Data flow: Sending and receiving work data using BlackBerry Secure Connect Plus
BlackBerry Secure Connect Plus
This data flow describes how data travels when an app on a device that is configured to use
BlackBerry Secure Connect Plusaccesses an application or content server in your organization.
- The user opens an app to access work data from a content or application server behind your organization's firewall.
- OnAndroid Enterprise, andSamsung Knox Workspacedevices, all work apps can useBlackBerry Secure Connect Plus.
- OniOSdevices, you specify whether all apps or only specified apps can useBlackBerry Secure Connect Plus.
- The device determines that a secure IP tunnel is the most direct, cost-efficient method available to connect to the application or content server to retrieve the data and sends a requests through a TLS tunnel, over port 443, to theBlackBerry Infrastructurefor a secure tunnel to the work network. By default, the signal is encrypted using FIPS-140 certified Certicom libraries. The signaling tunnel is encrypted end-to-end.
- BlackBerry Secure Connect Plusreceives the request from theBlackBerry Infrastructurethrough port 3101.
- The device andBlackBerry Secure Connect Plusnegotiate the tunnel parameters and establish a secure tunnel for the device through theBlackBerry Infrastructure. The tunnel is authenticated and encrypted end-to-end with DTLS.
- The app uses the tunnel to connect to the application or content server using standard IPv4 protocols (TCP and UDP).
- BlackBerry Secure Connect Plustransfers the IP data to and from your organization's network.BlackBerry Secure Connect Plusencrypts and decrypts traffic using FIPS-140 certified Certicom libraries.
- The app receives and displays the data on the device.
- As long as the tunnel is open, supported apps use it to access network resources. When the tunnel is no longer the best available method to connect to your organization's network,BlackBerry Secure Connect Plusterminates it.ForiOSdevices, if you configure per-app VPN forBlackBerry Secure Connect Plus, the tunnel eventually terminates when none of the configured apps are in use.