RIM To Offer Cloud-Based BlackBerry Enterprise Server

Research in Motion is reportedly readying a cloud-based version of its BlackBerry Enterprise Server (BES), which should give smaller businesses the chance to use an encrypted email system.

The BlackBerry Enterprise Server is the encryption server that Indian authorities want to access, in its dispute with RIM over security. If RIM allowed this, it would potentially give Indian security officials the chance to decrypt, and if required, monitor text messages and emails being sent and received by BlackBerry users in the country.

India, along with other countries, has been threatening to ban BlackBerry services from its country, but two two parities have now apparently reached a solution amid talk of a two year grace period.

“RIM has now delivered a solution that enables India’s wireless carriers to address their lawful access requirements for our consumer messaging services, which include BlackBerry Messenger (BBM) and BlackBerry Internet Service (BIS) email,” RIM told eWEEK Europe UK in an emailed statement, saying that the solution had been delivered well before the mutually agreed deadline of 31 January.

“We also wish to underscore, once again that this enablement of lawful access does not extend to BlackBerry Enterprise Server, which is essentially an enterprise VPN solution,” RIM added. “RIM cannot access information encrypted through BES given that neither RIM nor the wireless operators are ever in possession of the encryption keys.”

Cloud BES

Meanwhile RIM has said it will launch a cloud-based version of BES by the end of 2011.

This offering could appeal to organisations that aren’t interested in provisioning physical BES servers themselves. Instead it could allow small businesses or even individual users to gain access to a encrypted, and hence secure email system.

Details at this stage are sketchy, especially how it would be rolled out on a global basis, and whether RIM would use its telecom carrier partners or host the cloud service in its own data centres.

RIM did not respond to eWEEK Europe UK at the time of writing regarding the BES cloud offering, but a clue was provided in another media report.

“We will be launching a cloud service,” RIM Vice President Pete Devenyi told Mobilized in an interview. However, Devenyi said the service offered by RIM directly won’t cover as many types of email servers as its software is capable of supporting, thereby leaving room for partners.

“We’re not going to launch a cloud service for everything, for every combination,” he said. “There are going to be mail servers out there that we don’t connect with through our cloud service. There will be other partners that choose to connect to other mail server providers and they may offer a hosted service on their own.”

Security Warnings

The talk of the launch of a cloud version of the BlackBerry Enterprise Server comes after RIM issued two separate security advisories. The warnings are for BlackBerry smartphone users as well as BES administrators, because of newly discovered security flaws in many versions of RIM’s BlackBerry handheld software and in BES.

The flaw that concerns BlackBerry smartphone users is reportedly a “partial Denial of Service (DoS)” attack, in which websites with hidden malicious code could freeze the handset’s web browser. The device or browser itself needs to be rebooted.

The second more serious flaw apparently concerns the PDF Distiller component of BES.

“The vulnerability could allow a malicious individual to cause buffer overflow errors, which may result in arbitrary code execution on the computer that hosts the BlackBerry Attachment Service,” RIM was reported as saying. “While code execution is possible, an attack is more likely to result in the PDF rendering process terminating before it completes. In the event of such an unexpected process termination, the PDF rendering process will restart automatically but will not resume processing the same PDF file.”