Login with:

Forgot your password?

BlackBerry PlayBook Security & Encryption with Mobile Fusion Explained

Mobile Fusion Architecture

Since RIM first announced BlackBerry Mobile Fusion a few months back administrators have been asking me how RIM secures work data and applications on the PlayBook. Now that Mobile Fusion has been released in its first stage we have a much better idea of what is going on along. RIM has even released a 68 page document on how the BlackBerry PlayBook is secured and segmented with OS 2.0 and Mobile Fusion. Certain media outlets have been saying that RIM is not leveraging their infrastructure but to simplify it all RIM is essentially tunneling all of your data transport using both TLS for the transport layer security while encrypting data packets with Message Keys to protect the integrity of the messages. It gets a little more complicated with Wi-Fi 802.1x on company networks and over VPN but the concepts are similar.

Mobile FUsion and PlayBook2

What is most often confused by people is what RIM means by BlackBerry Balance on the PlayBook. RIM has divided the PlayBook into three perimeters. There is the Work perimeter, Bridge perimeter, and personal perimeter. Both the Work and Bridge perimeters are fully encrypted. The Work perimeter encrypts files using XTS-AES-256 together with a security record that also includes 512-bit random salt and several attributes of the file. That security record is the encrypted using the domain key which is yet another 512-bit random key. The process is similar for BlackBerry Bridge data which is isolated into its own perimeter and encrypted with XTS-AES-256 encryption. Sadly the PlayBook does not encrypt the personal perimeter.

Mobile FUsion and PlayBook  

Where things start to get really confusing is the fact that certain apps live in multiple perimeters which is where BlackBerry Balance comes into play. For example, the new contacts, calendar, and messages apps can live both in the personal and the work perimeter if you have Mobile Fusion activated. That is where things get really sticky and you need a whole chart to explain to you how RIM combines the two while keeping them separate. For example, it provides administrators the option to remotely wipe your work contacts, calendar, and messages without touching your personal data (with a few exceptions like browser cache). They also limit what you can access from apps that are designated personal, work, or bridge.

The fun of Mobile Fusion2

All in all I highly recommend you check out the whole 68 page document RIM has published on the subject on how the domains are segregated. I will copy a bit of how complex it gets below but the full PDF can be found here.

The fun of Mobile Fusion

PS: I know I am oversimplifying quite a bit of this but it you really were interested you would have read the 68 page document RIM put out. :)

4 total comments on this postSubmit your comment!
  1. Excellent Break down and great article! :) Thank you for this info :)

  2. Great post. Maybe you send it over to that cnet writer Roger Cheng. Dude was clueless.

  3. Thanks for all the detail. It makes you really appreciate the work RIM has been conducting in the back-end – something many of us will not see.

  4. Great article :)
    I love the concept of perimeters, but people shouldn’t be forced to shell out cash for BES to be able to protect their data, especially if they’re already using a BlackBerry smartphone. The PIM suite that comes with Bridge is simply ridiculous compared to what BES users have access to now with PB OS 2.0.

BlackBerry© is a registered Trademark of BlackBerry Limited. BerryReview is in no way affiliated with BlackBerry Limited though sometimes their lawyers send us love letters...

Copyright © 2007-‘2014’ BerryReview LLC