View meeting invitee availability
Remote search for email messages
Download native attachment formats
Attachment support for.amr file format
Feature Separate messages list on BlackBerry devices for messages received from BlackBerry Enterprise Server instances

Description

You can add a separate messages list to users BlackBerry devices that contains messages received from BlackBerry Enterprise Server instances only. This feature is turned off by default. For more information about how to turn on this feature, visit www.blackberry.com/support to see article KB15003. Monitor wireless application push The new Software Config Status tab in the BlackBerry Manager allows you to failures view any issues with the wireless delivery of applications. Apply application control policies to You can now apply application control policies to BlackBerry MDS Runtime BlackBerry MDS Runtime Applications Applications that are running on the BlackBerry MDS Runtime version 4.5 or later. The Allow External Access property in BlackBerry MDS Integration Service device policies does not apply to BlackBerry devices running BlackBerry MDS Runtime version 4.5 or later. To apply this property, you must apply an application control policy to a BlackBerry MDS Runtime Application. For more information, see the BlackBerry Enterprise Server Administration Guide. Unconditional message encryption for All messages exchanged between BlackBerry devices and the BlackBerry MDS the BlackBerry MDS Integration Integration Service are now encrypted by default. Service Support for Microsoft SQL Server The BlackBerry Enterprise Server now supports the Microsoft SQL Server (64-bit) (64-bit) database management system. Enhanced control of lost and stolen You can specify a delay (in hours) when using the Erase Data And Disable BlackBerry devices Handheld IT administration command over the wireless network. This change applies to BlackBerry Device Software version 4.5 or later. The remote password reset cryptographic protocol is designed to allow you to set the BlackBerry device password remotely, even if content protection is enabled on the BlackBerry device. This change applies to BlackBerry Device Software version 4.3 or later. You can use the Weak Digest Algorithms IT policy rule to specify algorithms that BlackBerry devices consider weak. This IT policy rule can be applied to BlackBerry devices running BlackBerry Device Software version 4.3 or later.
Specify algorithms that BlackBerry devices consider weak

Feature

Description The BlackBerry Enterprise Server uses the list of weak digest algorithms when verifying that the certificate chains for the certificates that BlackBerry devices use with the SSL protocol over connections to external web servers are strong enough. BlackBerry devices use the list of weak digest algorithms when verifying that the digital signatures on messages that BlackBerry devices receive are not generated using a weak hash digest. BlackBerry devices use the list of weak digest algorithms when verifying that the certificate chains for the certificates used to sign messages that BlackBerry devices receive do not contain hashes generated using a weak digest. Developers can digitally sign BlackBerry MDS Runtime Applications that they create using BlackBerry MDS Studio, before publishing these applications to the BlackBerry MDS Application Repository. BlackBerry devices support using a private key with a corresponding certificate in X.509 syntax to digitally sign BlackBerry MDS Runtime Applications. The BlackBerry MDS Integration Service verifies the digital signature on the BlackBerry MDS Runtime Application code before sending the application to BlackBerry devices over the wireless network. When the BlackBerry device receives the BlackBerry MDS Runtime Application, it displays the certificate subject details as the code signer identity, and prompts the BlackBerry device user to accept or reject the application. You can apply an encoding scheme to BlackBerry data using transcoder application code. Third-party application developers can create encoding schemes that encrypt, convert, or otherwise change the format of BlackBerry device data. This feature applies to BlackBerry devices running BlackBerry Device Software version 4.5 or later. You can use the Firewall Whitelist Addresses IT policy rule to specify the list of email addresses that the BlackBerry device firewall allows. The BlackBerry device receives messages from these email addresses even if the user blocks all incoming messages on the device. This IT policy rule can be applied to BlackBerry devices running BlackBerry Device Software version 4.2.3 or later.

Feature New naming conventions for the BlackBerry Mobile Data System and related software
Description The component of the BlackBerry Enterprise Server that was previously named the BlackBerry MDS Services is now named the BlackBerry MDS Integration Service. The term BlackBerry MDS Services now refers collectively to the BlackBerry MDS Integration Service and the BlackBerry MDS Connection Service. BlackBerry MDS Studio Applications are now named BlackBerry MDS Runtime Applications. Java applications that are developed for and used on BlackBerry devices are now named BlackBerry Java Applications. Browser applications that are developed for and used on BlackBerry devices are now named BlackBerry Browser Applications. The term BlackBerry Applications refers collectively to BlackBerry MDS Runtime Applications, BlackBerry Java Applications, and BlackBerry Browser Applications. The BlackBerry Manager UI and the BlackBerry Enterprise Server documentation reflect these new naming conventions.
BlackBerry Enterprise Server architecture
Architecture: BlackBerry Enterprise Server
The BlackBerry Enterprise Server consists of various components that are designed to perform the following actions: provide productivity tools and data from an organization's applications to its BlackBerry device users monitor other BlackBerry Enterprise Server components process, route, compress, and encrypt data communicate with the wireless network
Component BlackBerry Attachment Service BlackBerry Collaboration Service
Description The BlackBerry Attachment Service converts supported message attachments into a format that users can view on their BlackBerry devices. The BlackBerry Collaboration Service provides a connection between your organization's instant messaging server and the collaboration client on BlackBerry devices.
Component BlackBerry Configuration Database
Description The BlackBerry Configuration Database is a relational database that contains configuration data that BlackBerry Enterprise Server components use. The BlackBerry Configuration Database includes the following data: details about the connection from the BlackBerry Enterprise Server to the wireless network user list address mappings between PINs and email addresses for BlackBerry MDS Connection Service push features read-only copy of each master encryption key The BlackBerry Controller monitors the BlackBerry Enterprise Server components and restarts them if they stop responding. The BlackBerry Dispatcher compresses and encrypts all of the data that is sent to and from BlackBerry devices. It sends the data through the BlackBerry Router, to and from the wireless network. The BlackBerry Manager connects to the BlackBerry Configuration Database. You can use the BlackBerry Manager to manage the BlackBerry Domain, including user accounts and device administration. The BlackBerry Domain consists of a single BlackBerry Configuration Database and all the BlackBerry Enterprise Server instances that use it. The BlackBerry MDS Connection Service enables users to access web content, the Internet, or your organization's intranet, and also enables applications on BlackBerry devices to connect to your organization's application or content servers for application data and updates. The BlackBerry MDS Integration Service provides application-level integration for BlackBerry MDS Runtime Applications on BlackBerry devices. You can use the BlackBerry MDS Integration Service to install BlackBerry MDS Runtime Applications that are stored in the BlackBerry MDS Application Repository on BlackBerry devices. You can also use it to manage, update, and remove BlackBerry MDS Runtime Applications. The BlackBerry MDS Application Repository stores BlackBerry MDS Runtime Applications that your organization's developers can create and publish using the BlackBerry MDS Studio or the BlackBerry Plug-in for Microsoft Visual

BlackBerry Controller BlackBerry Dispatcher

BlackBerry Manager

BlackBerry MDS Connection Service
BlackBerry MDS Integration Service
BlackBerry MDS Application Repository

Component

Description Studio developer tools. You can use the BlackBerry Manager to manage the BlackBerry MDS Runtime Applications that are stored in the BlackBerry MDS Application Repository. The BlackBerry Messaging Agent connects to your organization's messaging server to provide messaging services, calendar management, address lookups, attachment viewing, attachment downloading, and encryption key generation. The BlackBerry Messaging Agent also acts as a gateway for the BlackBerry Synchronization Service to access organizer data on the messaging server. The BlackBerry Messaging Agent synchronizes configuration data between the BlackBerry Configuration Database and the message store databases. The BlackBerry Policy Service performs administration services over the wireless network. It sends IT policies and IT administration commands and provisions service books. IT policies and IT administration commands define BlackBerry device security, settings for synchronizing data over the wireless network, and other configuration settings on BlackBerry devices. The BlackBerry Policy Service also sends service books to configure feature and component settings on BlackBerry devices. The BlackBerry Router connects to the wireless network to send data to and from BlackBerry devices. It also sends data within your organization's network to BlackBerry devices that are connected to computers with the BlackBerry Device Manager. The BlackBerry Synchronization Service synchronizes organizer data between BlackBerry devices and the messaging server over the wireless network. The organization's application or content server provides push applications and intranet content for the BlackBerry MDS Services. The instant messaging server stores instant messaging accounts. The messaging server stores email accounts. The user's computer with the BlackBerry Device Manager enables users to connect their BlackBerry devices to their computers using a serial or USB connection. The BlackBerry Enterprise Server and BlackBerry devices use this connection to send data between them.

conversations with multiple contacts
Feature availability status
Users can change their availability status while they are logged in to their collaboration clients. For example, users can set their availability status to away or busy. presence updates Using the latest version of the collaboration clients, users can set their availability status to display as away if they do not use their BlackBerry devices for a specified period of time. presence level Using the latest version of the BlackBerry Client for use with Microsoft Office Communications Server 2007, users can set the presence level of contacts in their contact lists. Each presence level consists of rules that determine how a contact can interact with a user through the instant messaging application. For example, users can assign the Personal presence level to their contacts. contact pictures Using the latest version of the collaboration clients, users can add pictures to the contacts in their contact lists. The pictures that users add using the collaboration clients on their BlackBerry devices are not synchronized with the instant messaging applications on users' computers. synchronized contact lists The instant messaging contact lists on users' BlackBerry devices are synchronized with the contact lists in their organization's instant messaging application. contact alerts Users can request alerts when specific contacts become available. file transfer Using the latest version of the BlackBerry Client for IBM Lotus Sametime, users can send files to contacts in their contact lists. Recipients can view supported file formats on their BlackBerry devices. link instant messaging contacts to the Using the latest version of the collaboration clients, users can link instant BlackBerry contact list messaging contacts to existing contact list entries on their BlackBerry devices, or they can create new contact list entries for instant messaging contacts and populate them with information from their organization's messaging server. send email messages from contact list Using the latest version of the collaboration clients on their BlackBerry devices, users can send email messages to contacts directly from their contact lists. call contacts Using the latest version of the collaboration clients on their BlackBerry devices, users can call instant messaging contacts directly from their contact lists. After a user starts an instant messaging conversation with a contact, the user can
Description make a call to that contact from the conversation window. Phone numbers for contacts are retrieved from the messaging server or from the BlackBerry contact list if the user is linked to an existing contact list entry. Using the latest version of the collaboration clients, users who are participating in an instant messaging conversation can send the history of the conversation as an email message to the participants of the conversation and to additional contacts from their BlackBerry contact lists. Users can click phone numbers in instant messages to make calls and they can click links in instant messages to view web pages. Using the latest version of the BlackBerry Client for IBM Lotus Sametime, users can add public groups to their instant messaging contact lists. Using the latest version of the BlackBerry Client for IBM Lotus Sametime or the BlackBerry Client for use with Microsoft Office Communications Server 2007, users can set their current location to display in their contact information. For example, users can set their current location to "In the office." This feature is not available if your organization's environment uses IBM Lotus Sametime version 6.5.1. Using the latest version of the BlackBerry Client for IBM Lotus Sametime or the BlackBerry Client for Novell GroupWise Messenger, users can send announcements to groups or multiple contacts in their contact lists. Using the latest version of the BlackBerry Client for IBM Lotus Sametime, the BlackBerry Client for use with Microsoft Office Live Communications Server 2005, or the BlackBerry Client for use with Microsoft Office Communications Server 2007, users can send instant messages to contacts they have not added to their contact lists. The collaboration clients enter dormant mode automatically after five minutes of inactivity. In dormant mode, the applications do not receive presence updates for contacts. Dormant mode is designed to reduce wireless network traffic in an organization's messaging environment. The collaboration clients turn off dormant mode when users open or use the applications, or receive conference requests, alerts, or messages from contacts.

BlackBerry device configurations
BlackBerry device reporting
BlackBerry Enterprise Solution security
Feature wireless application delivery
Description You can use software configurations to send BlackBerry Java Applications to BlackBerry devices over the wireless network.
Controlling third-party applications on BlackBerry devices

Feature Description

control the installation and removal of Allow users to download and install third-party applications on BlackBerry third-party applications devices or prevent them from downloading applications. You can also remove applications from BlackBerry devices over the wireless network. control the resources that third-party Create application control policies or BlackBerry MDS Integration Service device applications can access policies that specify the resources that third-party applications can access on BlackBerry devices (for example, message, phone, and key store). Create IT policies that specify the type of connections that third-party applications on BlackBerry devices can establish (for example, opening network connections inside the firewall). Create BlackBerry MDS Integration Service device policies to control whether users can search for BlackBerry MDS Runtime Applications in the BlackBerry MDS Application Repository.
control the availability of BlackBerry MDS Runtime Applications
The BlackBerry Enterprise Solution is designed to encrypt data in transit at all points between the BlackBerry device and the BlackBerry Enterprise Server to protect your organization from data loss or alteration. Only the BlackBerry Enterprise Server and the BlackBerry device can access the data that they send between them. If events that threaten the wireless security of your organization occur, third parties, including wireless service providers, cannot access your organization's potentially sensitive information in a decrypted format. The BlackBerry Enterprise Solution uses symmetric key cryptography to encrypt messages and user data that it sends over the transport layer to provide the following criteria for the security of wired and wireless solutions. Criteria confidentiality Description The BlackBerry Enterprise Solution uses encryption to make sure that only the intended message recipients can view the contents of the message.

Criteria integrity

Description The BlackBerry Enterprise Solution protects each message that the BlackBerry device sends with one or more message keys. To prevent third-party decryption or alteration of the message data, the message keys are designed to consist of random data. Only the BlackBerry Enterprise Server and the BlackBerry device know the value of the master encryption key, recognize the format of the decrypted and decompressed message, and automatically reject a message that is not encrypted with the correct master encryption key. The BlackBerry device authenticates itself to the BlackBerry Enterprise Server to prove that it knows the master encryption key before the BlackBerry Enterprise Server can send data to the BlackBerry device.

IT policy coverage

IT policy assignment resend options

security enforcement

BlackBerry Configuration Panel
The BlackBerry Configuration Panel displays data, such as BlackBerry Configuration Database settings, that the BlackBerry Enterprise Server setup application gathered during the installation process. You can use the BlackBerry Configuration Panel to change configuration data after you install the BlackBerry Enterprise Server.
BlackBerry Enterprise Server process flows

Messaging process flows

Process flow: Connecting to a messaging server
A BlackBerry Enterprise Server opens a connection that allows multiple logins to a Novell GroupWise server using the trusted application key, and opens a connection to a user's post office. The peek mode is set between the BlackBerry Enterprise Server and the Novell GroupWise server. The Novell GroupWise connector creates a TCP/IP connection to the Novell GroupWise server using the Novell GroupWise Object API. This connection remains open while the BlackBerry Enterprise Server is running. The BlackBerry Enterprise Server starts processing transactions when all active users are connected.
You can add users to the BlackBerry Enterprise Server without restarting the Novell GroupWise server or the BlackBerry Enterprise Server.
Process flow: Sending a message to a BlackBerry device

1. 2. 3.

A new message arrives in a users Novell GroupWise mailbox. The BlackBerry Messaging Agent polls the user's mailbox and detects the message. The BlackBerry Messaging Agent applies global filter rules to the messages in the users mailbox and filters the messages that match the filter criteria. If no global filter rules apply, the BlackBerry Messaging Agent applies user-defined filter rules to the messages in the users mailbox. The BlackBerry Messaging Agent sends the first 2 KB of the message to the BlackBerry Dispatcher. The BlackBerry Dispatcher compresses the first 2 KB of the message, encrypts it with the master encryption key of the BlackBerry device, and sends the encrypted data to the BlackBerry Router. The BlackBerry Router sends the encrypted data to the wireless network over port 3101.

4. 5. 6.

The wireless network verifies that the PIN belongs to a valid BlackBerry device that is registered with the wireless network, and sends the message data to the BlackBerry device. The BlackBerry device sends a delivery confirmation to the BlackBerry Dispatcher. The BlackBerry Dispatcher sends the delivery confirmation to the BlackBerry Messaging Agent. If the BlackBerry Messaging Agent does not receive a delivery confirmation within four hours, it sends the message to the wireless network again. The delivery confirmation verifies that the wireless network delivered the message to the BlackBerry device, but it does not verify that the user received or opened the message. The BlackBerry device decrypts and decompresses the message so that the user can view it, and notifies the user that the message has arrived.

The default transport protocol is TLS. If you changed the transport protocol to TCP, it requires more dedicated connections for each session and supports fewer sessions. 8. The BlackBerry Instant Messaging Connector returns the acceptance to the local queue on the BlackBerry Collaboration Service. 9. The BlackBerry Collaboration Service returns the acceptance, in encrypted and compressed format, through the BlackBerry Dispatcher to the BlackBerry device, and creates a cache of the connectivity information to maintain the new instant messaging session. 10. The collaboration client on the BlackBerry device starts the instant messaging session using the RTC connection object.
Process flow: Starting an instant messaging session using the BlackBerry Client for use with Microsoft Office Live Communications Server 2005 (Microsoft Office Communicator)
A user logs in to a collaboration client on a BlackBerry device. The BlackBerry device compresses and encrypts the user ID and password, and sends them through the BlackBerry Router to the BlackBerry Dispatcher over port 3101. The BlackBerry Dispatcher sends the request to the BlackBerry Collaboration Service over port 3201. If the BlackBerry Collaboration Service is located on a remote computer, the request remains encrypted using a Research In Motion proprietary protocol.
The BlackBerry Collaboration Service checks the BlackBerry Configuration Database to find out if the maximum number of sessions has been reached, and performs one of the following actions: If the maximum number of sessions has been reached and a timeout limit is set, the BlackBerry Collaboration Service logs out any instant messaging sessions on BlackBerry devices that are out of coverage, and any instant messaging sessions that are no longer sending status messages to the BlackBerry Collaboration Service. If there are no idle sessions, the BlackBerry Collaboration Service sends a "Server Busy" status message to the BlackBerry device and rejects the login request. If the maximum number of sessions is not set and the number of sessions equals the total number that the HTTP persistent connection supports, the BlackBerry Collaboration Service sends a "Failed" status message to the BlackBerry device and rejects the login request. The BlackBerry Collaboration Service checks the BlackBerry Configuration Database to verify that the user has permission to use the collaboration client, and tries to authenticate the user using Integrated Windows Authentication; if the authentication is not successful, the BlackBerry Collaboration Service tries a forms-based login process instead. The BlackBerry Collaboration Service sends a login request in JSON, a lightweight data-interchange format, to the Microsoft Office Communicator Web Access server.

The BlackBerry Collaboration Service opens the connection using HTTPS over port 443. The administrator can also configure the connection to use HTTP, the transport protocol that the AJAX service uses, or a custom port number. 6. The Microsoft Office Communicator Web Access server formats the request using a Microsoft API and sends the request to the Microsoft Office Live Communications Server over an MTLS connection. 7. The Microsoft Office Live Communications Server accepts the request, processes the login information, and sends the acceptance to the Microsoft Office Communicator Web Access server. 8. The Microsoft Office Communicator Web Access server sends the acceptance to the BlackBerry Collaboration Service. 9. The BlackBerry Collaboration Service sends the acceptance, in encrypted and compressed format, through the BlackBerry Dispatcher to the BlackBerry device, and creates a cache of the connectivity information to maintain the new instant messaging session. 10. The collaboration client on the BlackBerry device starts the session using an open GET request over the HTTPS persistent connection. The BlackBerry Collaboration Service receives server-initiated events from the Microsoft Office Communicator Web Access server using an HTTP GET or HTTPS GET request, and sends these events to the collaboration client over this session. The BlackBerry Collaboration Service sends events that the BlackBerry device initiates to the Microsoft Office Communicator Web Access server using an HTTP POST or HTTPS POST request.
Process flow: Starting an instant messaging session using the BlackBerry Client for use with Microsoft Office Communications Server 2007
A user logs in to a collaboration client on a BlackBerry device. The BlackBerry device compresses and encrypts the user ID and password, and sends them through the BlackBerry Router to the BlackBerry Dispatcher over port 3101. The BlackBerry Dispatcher sends the request to the BlackBerry Collaboration Service over port 3201. If the BlackBerry Collaboration Service is located on a remote computer, the request remains encrypted using a Research In Motion proprietary protocol. The BlackBerry Collaboration Service checks the BlackBerry Configuration Database to find out if the maximum number of sessions has been reached, and performs one of the following actions: If the maximum number of sessions has been reached and a timeout limit is set, the BlackBerry Collaboration Service logs out any instant messaging sessions on BlackBerry devices that are out of coverage, and any instant messaging sessions that are no longer sending status messages to the BlackBerry Collaboration Service. If there are no idle sessions, the BlackBerry Collaboration Service sends a "Server Busy" status message to the BlackBerry device and rejects the login request. If the maximum number of sessions is not set and the number of sessions equals the total number that the HTTP persistent connection supports, the BlackBerry Collaboration Service sends a "Failed" status message to the BlackBerry device and rejects the login request. The BlackBerry Collaboration Service checks the BlackBerry Configuration Database to verify that the user has permission to use the collaboration client, and tries to authenticate the user using Integrated Windows Authentication; if the authentication is not successful, the BlackBerry Collaboration Service tries a forms-based login process instead. The BlackBerry Collaboration Service sends a login request in XML format to the Microsoft Office Communicator Web Access Server.

Process flow: Starting an instant messaging session using the BlackBerry Client for IBM Lotus Sametime
A user logs in to a collaboration client on a BlackBerry device. The BlackBerry device compresses and encrypts the user ID and password, and sends them through the BlackBerry Router to the BlackBerry Dispatcher over port 3101.
The BlackBerry Dispatcher sends the request to the BlackBerry Collaboration Service over port 3201. If the BlackBerry Collaboration Service is located on a remote computer, the request remains encrypted using a Research In Motion proprietary protocol. The BlackBerry Collaboration Service checks the BlackBerry Configuration Database to find out if the maximum number of sessions has been reached, and performs one of the following actions: If the maximum number of sessions has been reached and a timeout limit is set, the BlackBerry Collaboration Service logs out any instant messaging sessions on BlackBerry devices that are out of coverage, and any instant messaging sessions that are no longer sending status messages to the BlackBerry Collaboration Service. If there are no idle sessions, the BlackBerry Configuration Database sends a "Server Busy" status message to the BlackBerry device and rejects the login request. If the maximum number of sessions is not set and the number of sessions equals the total number that the IBM Lotus Sametime API supports, the BlackBerry Configuration Database sends a "Failed" status message to the BlackBerry device and rejects the login request. The BlackBerry Collaboration Service checks the BlackBerry Configuration Database to verify that the user has permission to use the collaboration client, and connects to the IBM Lotus Sametime server. The BlackBerry Collaboration Service starts an encrypted proxy connection over TCP/IP using the IBM Lotus Sametime API, reformats the request from the RIM proprietary protocol format into one that the IBM Lotus Sametime API supports, and sends the request. By default, the BlackBerry Collaboration Service starts the connection over port 1533 unless you specify a custom port number. The IBM Lotus Sametime server accepts the login request from the BlackBerry device, starts a dedicated TCP/IP connection for the session, and starts listening for requests from the BlackBerry device for that session. The BlackBerry Collaboration Service sends the acceptance, in encrypted and compressed format, through the BlackBerry Dispatcher to the BlackBerry device, and creates a cache of the connectivity information to maintain the new instant messaging session.
Process flow: Starting an instant messaging session using the BlackBerry Client for Novell GroupWise Messenger
A user logs in to a collaboration client on a BlackBerry device. The BlackBerry device compresses and encrypts the user ID and password and sends them through the BlackBerry Router to the BlackBerry Dispatcher over port 3101. The BlackBerry Dispatcher sends the request to the BlackBerry Collaboration Service over port 3201. If the BlackBerry Collaboration Service is located on a remote computer, the request remains encrypted using a Research In Motion proprietary protocol. The BlackBerry Collaboration Service checks the BlackBerry Configuration Database to find out if the maximum number of sessions has been reached, and performs one of the following actions: If the maximum number of sessions has been reached and a timeout limit is set, the BlackBerry Collaboration Service logs out any instant messaging sessions on BlackBerry devices that are out of coverage, and any instant messaging sessions that are no longer sending status messages to the BlackBerry Collaboration Service. If there are no idle sessions, the BlackBerry Configuration Database sends a "Server Busy" status message to the BlackBerry device and rejects the login request. If the maximum number of sessions is not set and the number of sessions equals the total number that the Novell GroupWise protocol supports, the BlackBerry device sends a "Failed (300)" status message to the BlackBerry device and rejects the login request. The BlackBerry Collaboration Service checks the BlackBerry Configuration Database to verify that the user has permission to use the collaboration client, and connects to the Novell GroupWise Messenger server. The BlackBerry Collaboration Service starts an encrypted proxy (SSL) connection using the Novell GroupWise protocol and sends the request. By default, the BlackBerry Collaboration Service opens this connection over port 8300, but it can also open this connection over a custom port number.

Process flow: Authenticating the data on a BlackBerry device without connecting to the BlackBerry Infrastructure
1. 2. A user connects a BlackBerry device to a computer that the BlackBerry Device Manager is running on. The BlackBerry Router uses a unique authentication protocol to verify that the user is a valid BlackBerry device user. This authentication sequence uses the authentication information for the BlackBerry Enterprise Server and the BlackBerry device that the SRP authentication sequence uses to validate the BlackBerry Enterprise Server before allowing it to connect to the BlackBerry Infrastructure. The BlackBerry Router cannot access the value of the master encryption key on the BlackBerry device and the BlackBerry Enterprise Server. The BlackBerry device and the BlackBerry Router use the BlackBerry Device Manager to send data to one another over the physical connection, behind the firewall. All data that the BlackBerry device and the BlackBerry Enterprise Server send to each other is compressed and encrypted. This data bypasses the wireless network. The movement of wireless data over an SRP connection is restored when the user disconnects the BlackBerry device from the computer or closes the BlackBerry Device Manager.
Process flow: Sending an application to a BlackBerry device over the wireless network
1. A BlackBerry Enterprise Server administrator adds a BlackBerry Java Application to a network drive, and adds the BlackBerry Java Application to a users software configuration in the BlackBerry Manager. The administrator specifies wireless delivery for the application. The BlackBerry Policy Service sends the software configuration to the BlackBerry Dispatcher.

3. 4. 5. 6.

The BlackBerry Dispatcher compresses the data, encrypts it with the master encryption key of the BlackBerry device, and sends it to the BlackBerry Router. The BlackBerry Router sends the data to the wireless network over port 3101. The wireless network verifies that the users PIN belongs to a valid BlackBerry device that is registered with the wireless network. The BlackBerry device receives and applies the updated software configuration, and compares the applications in the software configuration to the applications that are installed on the BlackBerry device.
If the applications do not match those that are defined in the software configuration (for example, an earlier version of an application is installed on the BlackBerry device), the BlackBerry device requests the required updates from the BlackBerry Policy Service. 7. The BlackBerry Policy Service receives the request and sends the applications to the BlackBerry Dispatcher. 8. The BlackBerry Dispatcher compresses the data, encrypts it with the master encryption key of the BlackBerry device, and sends it to the BlackBerry Router. 9. The BlackBerry Router sends the application data to the wireless network over port 3101, which verifies that the PIN belongs to a valid BlackBerry device that is registered with the wireless network. 10. The BlackBerry device decrypts and decompresses the application data, and installs the BlackBerry Java Application. The BlackBerry Java Application appears on the home screen of the BlackBerry device, or it appears in the list of installed applications on the BlackBerry device.

Glossary

AES Advanced Encryption Standard AJAX Asynchronous JavaScript and XML API application programming interface ASCII American Standard Code for Information Interchange
BlackBerry Domain A BlackBerry Domain consists of the BlackBerry Configuration Database with its users and any BlackBerry Enterprise Server instances that connect to it. BlackBerry MDS BlackBerry Mobile Data System CBC cipher block chaining DOM Document Object Model DRM Digital Rights Management ECC Elliptic Curve Cryptography GME The gateway message envelope (GME) protocol is a Research In Motion proprietary protocol that allows the transfer of compressed and encrypted data between the wireless network and BlackBerry devices. The protocol defines a routing layer that specifies the types of message contents allowed and the addressing information for the data. Gateways and routing components use this information to identify the type and source of the BlackBerry device data, and the appropriate destination service to route the data to. HTTP Hypertext Transfer Protocol
HTTPS Hypertext Transfer Protocol over Secure Sockets Layer Java ME Java Platform, Micro Edition JSON JavaScript Object Notation LTPA Lightweight Third-Party Authentication messaging server A messaging server sends and processes messages and provides collaboration services, such as updating and communicating calendar and address book information. MSMQ Microsoft Message Queuing MTLS Mutual Transport Layer Security NTLM NT LAN Manager PAC proxy auto-configuration PIN personal identification number PKI Public Key Infrastructure RTC real-time communications SIM Subscriber Identity Module SRP Server Routing Protocol SSL Secure Sockets Layer
TCP Transmission Control Protocol TCP/IP Transmission Control Protocol/Internet Protocol (TCP/IP) is a set of communication protocols that is used to transmit data over networks, such as the Internet. TLS Transport Layer Security UCS Universal Content Stream VPN virtual private network XML Extensible Markup Language XMPP Extensible Messaging and Presence Protocol

Legal notice

2008 Research In Motion Limited. All rights reserved. BlackBerry, RIM, Research In Motion, SureType and related trademarks, names, and logos are the property of Research In Motion Limited and are registered and/or used in the U.S. and countries around the world. Adobe and Acrobat are trademarks of Adobe Systems Incorporated. Corel and WordPerfect are trademarks of Corel Corporation. IBM, Lotus, and Sametime are trademarks of International Business Machines Corporation. Kerberos is a trademark of Massachusetts Institute of Technology. Microsoft, Excel, Outlook, PowerPoint, Visual Studio, and Windows are trademarks of Microsoft Corporation. Novell and GroupWise are trademarks of Novell, Inc. Open Mobile Alliance is a trademark of Open Mobile Alliance Ltd. RSA SecurID is a trademark of RSA Security. Java and JavaScript are trademarks of Sun Microsystems, Inc. All other trademarks are the property of their respective owners. The BlackBerry smartphone and other devices and/or associated software are protected by copyright, international treaties, and various patents, including one or more of the following U.S. patents: 6,278,442; 6,271,605; 6,219,694; 6,075,470; 6,073,318; D445,428; D433,460; D416,256. Other patents are registered or pending in the U.S. and in various countries around the world. Visit www.rim.com/patents for a list of RIM (as hereinafter defined) patents. This documentation including all documentation incorporated by reference herein such as documentation provided or made available at www.blackberry.com/go/docs is provided or made accessible "AS IS" and "AS AVAILABLE" and without condition, endorsement, guarantee, representation, or warranty of any kind by Research In Motion Limited and its affiliated companies ("RIM") and RIM assumes no responsibility for any typographical, technical, or other inaccuracies, errors, or omissions in this documentation. In order to protect RIM proprietary and confidential information and/or trade secrets, this documentation may describe some aspects of RIM technology in generalized terms. RIM reserves the right to periodically change information that is contained in this documentation; however, RIM makes no commitment to provide any such changes, updates, enhancements, or other additions to this documentation to you in a timely manner or at all. This documentation might contain references to third-party sources of information, hardware or software, products or services including components and content such as content protected by copyright and/or third-party web sites (collectively the "Third Party Products and Services"). RIM does not control, and is not responsible for, any Third Party Products and Services including, without limitation the content, accuracy, copyright compliance, compatibility, performance, trustworthiness, legality, decency, links, or any other aspect of Third Party Products and Services. The inclusion of a reference to Third Party Products and Services in this documentation does not imply endorsement by RIM of the Third Party Products and Services or the third party in any way. EXCEPT TO THE EXTENT SPECIFICALLY PROHIBITED BY APPLICABLE LAW IN YOUR JURISDICTION, ALL CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS, OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, ANY CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS OR WARRANTIES OF DURABILITY, FITNESS FOR A PARTICULAR PURPOSE OR USE, MERCHANTABILITY, MERCHANTABLE QUALITY, NON-INFRINGEMENT, SATISFACTORY QUALITY, OR TITLE, OR ARISING FROM A STATUTE OR CUSTOM OR A COURSE OF DEALING OR USAGE OF TRADE, OR RELATED TO THE DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NON-PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN, ARE HEREBY EXCLUDED. YOU MAY ALSO HAVE OTHER RIGHTS THAT VARY BY STATE OR PROVINCE. SOME JURISDICTIONS MAY NOT ALLOW THE EXCLUSION OR LIMITATION OF IMPLIED WARRANTIES AND

The terms of use of any RIM product or service are set out in a separate license or other agreement with RIM applicable thereto. NOTHING IN THIS DOCUMENTATION IS INTENDED TO SUPERSEDE ANY EXPRESS WRITTEN AGREEMENTS OR WARRANTIES PROVIDED BY RIM FOR PORTIONS OF ANY RIM PRODUCT OR SERVICE OTHER THAN THIS DOCUMENTATION. Certain features outlined in this documentation require a minimum version of BlackBerry Enterprise Server Software, BlackBerry Desktop Software, and/or BlackBerry Device Software and may require additional development or Third Party Products and Services for access to corporate applications. This product includes software developed by the Apache Software Foundation (www.apache.org/) and/or licensed pursuant to Apache License, Version 2.0 (www.apache.org/licenses/). For more information, see the NOTICE.txt file included with the software. Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Research In Motion Limited 295 Phillip Street Waterloo, ON N2L 3W8 Canada Research In Motion UK Limited 200 Bath Road Slough, Berkshire SL1 3XE United Kingdom Published in Canada

BlackBerry Enterprise Server for Novell GroupWise Compatibility Matrix January 31, 2011
2010 Research In Motion Limited. All rights reserved. www.rim.com

Page: 1

Operating Systems: BlackBerry Enterprise Server and BlackBerry Enterprise Server Components 32-bit

Windows Server 2000 SP4

5.0.1 4.1.7 4.1.6 x x x x x x

4.1.4 x x x

4.1.3 x x x
Windows Server 2003 xA Windows Server 2003 SP1 xA Windows Server 2003 SP2 xA Windows Server 2003 R2 xA Windows Server 2003 R2 SP2 xA Windows Server 2008 SP1 x Windows Server 2008 SP2

x x x x x

64-bit
Windows Server 2003 xA Windows Server 2003 SP1 xA Windows Server 2003 SP2 xA Windows Server 2003 R2 SP2 xA Windows Server 2008 SP1 x Windows Server 2008 SP2 Windows Server 2008 R2

x x x x

x x x x x x x x x x

Page: 2

Operating System:

BB Manager

5.0.1 4.1.7 4.1.6 32-bit
Windows 2000 SP4 NA Windows Server 2003 NA Windows Server 2003 SP1 NA Windows Server 2003 SP2 NA Windows Server 2003 R2 NA Windows Server 2003 R2 SP2 NA Windows Server 2008 SP1 NA Windows Server 2008 SP2 NA Windows XP Professional SP1 NA Windows XP Professional SP2 NA Windows XP Professional SP3 Windows Vista SP1 Windows Vista SP2 Windows 7 NA NA NA NA

4.1.4 x x x x

4.1.3 x x x x

x x x x x x x

x x x x x x
Windows Server 2003 NA Windows Server 2003 SP1 NA Windows Server 2003 SP2 NA Windows Server 2003 R2 SP2 NA Windows Server 2008 SP1 NA Windows Server 2008 SP2 NA Windows Server 2008 R2 NA Windows 7 NA

x x x x x

x x x x x x x x x x x
Server Virtualization: BlackBerry Enterprise Server and BlackBerry Enterprise Server Components VMware Infrastructure 3.0.0 VMware Infrastructure 3.0.1 VMware Infrastructure 3.0.2 VMware Infrastructure 3.5.0 VMware vSphere 4 Microsoft Hyper-V Server 2008 Microsoft Hyper-V Server 2008 R2

5.0.1 4.1.7 4.1.6 x x x

4.1.4 x

4.1.3 x

x x x

x x x

Page: 3

Mail Server

Novell GroupWise Server 6.5.1 or later
5.0.1 4.1.7 4.1.6 x Novell GroupWise Server 6.5.7 x
Novell GroupWise Server 7.0.0 Novell GroupWise Server 7.0.1 Novell GroupWise Server 7.0.2 Novell GroupWise Server 7.0.3 Novell GroupWise Server 7.0.4 Novell GroupWise Server 8.0.0 Novell GroupWise Server 8.0.1 Novell GroupWise Server 8.0.1 HP1 Novell GroupWise Server 8.0.2 Novell GroupWise Server 8.0.2 HP2

4.1.4 x x

4.1.3 x x

x x x x x B

x x x x
x Novell GroupWise Server 7.0.1 HP1 x x x x x x B B

Mail Software

Novell GroupWise Client 6.5.6 Novell GroupWise Client 6.5.6 Update 1 Novell GroupWise Client 6.5.6 Up1 Rev4 Novell GroupWise Client 6.5.6 Update 2 Novell GroupWise Client 6.5.6 Up2 with 7.0.2 FTF Novell GroupWise Client 6.5.7 Novell GroupWise Client 7.0.1 Novell GroupWise Client 7.0.2 Novell GroupWise Client 7.0.2 HP Novell GroupWise Client 7.0.3 Novell GroupWise Client 7.0.3 HP1 Novell GroupWise Client 7.0.3 HP2 Novell GroupWise Client 7.0.3 HP5 Novell GroupWise Client 7.0.4 Novell GroupWise Client 8.0.0 Novell GroupWise Client 8.0.0 HP1 Novell GroupWise Client 8.0.0 HP2 Novell GroupWise Client 8.0.1 Novell GroupWise Client 8.0.1 HP1 Novell GroupWise Client 8.0.2 Novell GroupWise Server 8.0.2 HP2

5.0.1 4.1.7 4.1.6

N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A

4.1.4 x x x x x x

4.1.3 x x x x x x
x x x x x x x x x x x x B

x x x x x x x x x x x x

Page: 4

Database Server 32-bit

MSDE 2000 SP3

5.0.1 4.1.7 4.1.6

x x x x
Microsoft SQL Server 2000 SP3 Microsoft SQL Server 2000 SP4 Microsoft SQL Server 2005 Microsoft SQL Server 2005 SP2 Microsoft SQL Server 2005 SP3

x x x

Microsoft SQL 2005 Express x Microsoft SQL 2005 Express SP2 x Microsoft SQL 2005 Express SP3

x x x x x x x x x x x

Microsoft SQL Server 2008 x Microsoft SQL Server 2008 SP1 Microsoft SQL Server 2008 SP2 Microsoft SQL 2008 R2
Microsoft SQL 2008 Express x Microsoft SQL 2008 Express SP1

x x x

x x x x x x
Microsoft SQL Server 2005 Microsoft SQL Server 2005 SP2 Microsoft SQL Server 2005 SP3
Microsoft SQL Server 2008 Microsoft SQL Server 2008 SP1 Microsoft SQL Server 2008 SP2 Microsoft SQL 2008 R2
Web Browser: BlackBerry Enterprise Server and BlackBerry Enterprise Server Components Microsoft Internet Explorer v6.0 Microsoft Internet Explorer v7.0 Microsoft Internet Explorer v8.0

NA NA NA NA NA NA NA NA NA

4.1.4

4.1.3

Page: 5

Web Browser for Accessing: BlackBerry Enterprise Server
Administration (BAS-WC) & BMS
Microsoft Internet Explorer v6.0 x Microsoft Internet Explorer v7.0 Microsoft Internet Explorer v8.0 Mozilla Firefox 3.6 x Google Chrome 4.0 x Safari 4 for Mac x.NET Runtime Microsoft.NET v1.1.NET v2.0.NET v3.0.NET v3.5 5.0.1 4.1.7 4.1.6 4.1.4 4.1.3
BlackBerry Enterprise Server will currently not install under this platform. Database version bundled with respective BlackBerry Enterprise Server service pack or major release. For MDSS/MDS-IS, refer to BlackBerry KB14930 for more information. Installer will not permit the install on v4.1.6 and below. BlackBerry Enterprise Server will not install with Windows 2008 and Hyper-V Server 2008 combination Installer will not permit the install on v4.1.6 and below. Will Support SOAP setting (remember to set on both BlackBerry Enterprise Server installation and GroupWise Mail Server) Currently suppported if using client version 7.0.3 A known compatibility issue with Novell GroupWise Server 7.0.4 will not allow a BlackBerry Enterprise Server running in SOAP connectivity mode to function. Please note, OAPI connection mode is not affected by this. Please refer to BlackBerry KB21707 for more information. There is a known compatibility issue with GroupWise 8.0.2, please refer to KB24352 for more information or apply MR1 for resolution. A: There is a known compatibility issue with Windows Server 2003, please refer to KB24504 for more details. B: Support for GroupWise 8.0.2 on BESG 5.0.1 and 4.1.7 requires MR1

Page: 6

2010 Research In Motion Limited. All rights reserved. BlackBerry, RIM, Research In Motion, SureType, SurePress and related trademarks, names and logos are the property of Research In Motion Limited and are registered and/or used in the U.S. and countries around the world. Novell and GroupWise are trademarks of Novell, Inc. Microsoft, Internet Explorer, Hyper-V, SQL Server, Windows, Windows Server and Windows Vista are trademarks of Microsoft Corporation. Google and Google Chrome are trademarks of Google Inc. Mozilla and Firefox are trademarks of Mozilla Foundation. VMware is a trademark of VMware, Inc. Safari is a trademark of Apple Inc. All other trademarks are the property of their respective owners. This documentation including any and all documentation incorporated by reference herein, including but not limited to those provided or made available by hyperlink, is provided or made accessible "AS IS" and AS AVAILABLE and without condition, endorsement, guarantee, representation or warranty of any kind by Research In Motion Limited and its affiliated companies ("RIM") and RIM assumes no responsibility for any typographical, technical, or other inaccuracies, errors or omissions in this documentation. In order to protect RIM proprietary and confidential information and/or trade secrets, this documentation may describe some aspects of RIM technology in generalized terms. RIM reserves the right to periodically change information that is contained in this documentation; however, RIM makes no commitment to provide any such changes, updates, enhancements, or other additions to this documentation to you in a timely manner or at all. This documentation might contain references to third-party sources of information, hardware or software, products or services including components and content such as content protected by copyright and/or third-party web sites (collectively the "Third Party Products and Services). RIM does not control, and is not responsible for, any Third Party Products and Services including, without limitation the content, accuracy, copyright compliance, compatibility, performance, trustworthiness, legality, decency, links, or any other aspect of Third Party Products and Services. The inclusion of a reference to Third Party Products and Services in this documentation does not imply endorsement by RIM of the Third Party Products and Services or the third party in any way. EXCEPT TO THE EXTENT SPECIFICALLY PROHIBITED BY APPLICABLE LAW IN YOUR JURISDICTION, ALL CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS, OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, ANY CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS OR WARRANTIES OF DURABILITY, FITNESS FOR A PARTICULAR PURPOSE OR USE, MERCHANTABILITY, MERCHANTABLE QUALITY, NONINFRINGEMENT, SATISFACTORY QUALITY, OR TITLE, OR ARISING FROM A STATUTE OR CUSTOM OR A COURSE OF DEALING OR USAGE OF TRADE, OR RELATED TO THE DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NON-PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN, ARE HEREBY EXCLUDED. YOU MAY ALSO HAVE OTHER RIGHTS THAT VARY BY STATE OR PROVINCE. SOME JURISDICTIONS MAY NOT ALLOW THE EXCLUSION OR LIMITATION OF IMPLIED WARRANTIES AND CONDITIONS. TO THE EXTENT PERMITTED BY LAW, ANY IMPLIED WARRANTIES OR CONDITIONS RELATING TO THE DOCUMENTATION TO THE EXTENT THEY CANNOT BE EXCLUDED AS SET OUT ABOVE, BUT CAN BE LIMITED, ARE HEREBY LIMITED TO NINETY (90) DAYS FROM THE DATE YOU FIRST ACQUIRED THE DOCUMENTATION OR THE ITEM THAT IS THE SUBJECT OF THE CLAIM. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, IN NO EVENT SHALL RIM BE LIABLE FOR ANY TYPE OF DAMAGES RELATED TO THIS DOCUMENTATION OR ITS USE, OR THE PERFORMANCE OR NON-PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN INCLUDING WITHOUT LIMITATION ANY OF THE FOLLOWING DAMAGES: DIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, INDIRECT, SPECIAL, PUNITIVE, OR AGGRAVATED DAMAGES, DAMAGES FOR LOSS OF PROFITS OR REVENUES, FAILURE TO REALIZE ANY EXPECTED SAVINGS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, LOSS OF BUSINESS OPPORTUNITY, OR CORRUPTION OR LOSS OF DATA, FAILURES TO TRANSMIT OR RECEIVE ANY DATA, PROBLEMS ASSOCIATED WITH ANY APPLICATIONS USED IN CONJUNCTION WITH RIM PRODUCTS OR SERVICES, DOWNTIME COSTS, LOSS OF THE USE OF RIM PRODUCTS OR SERVICES OR ANY PORTION THEREOF OR OF ANY AIRTIME SERVICES, COST OF SUBSTITUTE GOODS, COSTS OF COVER, FACILITIES OR SERVICES, COST OF CAPITAL, OR OTHER SIMILAR PECUNIARY LOSSES ,WHETHER OR NOT SUCH DAMAGES WERE FORESEEN OR UNFORESEEN, AND EVEN IF RIM HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, RIM SHALL HAVE NO OTHER OBLIGATION, DUTY, OR LIABILITY WHATSOEVER IN CONTRACT, TORT, OR OTHERWISE TO YOU INCLUDING ANY LIABILITY FOR NEGLIGENCE OR STRICT LIABILITY. THE LIMITATIONS, EXCLUSIONS, AND DISCLAIMERS HEREIN SHALL APPLY: (A) IRRESPECTIVE OF THE NATURE OF THE CAUSE OF ACTION, DEMAND, OR ACTION BY YOU INCLUDING BUT NOT LIMITED TO BREACH OF CONTRACT, NEGLIGENCE, TORT, STRICT LIABILITY OR ANY OTHER LEGAL THEORY AND SHALL SURVIVE A FUNDAMENTAL BREACH OR BREACHES OR THE FAILURE OF THE ESSENTIAL PURPOSE OF THIS AGREEMENT OR OF ANY REMEDY CONTAINED HEREIN; AND (B) TO RIM AND ITS AFFILIATED COMPANIES, THEIR SUCCESSORS, ASSIGNS, AGENTS, SUPPLIERS (INCLUDING AIRTIME SERVICE PROVIDERS), AUTHORIZED RIM DISTRIBUTORS (ALSO INCLUDING AIRTIME SERVICE PROVIDERS) AND THEIR RESPECTIVE DIRECTORS, EMPLOYEES AND INDEPENDENT CONTRACTORS. IN ADDITION TO THE LIMITATIONS AND EXCLUSIONS SET OUT ABOVE, IN NO EVENT SHALL ANY DIRECTOR, EMPLOYEE, AGENT, DISTRIBUTOR, SUPPLIER, INDEPENDENT CONTRACTOR OF RIM OR ANY AFFILIATES OF RIM HAVE ANY LIABILITY ARISING FROM OR RELATED TO THE DOCUMENTATION. Prior to subscribing for, installing or using any Third Party Products and Services it is your responsibility to ensure that your airtime service provider has agreed to support all of their features. Some airtime service providers may not offer Internet browsing functionality with a subscription to BlackBerry Internet Service. Check with your service provider for availability, roaming arrangements, service plans and features. Installation or use of Third Party Products and Services with RIMs products and services may require one or more patent, trademark, copyright or other licenses in order to avoid infringement or violation of third party rights. You are solely responsible for determining whether to use, Third Party Products and Services and if any third party licenses are required to do so. If required you are responsible for acquiring them. You should not install or use Third Party Products and Services until all necessary licenses have been acquired. Any Third Party Products and Services that are provided with RIMs products and services are provided as a convenience to you and are provided AS IS with no express or implied conditions, endorsements, guarantees, representations or warranties of any kind by RIM and RIM assumes no liability whatsoever, in relation thereto. Your use of Third Party Products and Services shall be governed by and subject to you agreeing to the terms of separate licenses and other agreements applicable thereto with third parties, except to the extent expressly covered by a license or other agreement with RIM. Certain features outlined in this documentation require a minimum version of BlackBerry Enterprise Server, BlackBerry Enterprise Server Express, BlackBerry Desktop Software, and/or BlackBerry Device Software. The terms of use of any RIM product or service are set out in a separate license or other agreement with RIM applicable thereto. NOTHING IN THIS DOCUMENTATION IS INTENDED TO SUPERSEDE ANY EXPRESS WRITTEN AGREEMENTS OR WARRANTIES PROVIDED BY RIM FOR PORTIONS OF ANY RIM PRODUCT OR SERVICE OTHER THAN THIS DOCUMENTATION.

Research In Motion Limited 295 Phillip Street Waterloo, ON N2L 3W8 Canada Research In Motion UK Limited Centrum House 36 Station Road Egham, Surrey TW20 9LF United Kingdom

Page: 7