted. Otherwise, it is untrusted. 9. The Good for BES12 pp sends n tivtion request to BES12. The tivtion request inludes the usernme, pssword, devie operting system, nd unique devie identifier. 10. BES12 performs following tions: d e Inspets the redentils for vlidity Cretes devie instne Assoites the devie instne with the speified user ount in the BES12 dtse Adds the enrollment session ID to n HTTP session Sends suessful uthentition messge to the devie 11. The Good for BES12 pp retes CSR using the informtion reeived from BES12 nd sends lient ertifite request over HTTPS. 12. BES12 performs the following tions: Vlidtes the lient ertifite request ginst the enrollment session ID in the HTTP session Signs the lient ertifite request with the root ertifite Sends the signed lient ertifite nd root ertifite k to the Good for BES12 pp A mutully uthentited TLS session is estlished etween the Good for BES12 pp nd BES The Good for BES12 pp displys messge to inform the user tht ertifite must e instlled to omplete the tivtion. The user liks OK nd is redireted to the link for the ntive MDM Demon tivtion. The Good for BES12 pp estlishes onnetion to BES BES12 provides the MDM profile to the devie. This profile ontins the MDM tivtion URL nd the hllenge. The MDM profile is wrpped s PKCS#7 signed messge tht inludes the full ertifite hin of the signer, whih llows the devie to vlidte the profile. This triggers the enrollment proess. 15. The ntive MDM Demon on the devie sends the devie profile, inluding the ustomer ID, lnguge, nd OS version, to BES BES12 vlidtes tht the request is signed y CA nd responds to the ntive MDM Demon with suessful uthentition notifition. 17. The ntive MDM Demon sends request to BES12 sking for the CA ertifite, CA pilities informtion, nd devie-issued ertifite. 35

36 Ativting devies 18. BES12 sends the CA ertifite, CA pilities informtion, nd the devie-issued ertifite to the ntive MDM Demon. 19. The ntive MDM Demon instlls the MDM profile on the devie. The Good for BES12 pp notifies BES12 of the suessful instlltion of the MDM profile nd ertifite nd polls BES12 periodilly until it knowledges tht the MDM tivtion is omplete. 20. BES12 knowledges tht the MDM tivtion is omplete. 21. The Good for BES12 pp requests ll onfigurtion informtion nd sends the devie nd softwre informtion to BES BES12 stores the devie informtion in the dtse nd sends onfigurtion informtion to the devie. 23. The devie sends n knowledgment to BES12 tht it reeived nd pplied the onfigurtion updtes. The tivtion proess is omplete. If the tivtion type for the devie is "Work nd personl - user privy" or "Work nd personl - full ontrol," fter the tivtion is ompleted, the user is prompted to rete work spe pssword. Additionlly, the user my e prompted to instll some or ll of the following pps: Work Connet Work Browser Douments To Go Note: If the devie is tivted with the "Work nd personl - user privy" tivtion type, the users re not prompted to instll the seure pps nd must mnully downlod nd instll them. Dt flow: Ativting n OS X devie 36

37 Ativting devies 1. You mke sure tht the user hs BES12 user ount nd the login informtion for BES12 Self-Servie, inluding: We ddress for BES12 Self-Servie Usernme nd pssword Domin nme 2. The user logs in to BES12 Self-Servie on their OS X devie nd tivtes the devie. 3. The devie sends n tivtion request to BES12 on port BES12 provides the MDM profile to the devie. This profile ontins the MDM tivtion URL nd the hllenge. The MDM profile is wrpped s PKCS#7 signed messge tht inludes the full ertifite hin of the signer, whih llows the devie to vlidte the profile. This triggers the enrollment proess. 5. The ntive MDM Demon on the devie sends the devie profile, inluding the ustomer ID, lnguge, nd OS version, to BES BES12 vlidtes tht the request is signed y CA nd responds to the ntive MDM Demon with suessful uthentition notifition. 7. The ntive MDM Demon sends request to BES12 sking for the CA ertifite, CA pilities informtion, nd devie issued ertifite. 8. BES12 sends the CA ertifite, CA pilities informtion, nd the devie issued ertifite to the ntive MDM Demon. 9. The ntive MDM Demon instlls the MDM profile on the devie. 10. BES12 knowledges tht the MDM tivtion is omplete. 11. The devie requests ll onfigurtion informtion. 12. BES12 stores the devie informtion in the dtse nd sends onfigurtion informtion to the devie. 13. The devie sends n knowledgment to BES12 tht it reeived nd pplied the onfigurtion informtion. The tivtion proess is omplete. Dt flow: Ativting Windows 10 devie 37

38 Ativting devies 1. You perform the following tions: Configure the disovery servie to simplify Windows 10 tivtions Add user to BES12 s lol user ount or using the ount informtion retrieved from your ompny diretory Use one of the following options to provide the user with tivtion detils: d Automtilly generte devie tivtion pssword nd send n emil with tivtion instrutions for the user. Set devie tivtion pssword nd selet the option to send the tivtion informtion to the user y emil. Don't set devie tivtion pssword nd ommunite the BES12 Self-Servie ddress to the user so tht they n set their own tivtion pssword nd view their server ddress. Provide the user CA ertifite generted y BES12 to instll on their devie 2. The user ompletes the following tions on their devie: Cheks tht the devie hs Internet onnetivity on port 443 d Opens nd instlls the ertifite Nvigtes to Settings > Aounts > Work ess nd tps Connet When prompted, enters their emil ddress nd tivtion pssword they reeived on the tivtion emil 3. The devie estlishes onnetion to the disovery servie tht you onfigured to simplify Windows 10 tivtions in your orgniztion. 4. The disovery servie heks tht the SRP ID for the BES12 server is vlid nd redirets the devie to BES The devie sends n tivtion request to BES12 on port 443. The tivtion request inludes the usernme, pssword, devie operting system, nd unique devie identifier. 38

39 Ativting devies 6. BES12 performs following tions: d e Inspets the redentils for vlidity Cretes devie instne Assoites the devie instne with the speified user ount in the BES12 dtse Adds the enrollment session ID to n HTTP session Sends suessful uthentition messge to the devie 7. The devie retes CSR nd sends it to BES12 over HTTPS. The CSR ontins the usernme nd tivtion pssword. 8. BES12 vlidtes the usernme nd pssword, vlidtes the CSR, nd returns the lient ertifite nd the CA ertifite to the devie. All ommunition etween the devie nd BES12 is now mutully uthentited end to end using these ertifites. 9. The devie requests ll onfigurtion informtion. 10. BES12 stores the devie informtion in the dtse nd sends onfigurtion informtion to the devie. 11. The devie sends n knowledgment to BES12 tht it reeived nd pplied the onfigurtion informtion. The tivtion proess is omplete. Dt flow: Ativting Windows Phone 8.1 devie 39

40 Ativting devies 1. You perform the following tions: Add user to BES12 s lol user ount or using the ount informtion retrieved from your ompny diretory Assign n tivtion profile to the user Use one of the following options to provide the user with tivtion detils: Automtilly generte devie tivtion pssword nd send n emil with tivtion instrutions for the user Set devie tivtion pssword nd ommunite the usernme nd pssword to the user diretly or y emil Don't set devie tivtion pssword nd ommunite the BES12 Self-Servie ddress to the user so tht they n set their own tivtion pssword 2. The user downlods nd instlls the BES12 Client on the Windows Phone 8.1 devie. After it is instlled, the user opens the BES12 Client nd enters the emil ddress nd tivtion pssword on the devie. 3. The BES12 Client on the devie performs the following tions: Estlishes onnetion to the BlkBerry Infrstruture Sends request for tivtion informtion to the BlkBerry Infrstruture 4. The BlkBerry Infrstruture performs the following tions: Verifies tht the user is vlid, registered user Retrieves the BES12 ddress for the user Sends the ddress to the BES12 Client 5. The BES12 Client estlishes onnetion with BES BES12 prompts the user to ept the BES12 ertifite. This prompt inludes informtion out the SSL ertifite, inluding the Common Nme nd fingerprint. 7. The user epts the ertifite. 8. The BES12 Client sends n tivtion request to BES12. The tivtion request inludes the usernme, pssword, devie operting system, nd unique devie identifier. 9. BES12 performs following tions: d e Inspets the redentils for vlidity Cretes devie instne Assoites the devie instne with the speified user ount in the BES12 dtse Adds the enrollment session ID to n HTTP session Sends suessful uthentition messge to the devie 10. The BES12 Client retes CSR using the informtion reeived from BES12 nd sends lient ertifite request over HTTPS. 11. BES12 performs the following tions: Vlidtes the lient ertifite request ginst the enrollment session ID in the HTTP session 40

41 Ativting devies Signs the lient ertifite request with the root ertifite Sends the signed lient ertifite nd root ertifite k to the BES12 Client A mutully uthentited TLS session is estlished etween the BES12 Client nd BES The BES12 Client displys messge nd video to show the user the steps the user must tke to omplete the tivtion. The BES12 Client sends the devie informtion to BES The user opies the server ddress nd nvigtes to the Windows Phone settings to omplete the tivtion. The user dds n ount using their usernme nd tivtion pssword nd pstes the server ddress. 14. The ntive MDM Demon on the Windows Phone devie sends CSR to BES12 tht ontins the usernme nd tivtion pssword. 15. BES12 vlidtes the usernme nd pssword, vlidtes the CSR nd returns the lient ertifite nd the CA ertifite to the devie. All ommunition etween the ntive MDM Demon nd BES12 is now mutully uthentited end to end using these ertifites. 16. The BES12 Client polls BES12 periodilly until it knowledges tht the MDM tivtion is omplete. 17. BES12 knowledges tht the MDM tivtion is omplete. 18. The BES12 Client requests ll onfigurtion informtion. 19. BES12 stores the devie informtion in the dtse nd sends onfigurtion informtion to the devie. 20. The devie sends n knowledgment to BES12 tht it reeived nd pplied the onfigurtion updtes. The tivtion proess is omplete. Dt flow: Ativting BlkBerry OS devie 41

42 Ativting devies 1. You use the mngement onsole to rete new user ount nd use one of the following options to provide the user with tivtion detils: Automtilly generte devie tivtion pssword nd send n emil with tivtion instrutions for the user Set devie tivtion pssword nd ommunite the usernme nd pssword to the user diretly or y emil Don't set devie tivtion pssword nd ommunite the BlkBerry We Desktop Mnger ddress to the user so tht they n set their own tivtion pssword The devie user list stored in the BES12 dtse is updted with the new devie user nme, emil ddress, milox informtion, tivtion pssword, tivtion sttus, nd other informtion. 2. The BlkBerry Dispther for BlkBerry OS ssigns the new user to BlkBerry Messging Agent. The BlkBerry Messging Agent strts to monitor the user's milox on the mil server for new emil. An emil ontining n etp.dt file tthment is required to ontinue the tivtion proess. 3. The devie user nvigtes to the Enterprise Ativtion sreen on the BlkBerry OS (version 5.0 to 7.1) devie nd types the emil ddress nd tivtion pssword. The devie user opens the menu nd liks Ativte. The devie displys "Ativting." 4. The devie retes n tivtion request emil tht ontins the emil ddress, devie PIN, nd puli key uthentition informtion, sed on the enterprise tivtion pssword the user typed. The devie enrypts the emil using SPEKE nd sends it to the BlkBerry Infrstruture. 5. The BlkBerry Infrstruture reeives the tivtion request emil nd identifies it s n tivtion request. The BlkBerry Infrstruture forwrds the emil using SMTP to the emil ddress tht the user typed on the Enterprise Ativtion sreen. 42

43 Ativting devies 6. When the tivtion request emil rrives in the user's milox, the BlkBerry Messging Agent identifies it nd removes it from the user's milox. The BlkBerry Messging Agent reognizes the etp.dt tthment in the tivtion request emil nd egins n uthentition proess. 7. The BlkBerry Messging Agent ompres the uthentition key reeived in the tivtion request emil with the uthentition key generted from the tivtion pssword nd stored in the BES12 dtse. If the uthentition keys mth, the BlkBerry Messging Agent notifies the BlkBerry OS devie tht the tivtion request ws reeived. 8. BES12 nd the BlkBerry OS devie estlish n enryption key nd verify their knowledge of the enryption key to eh other. The BlkBerry OS devie displys "Enryption Verified. Witing for Servies." All the dt sent etween the BlkBerry OS devie nd BES12 from now on is ompressed nd enrypted using this enryption key nd the devie n now e mnged from the mngement onsole. 9. The BlkBerry Messging Agent forwrds request to the BlkBerry Poliy Servie to generte servie ooks. The BlkBerry Poliy Servie reeives nd queues the request. The BlkBerry Poliy Servie dds the unique uthentition key tht the BES12 domin uses to sign IT poliy dt nd then forwrds the IT poliy dt through the BlkBerry Dispther for BlkBerry OS to the devie. The BlkBerry Poliy Servie wits for onfirmtion from the devie tht the IT poliy hs een pplied suessfully. 10. The BlkBerry OS devie pplies the IT poliy nd sends onfirmtion to BES12. The IT poliy pplied to the BlkBerry OS devie is now in red-only stte nd n e modified only y updtes sent from the sme BES12 domin. 11. One the BlkBerry Poliy Servie reeives onfirmtion tht the IT poliy ws pplied suessfully, the BlkBerry Poliy Servie genertes nd sends the servie ooks to the BlkBerry OS devie. 12. The BlkBerry OS devie reeives the servie ooks. The devie user is notified tht the emil ddress hs een tivted. The BlkBerry OS devie displys "Servies Reeived. Your emil ddress, <usernme>@<domin>.om is now enled." The devie user n now send nd reeive emil messges on the BlkBerry OS devie. 13. The slow synhroniztion proess egins. The BlkBerry OS devie requests the synhroniztion onfigurtion informtion from the BlkBerry Synhroniztion Servie. The onfigurtion informtion indites whether wireless dt synhroniztion on BES12 is turned on nd whih orgnizer dtses n e synhronized. The onfigurtion informtion lso provides dtse synhroniztion types (unidiretionl or idiretionl) nd onflit resolution settings. 14. The BlkBerry Synhroniztion Servie returns the onfigurtion informtion nd synhronizes the dtses on the BlkBerry OS devie using tht informtion. The BlkBerry OS devie nd BES12 do not delete reords during the initil synhroniztion proess. 15. The slow synhroniztion proess is omplete when ll dtses re synhronized etween the BlkBerry OS devie nd BES12. The tivtion proess is omplete when the BlkBerry OS devie displys Ativtion Complete nd the devie user ount sttus displys Completed in the mngement onsole or BlkBerry Administrtion Servie. 43

44 Sending nd reeiving work dt Sending nd reeiving work dt 8 When devies tht re tive on BES12 send nd reeive work dt, they onnet to your orgniztion's mil, pplition, or ontent servers. For exmple, when they use the work emil or lendr pps, devies estlish onnetion to your orgniztion's mil server. When they use the work rowser to nvigte the intrnet, devies estlish onnetion to the we server in your orgniztion, nd so on. Depending on the type of devie, the tivtion type, nd onfigurtion settings, devie my estlish onnetions to your orgniztion's servers using the following pths: Dt Pth Work Wi-Fi network VPN BES12 nd the BlkBerry Infrstruture Desription You n use BES12 to onfigure Wi-Fi profiles for devies so tht devies n onnet to your orgniztion's resoures using your work Wi-Fi network. You n use BES12 to onfigure VPN profiles for devies or users my onfigure VPN profiles on their devies so tht devies n onnet to your orgniztion's resoures using VPN. Depending on the devie nd tivtion type, devies my e le to ommunite with your orgniztion's resoures using BES12 nd the BlkBerry Infrstruture Devies with n tivtion type other thn MDM ontrols n use enterprise onnetivity for ll work dt. Enterprise onnetivity enrypts nd uthentites ll work dt nd sends it through BES12 nd the BlkBerry Infrstruture. Enterprise onnetivity limits the numer of ports tht you need to open on your orgniztion's externl firewll to single port, For BlkBerry 10 devies, ios devies with the MDM ontrols tivtion type, nd Android devies tivted to use Android for Work or Smsung KNOX Workspe, you n onfigure the enterprise onnetivity profile to use BlkBerry Seure Connet Plus. When devies use BlkBerry Seure Connet Plus, work dt flows in seure IP tunnel estlished etween pps on the devie nd your orgniztion's network through the BlkBerry Infrstruture. For ios devies with the MDM ontrols tivtion type, you n enle the BlkBerry Seure Gtewy Servie to llow devies to onnet to your work mil server through the BlkBerry Infrstruture nd BES12. If you use the BlkBerry Seure Gtewy Servie, you do not hve to expose your mil server outside of the firewll to llow users with these devies to reeive work emil when they re not onneted to your orgniztion's VPN or work Wi-Fi network. When BlkBerry OS (version 5.0 to 7.1) devies send or reeive work dt, they lwys onnet to BES12. BES12 then estlishes onnetion to your orgniztion's mil, pplition, or ontent servers to send nd reeive work dt on ehlf of the BlkBerry 44

45 Sending nd reeiving work dt Dt Pth Desription OS devies. For more informtion out dt flows for BlkBerry OS (version 5.0 to 7.1) devies, visit to see the BES5 Feture nd Tehnil Overview. Sending nd reeiving work dt using the BlkBerry Infrstruture Devies onnet to BES12 through the BlkBerry Infrstruture to otin onfigurtion updtes nd to send nd reeive work dt using enterprise onnetivity or the BlkBerry Seure Gtewy Servie. The following digrm shows how devies onnet to BES12 nd your orgniztion's resoures through the BlkBerry Infrstruture. The following tle lists the irumstnes when devies onnet to BES12 nd your orgniztion's network through the BlkBerry Infrstruture. Devie type All devies ios nd Android devies with Seure Work Spe Desription All devies use this ommunition pth to send nd reeive onfigurtion dt, suh s devie ommnds, poliy nd profile updtes, nd to send devie informtion nd tivity reports. For more informtion, see Reeiving devie onfigurtion updtes. ios nd Android devies with Seure Work Spe lwys use this pth to send nd reeive Exhnge AtiveSyn dt nd other work pp dt when they hve enterprise onnetivity enled. Enterprise onnetivity is enled y defult for ios nd Android devies with Seure Work Spe. 45

46 Sending nd reeiving work dt Devie type BlkBerry 10 devies BlkBerry 10 devies, ios devies with the MDM ontrols tivtion type, nd Android devies tivted to use Android for Work or Smsung KNOX Workspe Desription BlkBerry 10 devies use this ommunition pth to send nd reeive work dt when this is the most diret, ost-effiient route ville. Devies tht hve n enterprise onnetivity profile onfigured to use BlkBerry Seure Connet Plus n use seure IP tunnel through the BlkBerry Infrstruture to trnsfer dt etween pps nd your orgniztion's network. For BlkBerry 10, KNOX Workspe, nd Android for Work devies, BlkBerry Seure Connet Plus provides seure tunnel etween ll work spe pps nd your orgniztion's network. For ios devies, BlkBerry Seure Connet Plus n provide seure tunnel etween your orgniztion's network nd ll pps or only speified pps. One tunnel is estlished for eh devie, nd the tunnel supports stndrd IPv4 protools (TCP nd UDP). When the tunnel is no longer required (for exmple, the user is in rnge of the work Wi-Fi network), it is terminted. ios devies with the MDM ontrols tivtion type BlkBerry OS (version 5.0 to 7.1) devies You n enle the BlkBerry Seure Gtewy Servie to llow ios devies with the MDM ontrols tivtion type to onnet to your work mil server through the BlkBerry Infrstruture nd BES12. If you use the BlkBerry Seure Gtewy Servie for these devies, you do not hve to expose your mil server outside of the firewll to llow users to reeive work emil when they re not onneted to your orgniztion's VPN or work Wi-Fi network. BlkBerry OS (version 5.0 to 7.1) devies use this ommunition pth to send nd reeive emil, orgnizer, nd pp dt updtes when this is the most diret, ost-effiient route ville. For more informtion on how to onfigure n enterprise onnetivity profile, see the Administrtion ontent. Relted informtion Sending nd reeiving work dt using VPN or work Wi-Fi network, on pge 57 Dt flow: Aessing n pplition or ontent server using enterprise onnetivity This dt flow desries how dt trvels when work pp on devie esses n pplition or ontent server in your orgniztion using enterprise onnetivity when BlkBerry Seure Connet Plus is not enled. 46

47 Sending nd reeiving work dt 1. The user opens work pp to view work dt. For exmple, the user opens the work rowser to nvigte the intrnet or uses BlkBerry Work Drives to ess file on network drive. 2. The pp estlishes onnetion to the pplition or ontent server to retrieve the dt. The request trvels through the seure hnnel estlished etween the BlkBerry Infrstruture nd BES12 to the pplition or ontent server: If the devie is n ios or Android devie, the request trvels through the BlkBerry Infrstruture nd the BES12 Core to the pplition or ontent server. If the devie is BlkBerry 10 devie, the request trvels through the BlkBerry Infrstruture, BlkBerry Affinity Mnger, BlkBerry Dispther, nd BlkBerry MDS Connetion Servie to the pplition or ontent server. 3. The pplition or ontent server replies with the work dt. The work dt trvels through the seure hnnel estlished etween BES12 nd the BlkBerry Infrstruture to the pp on the work spe of the devie: If the devie is n ios or Android devie, the dt trvels through the BES12 Core nd the BlkBerry Infrstruture to the devie. If the devie is BlkBerry 10 devie, the dt trvels through the BlkBerry MDS Connetion Servie, BlkBerry Dispther, BlkBerry Affinity Mnger, nd BlkBerry Infrstruture to devie. 4. The pp reeives nd displys the dt on the devie. Relted informtion Dt flow: Aessing n pplition or ontent server using BlkBerry Seure Connet Plus, on pge 54 Dt flow: Aessing n pplition or ontent server using VPN or work Wi-Fi network, on pge 60 47

48 Sending nd reeiving work dt Dt flow: Sending emil from BlkBerry 10, ios, or Android devie This dt flow desries how work emil nd lendr dt trvels from BlkBerry 10, Android, or ios devies to the Exhnge AtiveSyn server using enterprise onnetivity when BlkBerry Seure Connet Plus in not enled. 1. A user retes n emil or updtes n orgnizer item in the work spe. 2. The devie sends the new or hnged item through the seure hnnel estlished etween the BlkBerry Infrstruture nd BES12 to the mil server: If the devie is n ios or Android devie, the new or hnged item trvels through the BlkBerry Infrstruture nd the BES12 Core to the mil server. If the devie is BlkBerry 10 devie, the new or hnged item trvels through the BlkBerry Infrstruture, BlkBerry Affinity Mnger, BlkBerry Dispther, nd BlkBerry MDS Connetion Servie to the mil server. 3. The mil server updtes the orgnizer dt on the user's milox or sends the mil item to the reipient nd sends onfirmtion to the devie. Relted informtion Dt flow: Sending emil from n ios devie using the BlkBerry Seure Gtewy Servie, on pge 51 Dt flow: Sending emil from devie using VPN or work Wi-Fi network, on pge 58 48

49 Sending nd reeiving work dt Dt flow: Reeiving emil on BlkBerry 10 or Android devie This dt flow desries how work emil nd lendr dt trvels etween the Exhnge AtiveSyn server nd the BlkBerry 10 or Android devies tht re using enterprise onnetivity when BlkBerry Seure Connet Plus is not enled. 1. The devie issues n HTTPS request to the mil server nd requests tht the mil server notifies the devie when ny items hnge in the folders tht re onfigured to synhronize. The request trvels through the seure hnnel estlished etween the BlkBerry Infrstruture nd BES12 to the mil server: If the devie is n Android devie, the request trvels through the BlkBerry Infrstruture nd the BES12 Core to the mil server. If the devie is BlkBerry 10 devie, the request trvels through the BlkBerry Infrstruture, BlkBerry Affinity Mnger, BlkBerry Dispther, nd BlkBerry MDS Connetion Servie to the mil server. 2. The devie stnds y. 3. When there re new or hnged items for the devie, suh s new emil or updted lendr entry, the mil server sends the updtes to devie. The new or hnged items trvel through the seure hnnel estlished etween BES12 nd the BlkBerry Infrstruture to the emil or orgnizer dt pp on the work spe of the devie: If the devie is n Android devie, the new or hnged item trvels through the BES12 Core nd the BlkBerry Infrstruture to the devie. If the devie is BlkBerry 10 devie, the request trvels through the BlkBerry MDS Connetion Servie, BlkBerry Dispther, BlkBerry Affinity Mnger, nd BlkBerry Infrstruture to devie. 4. When the synhroniztion is omplete, the devie issues nother request to restrt the proess. 49

50 Sending nd reeiving work dt 5. If there re no new or hnged items during this intervl, the mil server sends "HTTP 200 OK" messge to the devie through the seure hnnel estlished etween BES12 nd the BlkBerry Infrstruture. 6. The devie issues new request nd the proess strts over. Relted informtion Dt flow: Reeiving emil on n ios devie, on pge 50 Dt flow: Reeiving emil on n ios devie using the BlkBerry Seure Gtewy Servie, on pge 52 Dt flow: Reeiving emil on devie using VPN or work Wi-Fi network, on pge 59 Dt flow: Reeiving emil on n ios devie This dt flow desries how work emil nd lendr dt trvels etween the Exhnge AtiveSyn mil server nd ios devies using enterprise onnetivity. 1. If the emil or orgnizer pp is open or the devie OS llows it to run in the kground, d The devie issues n HTTPS request to the mil server nd requests tht the mil server notifies the devie when ny items hnge in the folders tht re onfigured to synhronize. The request trvels through the enrypted nd uthentited hnnel estlished etween the BlkBerry Infrstruture nd BES12 Core to the mil server. The devie stnds y. If there re no new or hnged items during this intervl, the mil server sends "HTTP 200 OK" messge to the devie. The devie issues new request nd the proess strts over. When there re new or hnged items for the devie, suh s new emil or updted lendr entry, the mil server sends the updtes to the devie through the seure hnnel estlished etween BES12 Core nd the BlkBerry Infrstruture to the emil or orgnizer pp on the work spe of the devie. 50

51 Sending nd reeiving work dt e When the synhroniztion is omplete, the devie issues nother request to restrt the proess. 2. If the emil or orgnizer pp is not open nd is not running in the kground, d e f The BlkBerry Work Connet Notifition Servie listens for new or updted items for the devie. When there is new or updted item, the BlkBerry Work Connet Notifition Servie sends the notifition to the BlkBerry Infrstruture using the seure hnnel estlished etween BES12 Core nd the BlkBerry Infrstruture. The BlkBerry Infrstruture sends the notifition to the pp on the ios devie using the APNs. The devie shows there is new emil or orgnizer item ville. When the user opens the pp, the devie issues n HTTPS request to the mil server nd requests the mil server sends ny new or hnged items to the devie. The request trvels through the seure hnnel estlished etween the BlkBerry Infrstruture nd BES12 Core to the mil server. The mil server sends the new or hnged items to the devie through the seure hnnel estlished etween BES12 Core nd the BlkBerry Infrstruture to the emil or orgnizer pp on the work spe of the devie. When the synhroniztion is omplete, the proess strts over. Relted informtion Dt flow: Reeiving emil on BlkBerry 10 or Android devie, on pge 49 Dt flow: Reeiving emil on n ios devie using the BlkBerry Seure Gtewy Servie, on pge 52 Dt flow: Reeiving emil on devie using VPN or work Wi-Fi network, on pge 59 Dt flow: Sending emil from n ios devie using the BlkBerry Seure Gtewy Servie This dt flow desries how work emil nd lendr dt trvels from ios devies with MDM ontrols tivtions to the Exhnge AtiveSyn server using the BlkBerry Seure Gtewy Servie. 51

52 Sending nd reeiving work dt 1. A user retes n emil or updtes n orgnizer item in the work spe. 2. The devie sends the new or hnged item through the BlkBerry Infrstruture nd the BlkBerry Seure Gtewy Servie to the mil server. 3. The mil server updtes the orgnizer dt on the user's milox or sends the mil item to the reipient nd sends onfirmtion to the devie. Relted informtion Dt flow: Sending emil from BlkBerry 10, ios, or Android devie, on pge 48 Dt flow: Sending emil from devie using VPN or work Wi-Fi network, on pge 58 Dt flow: Reeiving emil on n ios devie using the BlkBerry Seure Gtewy Servie This dt flow desries how work emil nd lendr dt trvels etween ios devies with MDM ontrols tivtions nd the Exhnge AtiveSyn server using the BlkBerry Seure Gtewy Servie. 52

53 Sending nd reeiving work dt 1. The devie issues n HTTPS request to the mil server nd requests tht the mil server notify the devie when ny items hnge in the folders tht re onfigured for synhroniztion. The request trvels through the enrypted nd uthentited hnnel etween the BlkBerry Infrstruture nd the BlkBerry Seure Gtewy Servie to the mil server. 2. If there re no new or hnged items during this intervl, the mil server sends n "HTTP 200 OK" messge to the devie. The devie issues new request nd the proess strts over. 3. When there re new or hnged items for the devie, suh s new emil or updted lendr entry, the mil server sends the updtes to the devie through the seure hnnel etween the BlkBerry Seure Gtewy Servie nd the BlkBerry Infrstruture to the emil or orgnizer pp on the devie. 4. When the synhroniztion is omplete, the devie issues nother request to restrt the proess. Relted informtion Dt flow: Reeiving emil on BlkBerry 10 or Android devie, on pge 49 Dt flow: Reeiving emil on n ios devie, on pge 50 Dt flow: Reeiving emil on devie using VPN or work Wi-Fi network, on pge 59 Dt flow: Reeiving enterprise push updtes on BlkBerry 10 devie This dt flow desries how work dt trvels from n pplition server to BlkBerry 10 devie tht is using enterprise onnetivity when BlkBerry Seure Connet Plus is not enled. 53

54 Sending nd reeiving work dt 1. When there is new or updted dt for work pp on BlkBerry 10 devie, the pplition or ontent server pushes the dt to the BlkBerry MDS Connetion Servie using n HTTP or HTTPS request. 2. The BlkBerry MDS Connetion Servie sends the pushed dt through the BlkBerry Dispther, BlkBerry Affinity Mnger, nd TCP proxy server or BlkBerry Router if instlled, to the BlkBerry Infrstruture over port 3101 on the firewll. 3. The BlkBerry Infrstruture sends the dt to the BlkBerry 10 devie. 4. The BlkBerry 10 devie sends n delivery onfirmtion to the BlkBerry Infrstruture. The devie pp detets the inoming ontent nd displys the ontent when the user opens the pp. 5. The BlkBerry Infrstruture sends delivery onfirmtion through the BlkBerry Router or TCP proxy server, if instlled, the BlkBerry Affinity Mnger, nd the BlkBerry Dispther to the BlkBerry MDS Connetion Servie. 6. If onfigured to do so, the BlkBerry MDS Connetion Servie sends the delivery onfirmtion to the push inititor using n HTTP request. Dt flow: Aessing n pplition or ontent server using BlkBerry Seure Connet Plus This dt flow desries how dt trvels when n pp on devie tht is onfigured to use BlkBerry Seure Connet Plus esses n pplition or ontent server in your orgniztion. 54

55 Sending nd reeiving work dt 1. The user opens n pp to ess work dt from ontent or pplition server ehind your orgniztion's firewll. For BlkBerry 10, Smsung KNOX Workspe, nd Android for Work devies, ll work spe pps use BlkBerry Seure Connet Plus. For ios devies, you speify whether ll pps or only speified pps use BlkBerry Seure Connet Plus. 2. The devie determines tht seure IP tunnel is the most diret, ost-effiient method ville to onnet to the pplition or ontent server to retrieve the dt nd it sends requests through TLS tunnel, over port 443, to the BlkBerry Infrstruture to request seure tunnel to the work network. The signl is enrypted y defult using FIPS-140 ertified Certiom lirries. The signling tunnel is enrypted end-to-end. 3. BlkBerry Seure Connet Plus reeives the request from the BlkBerry Infrstruture through port The devie nd BlkBerry Seure Connet Plus negotite the tunnel prmeters nd estlish seure tunnel for the devie through the BlkBerry Infrstruture. The tunnel is uthentited nd enrypted end-to-end with DTLS. 5. The pp uses the tunnel to onnet to the pplition or ontent server using stndrd IPv4 protools (TCP nd UDP). 6. BlkBerry Seure Connet Plus trnsfers the IP dt to nd from your orgniztion's network. BlkBerry Seure Connet Plus enrypts nd derypts trffi using FIPS-140 ertified Certiom lirries. 7. The pp reeives nd displys the dt on the devie. 8. As long s the tunnel is open, supported pps use it to ess network resoures. When the tunnel is no longer the est ville method to onnet to your orgniztion's network, BlkBerry Seure Connet Plus termintes it. Relted informtion Dt flow: Aessing n pplition or ontent server using enterprise onnetivity, on pge 46 Dt flow: Aessing n pplition or ontent server using VPN or work Wi-Fi network, on pge 60 55

56 Sending nd reeiving work dt Dt flow: Sending n instnt messge from the BlkBerry Enterprise IM pp 1. A user logs in to the BlkBerry Enterprise IM pp on BlkBerry 10 devie tht is running BlkBerry 10 OS version or lter. The BlkBerry 10 devie ompresses nd enrypts the user ID nd pssword. 2. The Enterprise IM pp request on the devie opens n SSL onnetion through the BlkBerry Infrstruture, BlkBerry Affinity Mnger, BlkBerry Dispther, nd BlkBerry MDS Connetion Servie to the BlkBerry Collortion Servie over port The BlkBerry Collortion Servie heks the BES12 dtse to hek whether the mximum numer of ville sessions hs een rehed. 4. The BlkBerry Collortion Servie onnets to Mirosoft Ative Diretory to vlidte the user's login informtion. 5. The BlkBerry Collortion Servie onnets to the instnt messging server nd registers n tive endpoint for the user using UCMA, over n MTLS onnetion over port The instnt messging server sends the registrtion informtion k to the BlkBerry Collortion Servie. 7. The BlkBerry Collortion Servie sends the registrtion response to the devie using the SSL onnetion through the BlkBerry MDS Connetion Servie, BlkBerry Dispther, BlkBerry Affinity Mnger, nd BlkBerry Infrstruture. 8. The session is reted etween the BlkBerry 10 devie nd the BlkBerry Collortion Servie nd etween the BlkBerry Collortion Servie nd the Mirosoft Lyn Server. For more informtion out BlkBerry Enterprise IM, see the BlkBerry Enterprise IM ontent.. 56

57 Sending nd reeiving work dt Sending nd reeiving work dt using VPN or work Wi-Fi network Devies tht hve VPN or Wi-Fi profiles onfigured y you or y the users, my e le to ess your orgniztion's resoures using your orgniztion's VPN or work Wi-Fi network. To use your orgniztion's VPN, users with Windows Phone 8.1 devie or n Android devie tht does not use Android for Work or Smsung KNOX Workspe must mnully onfigure VPN profile on their devies. This digrm shows how dt n trvel when BlkBerry 10, ios, Android, Windows, or OS X devie onnets to your orgniztion's resoures using your orgniztion's VPN or work Wi-Fi network. This digrm shows how dt n trvel when BlkBerry OS (version 5.0 to 7.1) devie onnets to your orgniztion's resoures using your orgniztion's VPN or work Wi-Fi network. The following tle desries wht devies use your orgniztion's VPN or work Wi-Fi network to onnet to your orgniztion's network nd when. 57

58 Sending nd reeiving work dt Devie type ios nd Android devies with Seure Work Spe Devies tht use Android for Work or KNOX Workspe Windows nd OS X devies, nd Android devies without Seure Work Spe ios devies with the MDM ontrols tivtion type BlkBerry 10 BlkBerry OS Desription ios nd Android devies with Seure Work Spe use your orgniztion's VPN or work Wi-Fi network to send nd reeive Exhnge AtiveSyn dt nd other work dt only when enterprise onnetivity is not enled. To use your orgniztion's VPN, Android devie users must mnully onfigure VPN profile on their devies. Devies tht use Android for Work or KNOX Workspe use your orgniztion's VPN or work Wi-Fi network to send nd reeive Exhnge AtiveSyn dt nd other work dt only when BlkBerry Seure Connet Plus is not enled. Windows nd OS X devies nd Android devies without Seure Work Spe use this ommunition pth to send nd reeive Exhnge AtiveSyn dt nd other work dt. To use your orgniztion's VPN, Android nd Windows Phone 8.1 devie users must mnully onfigure VPN profile on their devies. ios devies with the MDM ontrols tivtion type use your orgniztion's VPN or work Wi-Fi network to send nd reeive Exhnge AtiveSyn dt only if the BlkBerry Seure Gtewy Servie is not enled. All other work dt uses your orgniztion's VPN or work Wi-Fi network. BlkBerry 10 devies use your orgniztion's VPN or work Wi-Fi network to send nd reeive Exhnge AtiveSyn dt updtes nd other work dt updtes when this is the most diret, ost-effiient route ville. BlkBerry 10 devies use only VPN nd Wi-Fi profiles onfigured y you, not y the user, when essing work dt. BlkBerry OS (version 5.0 to 7.1) devies use this ommunition pth to send nd reeive ll emil, orgnizer, nd pp dt updtes when this is the most diret, ost-effiient route ville. Relted informtion Sending nd reeiving work dt using the BlkBerry Infrstruture, on pge 45 Dt flow: Sending emil from devie using VPN or work Wi- Fi network This dt flow desries how work emil nd lendr dt trvels from the devie to the mil server over your orgniztion's VPN or work Wi-Fi network using Exhnge AtiveSyn. 58

59 Sending nd reeiving work dt 1. A user retes n emil or updtes n orgnizer item in the work spe. 2. The devie sends the new or hnged item to the mil server over your orgniztion's VPN or work Wi-Fi network. 3. The mil server updtes the orgnizer dt on the user's milox or sends the mil item to the reipient nd sends onfirmtion to the devie. Relted informtion Dt flow: Sending emil from BlkBerry 10, ios, or Android devie, on pge 48 Dt flow: Sending emil from n ios devie using the BlkBerry Seure Gtewy Servie, on pge 51 Dt flow: Reeiving emil on devie using VPN or work Wi- Fi network This dt flow desries how work emil nd lendr dt trvels from the devie to the mil server over your orgniztion's VPN or work Wi-Fi network using Exhnge AtiveSyn. 1. The devie issues n HTTPS request to the mil server nd requests tht the mil server notify the devie when ny items hnge in the folders tht re onfigured to synhronize. The request trvels through your orgniztion's VPN or work Wi- Fi network to the mil server. 2. The devie stnds y. 59

60 Sending nd reeiving work dt 3. When there re new or hnged items for the devie, suh s new emil or updted lendr entry, the mil server sends the updtes to the devie. The new or hnged items trvel through your orgniztion's VPN or work Wi-Fi network to the emil or orgnizer dt pp on the devie. 4. When the synhroniztion is omplete, the devie issues nother request to restrt the proess. 5. If there re no new or hnged items during this intervl, the mil or pplition server sends "HTTP 200 OK" messge to the devie. 6. The devie issues new request nd the proess strts over. Relted informtion Dt flow: Reeiving emil on BlkBerry 10 or Android devie, on pge 49 Dt flow: Reeiving emil on n ios devie, on pge 50 Dt flow: Reeiving emil on n ios devie using the BlkBerry Seure Gtewy Servie, on pge 52 Dt flow: Aessing n pplition or ontent server using VPN or work Wi-Fi network This dt flow desries how dt trvels etween n pplition or ontent server in your orgniztion nd n pp on devie using VPN onnetion or work Wi-Fi network. 1. The user opens work pp to view work dt. For exmple, the user opens the work rowser to nvigte the intrnet or uses BlkBerry Work Drives to ess file on network drive. 2. The pp estlishes onnetion to the pplition or ontent server to retrieve the dt. The request trvels through your VPN or work Wi-Fi network to the pplition or ontent server. 3. The pplition or ontent server replies with the work dt. The work dt trvels through your VPN or work Wi-Fi network to the pp on the work spe of the devie. 4. The pp reeives nd displys the dt on the devie. Relted informtion Dt flow: Aessing n pplition or ontent server using enterprise onnetivity, on pge 46 Dt flow: Aessing n pplition or ontent server using BlkBerry Seure Connet Plus, on pge 54 60

61 Reeiving devie onfigurtion updtes Reeiving devie onfigurtion updtes 9 When you use the mngement onsole to send devie ommnds, suh s lok devie or delete the work dt, or when you perform other devie mngement tsks, suh s updtes to poliy, profile, nd pp settings or ssignments, you trigger onfigurtion updte for the devie. When onfigurtion updte needs to e sent to devie, BES12 notifies the devie tht onfigurtion updte is pending. Devies lso poll BES12 regulrly to sk for ny tions tht need to e run on the devie to prevent ny onfigurtion updte from eing missed if notifition is not reeived on the devie. Windows Phone 8.0 devies don't reeive updte notifitions. Insted, these devies poll BES12 every hour to request pending updtes. On BlkBerry 10 devies, the Enterprise Mngement Agent reeives nd ompletes ll onfigurtion updtes. On Android devies, the BES12 Client reeives nd ompletes ll onfigurtion updtes. On ios devies, the Good for BES12 pp displys ompline sttus nd onfigurtion informtion for the devie, suh s pps or poliies ssigned to it. However, the ntive MDM Demon on the devie reeives nd ompletes ll onfigurtion updtes sent to the devie. On Windows Phone devies, the BES12 Client displys ompline sttus nd onfigurtion informtion for the devie, suh s pps or poliies ssigned to it. However, the ntive MDM Demon on the devie reeives nd ompletes ll onfigurtion updtes sent to the devie. On Windows 10 nd OS X devies, whih do not require the BES12 Client for tivtion, the ntive MDM Demon reeives nd ompletes ll onfigurtion updtes sent to the devie. Dt flow: Reeiving onfigurtion updtes on BlkBerry 10 devie 61

62 Reeiving devie onfigurtion updtes 1. An tion is tken in the mngement onsole tht triggers onfigurtion updte for the devie. For exmple, you updte the IT poliy or ssign new profile or pp to the user ount. 2. Updtes re pplied in BES12, nd ojets tht must e shred with the devie re identified. 3. The BES12 Core notifies the BlkBerry Infrstruture tht there is n updte for devie. The notifition psses through the BlkBerry Router or TCP proxy server, if instlled, nd the externl firewll, over port The BlkBerry Infrstruture notifies the Enterprise Mngement Agent on the devie tht there is n updte. 5. The Enterprise Mngement Agent on the devie polls the BES12 Core to request ny pending tions nd ommnds tht must e performed on the devie. This poll psses through the BlkBerry Infrstruture nd the BlkBerry Router, if instlled, to the BES12 Core. 6. The BES12 Core replies, through the BlkBerry Infrstruture nd BlkBerry Router or TCP proxy server, if instlled, with the highest priority tion. Priority is given to IT dministrtion ommnds, suh s Delete devie dt nd Lok devie, followed y requests for devie informtion, instlled pps, nd so on. The BES12 Core sends only one ommnd t time. If neessry, dditionl informtion is inluded in the response. 7. The Enterprise Mngement Agent on the devie reeives the onfigurtion updtes nd pplies the new or updted onfigurtion on the devie. The Enterprise Mngement Agent sends response to the BES12 Core, through the BlkBerry Infrstruture, to updte the ommnd sttus. The sttus indites whether the ommnd rn suessfully nd provides n error messge in the event of filure. 8. If more tions or ommnds re pending for the devie, the BES12 Core replies, through the BlkBerry Infrstruture, with the highest priority tion. If no tions or ommnds re pending for the devie, the BES12 Core replies with n idle ommnd. Steps 6 to 8 re repeted until no more pending tions or ommnds must e performed on the devie. 62

63 Reeiving devie onfigurtion updtes Dt flow: Reeiving onfigurtion updtes on n Android devie 1. An tion is tken in the mngement onsole tht triggers onfigurtion updte for n Android devie or devie using Android for Work or Smsung KNOX. 2. Updtes re pplied in BES12, nd ojets tht must e shred with the devie re identified. 3. The BES12 Core ontts the BlkBerry Infrstruture, through the BlkBerry Router or TCP proxy server, if instlled, nd the externl firewll over port The BlkBerry Infrstruture uses the GCM to notify Android devies tht n updte is pending. 5. The GCM sends notifition to the BES12 Client on the Android devie to ontt the BES12 Core. 6. The BES12 Client ontts the BES12 Core, on port 3101 on the externl firewll, to request ny pending tions nd ommnds tht must e performed on the devie. 7. The BES12 Core replies, through the BlkBerry Infrstruture nd BlkBerry Router or TCP proxy server, if instlled, with the highest priority tion. Priority is given to IT dministrtion ommnds, suh s Delete devie dt nd Lok devie, followed y requests for devie informtion, instlled pps, nd so on. The BES12 Core sends only one ommnd t time. If neessry, dditionl informtion is inluded in the response. 8. The BES12 Client inspets the response, shedules the ommnd to e proessed, nd wits for the ommnd to e run. The BES12 Client sends response to the BES12 Core, through the BlkBerry Infrstruture, to updte the ommnd 63