BlackBerry Enterprise Solution
48
compatible with the wireless security policies and environments of most organizations, and use the security
features of the BlackBerry Enterprise Solution.
Wi-Fi enabled BlackBerry devices support the following categories of enterprise Wi-Fi network security
technology:
Enterprise Wi-Fi network security technology
Wi-Fi enabled BlackBerry device implementation
Enterprise captive portal
Set authentication with enterprise captive portals
(enterprise Wi-Fi networks outside of your organization’s
network) using a configured login web page.
Layer 2 security
Set layer 2 (the IEEE® 802.11® link layer) security
methods and protocols for use with layer 2 methods that
operate between the BlackBerry device and a wireless
access point on the enterprise Wi-Fi network using
encryption, or encryption and BlackBerry device user
authentication. The BlackBerry device supports the
following layer 2 security methods:
•
open (no security method)
•
64-bit and 128-bit WEP encryption
•
PSK
•
IEEE 802.1x and EAP authentication framework
support (RFC 3748) using LEAP, PEAP, EAP-TTLS,
EAP-FAST, EAP-SIM, and EAP-TLS (RFC 2716)
The BlackBerry device supports the use of TKIP and AES-
CCMP encryption for WPA™-Personal, WPA2™-Personal,
WPA-Enterprise, and WPA2-Enterprise.
Layer 3 security
Use VPNs (the only layer 3 security method that the
BlackBerry device currently supports) at the IP layer.
Two-factor authentication
Use passcodes to authenticate the BlackBerry device user
to enterprise Wi-Fi networks using PEAP, EAP-FAST and
EAP-TTLS authentication methods and VPNs. The
BlackBerry device supports using automatic PAC
provisioning with EAP-FAST only.
For more information about the security methods and encryption algorithms that the BlackBerry device supports,
see “Appendix H: Enterprise Wi-Fi security methods that the BlackBerry device supports” on page 83.
IEEE 802.1X environment components
An IEEE 802.1X environment includes the following components:
•
IEEE 802.1X/EAP client software, also called a supplicant, running on the enterprise Wi-Fi network client
device
The Wi-Fi enabled BlackBerry device has a built-in IEEE 802.1x supplicant.
•
IEEE 802.1x software running on the access point, also called an authenticator
•
authentication server that authenticates the enterprise Wi-Fi network client device on behalf of the
authenticator and allows the Wi-Fi network client to authenticate the Wi-Fi network
In most cases, the authentication server uses the RADIUS protocol (RFC 2865 and RFC 3579) to
communicate with the authenticator on the access point.
www.blackberry.com