Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry UEM 12.10
  3. BlackBerry UEM Architecture and Data Flows
  4. Receiving device configuration updates
  5. Data flow: Activating a BlackBerry Dynamics app on a Samsung KNOX Workspace device when BlackBerry Secure Connect Plus is enabled

Data flow: Activating a 
BlackBerry Dynamics
 app on a 
Samsung KNOX Workspace
 device when 
BlackBerry Secure Connect Plus
 is enabled

This data flow describes how data travels when a 
BlackBerry Dynamics
 app in the work space on a 
Samsung KNOX Workspace
 device is activated over a 
BlackBerry Secure Connect Plus
 connection.
 
Diagram showing the steps and components used when activating a BlackBerry Dynamics app on a Samsung KNOX Workspace device using BlackBerry Secure Connect Plus
 
  1. An administrator assigns one or more 
    BlackBerry Dynamics
     apps to a user.
  2. The user installs the app on the 
    Samsung KNOX
     device.
  3. If the device is not a 
    Samsung KNOX Workspace
     device and the 
    BlackBerry UEM Client
     is installed on the device, the 
    BlackBerry Dynamics
     app performs the following actions:
    1. Establishes a secure channel with the 
      BlackBerry UEM Client
       on the device. Data exchanged over the secure channel is encrypted using an AES-CBC cipher.
    2. Asks the 
      BlackBerry UEM Client
       to request an access key for the new 
      BlackBerry Dynamics
       app. The request includes a randomly generated nonce.
  4. The device sends a request through a TLS tunnel, over port 443, to the 
    BlackBerry Infrastructure
     to request a secure tunnel to the work network. The signal is encrypted by default using FIPS-140 certified 
    Certicom
     libraries. The signaling tunnel is encrypted end to end.
  5. BlackBerry Secure Connect Plus
     receives the request from the 
    BlackBerry Infrastructure
     through port 3101.
  6. The device and 
    BlackBerry Secure Connect Plus
     negotiate the tunnel parameters and establish a secure tunnel for the device through the 
    BlackBerry Infrastructure
    . The tunnel is authenticated and encrypted end to end with DTLS. 
  7. The 
    BlackBerry UEM Client
     sends the access key request and the randomly generated nonce from 
    BlackBerry Secure Connect Plus
     to the 
    BlackBerry UEM Core
    .
  8. The 
    BlackBerry UEM Core
     sends the requested access key from 
    BlackBerry Secure Connect Plus
     to the 
    BlackBerry UEM Client
    .
  9. The 
    BlackBerry UEM Client
     provides the access key to the 
    BlackBerry Dynamics
     app.
  10. The 
    BlackBerry Dynamics
     app establishes a connection using 
    BlackBerry Secure Connect Plus
     with the 
    BlackBerry Dynamics NOC
     and sends it a hash of the access key.
  11. The 
    BlackBerry Dynamics NOC
     verifies the access key and, if the verification is successful, sends provisioning data, including the master link key and connection information, using 
    BlackBerry Secure Connect Plus
     to the 
    BlackBerry Dynamics
     app.
  12. The 
    BlackBerry Dynamics
     app begins the process of establishing a shared secret with the 
    BlackBerry UEM Core
     by sending a secure channel setup message to the 
    BlackBerry Dynamics NOC
     using 
    BlackBerry Secure Connect Plus
    .
    The secure channel setup message contains a user identifier (email address), ephemeral ECDH public key, a salt value, a token, and a MAC of the message to authenticate the sender and guarantee the integrity of the message.
  13. The 
    BlackBerry Dynamics NOC
     forwards the secure channel setup message to 
    BlackBerry Proxy
     over an HTTPS connection.
  14. BlackBerry Proxy
     forwards the secure channel setup message to the 
    BlackBerry UEM Core
    .
  15.  The 
    BlackBerry UEM Core
     responds to the 
    BlackBerry Dynamics
     app using 
    BlackBerry Secure Connect Plus
    . The response contains a new ephemeral ECDH public key and a MAC of the message.
  16. The 
    BlackBerry Dynamics
     app requests provisioning data from the 
    BlackBerry UEM Core
    . The request travels through 
    BlackBerry Secure Connect Plus
    , the 
    BlackBerry Dynamics NOC
    , and 
    BlackBerry Proxy
    .
  17. The 
    BlackBerry UEM Core
     sends encrypted provisioning data, including the master session key, app configuration data, and a list of 
    BlackBerry Proxy
     instances, to the 
    BlackBerry Dynamics
     app to complete the activation.