[Orinoko]

Hi,


I witnessed a strange problem this morning; Two devices (8120 & 9700) are only updating their messages when they are unlocked. So if a device has pending emails they are received as a bunch (all with the same date/time) when the user unlocks their BB.


We have recently updated to BS 5.0.2 and as part of this upgrade we have enforced content protection across all devices, we have had the usual problems with address book's and split SMS and I suspect this particular issue is related to encryption.


Has anyone seen this before?


Thanks in advance.

[BESMstr]

Hi Orinko,

This could be a "Content Protection" issue. If you have content protection enabled in the IT Policy then the BlackBerry cannot receive email until it has been unlocked and the encryption key verified. This is operation as designed and cannot be changed.

If you don't have content protection enabled, then it is another issue.

To check, open the IT Policy assigned to the user, click on "edit" and then click on the "Security" tab. Scroll down and look at the "Content Protection Strength" and if it isn't blank then it is enabled.

Good Luck.

--BESMstr

[BESMstr]

Orinoko,

Apologies for mispelling your name.

--BESMstr

[cyclmpc]

Originally Posted by BESMstr

Hi Orinko,

This could be a "Content Protection" issue. If you have content protection enabled in the IT Policy then the BlackBerry cannot receive email until it has been unlocked and the encryption key verified. This is operation as designed and cannot be changed.

--BESMstr

I do not believe that is accurate.

A BB device uses the ECC private key to decrypt a message that it receives when it is locked. In addition, enabling Content Protection adds a small padlock icon to the locked screen, different from the large padlock icon. Once you receive messages, that icon turns from black to the color of your other notifications, like email messages, PINs, or SMS messages. And as the last item, but very obvious item, you also get the LED that blinks.

I have Content Protection enabled and can assure you that these functions work.

Please take a review of the Security Technical Overview for the details of how this works. This is the Exchange 5.0.2 version.

http://docs.blackberry.com/en/admin/...1-5.0.2-US.pdf

[BESMstr]

Interesting explanations and likely correct.

However, my comments come from experience and RIM Premier Support.

I have many users that work in a secure locations that do not allow any mobile communication device to enter.

These users normally leave their BBs in a locker and when they return of course they are locked however their radios are on and technically the device should still be receiving email; but they do not.

As soon as they unlock the device they receive all emails that were sent during their shift, but not before they unlock the device. RIM informed me that this was due to "Content Protection" being enabled and that BES was functioning as designed. The explanation provided was that the emails could not be decrypted while the device was locked due to the Content Protection.

Of course, I'm open minded and willing to learn if there is a better explanation. Plus, if there is a solution, I would be thrilled to learn it.

--BESMstr

[cyclmpc]

Originally Posted by BESMstr

Interesting explanations and likely correct.

However, my comments come from experience and RIM Premier Support.

I have many users that work in a secure locations that do not allow any mobile communication device to enter.

These users normally leave their BBs in a locker and when they return of course they are locked however their radios are on and technically the device should still be receiving email; but they do not.

As soon as they unlock the device they receive all emails that were sent during their shift, but not before they unlock the device. RIM informed me that this was due to "Content Protection" being enabled and that BES was functioning as designed. The explanation provided was that the emails could not be decrypted while the device was locked due to the Content Protection.

Of course, I'm open minded and willing to learn if there is a better explanation. Plus, if there is a solution, I would be thrilled to learn it.

--BESMstr

This was bugging me for a bit and I think I found out why we are having different experiences. There is a policy in the security tab of the policy called Force Content Protection of Master Key. This would explain it, I believe. When locked, this policy will prevent the radio from receiving datagrams and therefore cannot decrypt.

[MarkF]

Originally Posted by cyclmpc

This was bugging me for a bit and I think I found out why we are having different experiences. There is a policy in the security tab of the policy called Force Content Protection of Master Key. This would explain it, I believe. When locked, this policy will prevent the radio from receiving datagrams and therefore cannot decrypt.

Thanks for clarifying. I can't think of a reason why one would want to use that Master Key. The delivered message timestamps alone would be annoying.

[freakinvibe]

We have "Force Content Protection of Master Key" set to "Yes" and we do not experience this problem. We still get e-mail messages while the device is locked (device OS versions 4.6, 5.0, 6.0).

But the side-effect of "Force Content Protection of Master Key" is the following: After a reset of the BB (i.e. battery pull), there is no data connection. We have to unlock the device once to establish a data connection.

After that, if the device locks again, e-mails are still coming in.

[Orinoko]

Hi all and thanks for the replies. I don't think this is policy related as we have the same policy applied to all devices and the problem appears to be only affecting the lower end devices, predominatly 8310 and 8520's.

The security potion of the policy is set to :

Content Protection Strength: Strong
Force Memory Clean When Idle: Yes
Force Content Protection of Master Keys: No
External File System Encryption Level: Encrypt to User Password (excluding multi-media directories)
Encryption On On-Board Device Memory Media Files: Required

I've got a couple fo 8520 in front of me, one is fine and the other occsionally only gets mails when unlocked. Both are the same version, policy and on Wifi, the only difference is the "Branding Version" but I don't think this matters.

Any more thoughts?

[cyclmpc]

Originally Posted by Orinoko

Hi all and thanks for the replies. I don't think this is policy related as we have the same policy applied to all devices and the problem appears to be only affecting the lower end devices, predominatly 8310 and 8520's.

The security potion of the policy is set to :

Content Protection Strength: Strong
Force Memory Clean When Idle: Yes
Force Content Protection of Master Keys: No
External File System Encryption Level: Encrypt to User Password (excluding multi-media directories)
Encryption On On-Board Device Memory Media Files: Required

I've got a couple fo 8520 in front of me, one is fine and the other occsionally only gets mails when unlocked. Both are the same version, policy and on Wifi, the only difference is the "Branding Version" but I don't think this matters.

Any more thoughts?

Just throwing this out there...If the determining factor is being locked/unlocked and you are only seeing this on lower/older devices, I have to wonder if this has to do with available interal memory? Content protection does slow down performance on any device that runs 256 MB or less. You are on the "Strong" setting. The keys used to encrypt/decrypt are in flash memory. I wonder if you would see more of this if you upped the setting to stonger or strongest to lengthen the key, thereby making these odler devices take longer to encrypt/decrypt. How much available memory are on the devices you have in front of you? Like I said, just a thought and seeing if it sticks...