Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry UEM 12.12
  3. Planning and Architecture
  4. BlackBerry UEM Cloud Architecture and Data Flows
  5. Data flow: Activating a BlackBerry Dynamics app on a Samsung Knox Workspace device when BlackBerry Secure Connect Plus is enabled

Data flow: Activating a 
BlackBerry Dynamics
 app on a 
Samsung Knox Workspace
 device when 
BlackBerry Secure Connect Plus
 is enabled

This data flow describes how data travels when a 
BlackBerry Dynamics
 app in the work space on a 
Samsung Knox Workspace
 device is activated over a 
BlackBerry Secure Connect Plus
 connection.
Diagram showing the steps and components mentioned in the following data flow.
  1. An administrator assigns one or more 
    BlackBerry Dynamics
     apps to a user.
  2. The user installs the apps on the 
    Samsung Knox
     device.
  3. One of the following events occurs:
    1. If this is the first 
      BlackBerry Dynamics
       app activated in the 
      Knox Workspace
      , the administrator generates an access key to send to the user or the user logs into 
      BlackBerry UEM Self-Service
       and generates an access key.
    2. If the 
      Knox Workspace
       already contains an activated 
      BlackBerry Dynamics
       app, the activated app sends an access key request and the randomly generated nonce to 
      BlackBerry UEM Cloud
      .
  4. The device sends a request through a TLS tunnel, over port 443, to the 
    BlackBerry Infrastructure
     to request a secure tunnel to the work network. The signal is encrypted by default using FIPS-140 certified 
    Certicom
     libraries. The signaling tunnel is encrypted end to end.
  5. BlackBerry Secure Connect Plus
     receives the request from the 
    BlackBerry Infrastructure
     through port 3101.
  6. The device and 
    BlackBerry Secure Connect Plus
     negotiate the tunnel parameters and establish a secure tunnel for the device through the 
    BlackBerry Infrastructure
    . The tunnel is authenticated and encrypted end to end with DTLS. 
  7. The activated 
    BlackBerry Dynamics
     app sends the access key request and the randomly generated nonce from 
    BlackBerry Secure Connect Plus
     to 
    BlackBerry UEM Cloud
    .
  8. BlackBerry UEM Cloud
     sends the requested access key from 
    BlackBerry Secure Connect Plus
     to the activated 
    BlackBerry Dynamics
     app.
  9. The activated 
    BlackBerry Dynamics
     app provides the access key to the new 
    BlackBerry Dynamics
     app.
  10. The 
    BlackBerry Dynamics
     app establishes a connection using 
    BlackBerry Secure Connect Plus
     with the 
    BlackBerry Dynamics NOC
     and sends it a hash of the access key.
  11. The 
    BlackBerry Dynamics NOC
     verifies the access key and, if the verification is successful, sends provisioning data, including the master link key and connection information, using 
    BlackBerry Secure Connect Plus
     to the 
    BlackBerry Dynamics
     app.
  12. The 
    BlackBerry Dynamics
     app begins the process of establishing a shared secret with 
    BlackBerry UEM Cloud
     by sending a secure channel setup message to the 
    BlackBerry Dynamics NOC
     using 
    BlackBerry Secure Connect Plus
    .
    The secure channel setup message contains a user identifier (email address), ephemeral ECDH public key, a salt value, a token, and a MAC of the message to authenticate the sender and guarantee the integrity of the message.
  13. The 
    BlackBerry Dynamics NOC
     forwards the secure channel setup message to 
    BlackBerry Proxy
     over an HTTPS connection.
  14. BlackBerry Proxy
     then forwards the secure channel setup message to 
    BlackBerry UEM Cloud
    .
  15. BlackBerry UEM Cloud
     responds to the 
    BlackBerry Dynamics
     app using 
    BlackBerry Secure Connect Plus
    . The response contains a new ephemeral ECDH public key and a MAC of the message.
  16. The 
    BlackBerry Dynamics
     app requests provisioning data from 
    BlackBerry UEM Cloud
    . The request travels through 
    BlackBerry Secure Connect Plus
    , the 
    BlackBerry Dynamics NOC
    , and 
    BlackBerry Proxy
    .
  17. BlackBerry UEM Cloud
     sends encrypted provisioning data, including the master session key, app configuration data, and a list of 
    BlackBerry Proxy
     instances, to the 
    BlackBerry Dynamics
     app to complete the activation.