Blackberry PRD-09695-004 Technical Overview - Page 20

Proximity authentication Proximity authentication is an authentication method that permits a user to unlock a BlackBerry® device using the BlackBerry device password and the BlackBerry® Smart Card Reader within Bluetooth® technology range of the BlackBerry device. To unlock a BlackBerry device, the user moves the BlackBerry Smart Card Reader within Bluetooth technology range of the BlackBerry device, clicks the unlock button on the BlackBerry device, and types the BlackBerry device password. Proximity authentication does not require the user to use a smart card. By default, if you or a user turns on proximity authentication and the user does not move the BlackBerry Smart Card Reader within Bluetooth technology range, the user can unlock the BlackBerry device using the BlackBerry device password. To require a user to use proximity authentication, you must change the value of the Allowed Authentication Mechanisms IT policy rule to Proximity. BlackBerry® Device Software version 5.0 and later and BlackBerry Smart Card Reader version 2.0 and later support proximity authentication. You must verify that the IT policies that you can use to manage proximity authentication are available on your organization's BlackBerry® Enterprise Server. BlackBerry Enterprise Server version 5.0 SP1 and later includes the IT policies that you require to manage proximity authentication. You cannot use proximity authentication to log in to a Bluetooth enabled computer. Locking a BlackBerry device when the BlackBerry Smart Card Reader moves out of Bluetooth technology range If your organization uses proximity authentication, you or a user can configure a BlackBerry® device to lock when a user moves the BlackBerry® Smart Card Reader out of Bluetooth® technology range. If you or a user configures this option, the BlackBerry device closes the Bluetooth connection to the BlackBerry Smart Card Reader and locks when the user moves out of Bluetooth technology range. To make this option mandatory, you must change the Lock on Proximity Authenticator Disconnect IT policy rule to Yes. When you change this rule to Yes, the user cannot change the option on the BlackBerry device. Configuring a BlackBerry device to use a specific BlackBerry Smart Card Reader You can use the password options on a BlackBerry® device to configure a specific BlackBerry® Smart Card Reader with a BlackBerry device. You or a user can configure proximity authentication so that the user cannot change the BlackBerry Smart Card Reader that the user uses to unlock the BlackBerry device. When you or the user configures a specific BlackBerry Smart Card Reader with the BlackBerry device, a user with malicious intent cannot use another BlackBerry Smart Card Reader to unlock the BlackBerry device and access data. If the battery power level for a specific BlackBerry Smart Card Reader that you or a user configures with a BlackBerry device is empty, the user cannot unlock the BlackBerry device until the user recharges the battery. For more information, see the online help on the BlackBerry device. Two-factor content protection Content protection is designed to encrypt data on a BlackBerry® device when the BlackBerry device is locked. When you configure two-factor content protection, the content encryption key encrypts the user data on the BlackBerry device, the BlackBerry device generates a key using the BlackBerry device password that encrypts the content encryption key, and the private key that is stored on the smart card encrypts the key that the BlackBerry device generates. When you configure two-factor content protection, the content encryption key is not transferred from the BlackBerry device to the BlackBerry® Smart Card Reader. Two-factor content protection requires the BlackBerry device password, a smart card, and an authentication certificate that is stored on the BlackBerry device. The authentication certificate must contain the public key for the private key that is stored on the smart card. If the authentication certificate expires or is revoked before a user can replace it, the user must delete all BlackBerry device data from the BlackBerry device before the BlackBerry device can recover. This feature is designed to protect the user data on the BlackBerry device if the BlackBerry device is lost or stolen. You or a user can configure two-factor content protection. By default, if a user has a smart card and an authentication certificate on the BlackBerry device, the user can turn on two-factor content protection. To make two- 20