企業(yè)移動(dòng)消息的應(yīng)用用與管理

MBL220基于Exchange2003和WindowsMobile企業(yè)移動(dòng)消息最佳實(shí)戰(zhàn)議程企業(yè)移動(dòng)消息應(yīng)用Exchange2003SP2WindowsMobile5withMSFP企業(yè)Exchange消息服務(wù)實(shí)踐移動(dòng)消息安全、管理、擴(kuò)展企業(yè)移動(dòng)消息應(yīng)用

豐富的實(shí)現(xiàn)多目的設(shè)備終端無處不在的低成本的無線網(wǎng)絡(luò)逐漸增強(qiáng)的安全管理基礎(chǔ)架構(gòu)日漸成熟的企業(yè)移動(dòng)消息應(yīng)用ExchangeServer2003/WindowsMobile5LCS2005/MobileOfficeCommunicatorCRM2.0/MobileCRMMobileOAMobileERP…企業(yè)移動(dòng)消息應(yīng)用的挑戰(zhàn)總擁有成本連接性Scalability安全性DeviceandNetwork管理性ProvisioningandSupport擴(kuò)展性LeveraginginfrastructureFocus:MicrosoftExchangeServer

2003ServicePack2MicrosoftWindowsMobile5MessagingandSecurity

FeaturePackArchitectureBestPractices企業(yè)移動(dòng)消息應(yīng)用的起點(diǎn)：E-MailE-Mail已經(jīng)是企業(yè)的核心應(yīng)用已經(jīng)存在多種成熟設(shè)備和解決方案

ExchangeServer2003是第一個(gè)集成的解決方案結(jié)合ISA可以提供更高的可用性和管理性結(jié)合IT策略可以實(shí)現(xiàn)更高的安全性移動(dòng)終端的重要更新WindowsMobile5永久存儲(chǔ)按需同步聯(lián)系人圖片MessagingandSecurityFeaturePack(MSFP)數(shù)據(jù)壓縮(GZIP)基于證書的認(rèn)證強(qiáng)制安全策略在線聯(lián)系人查找（GAL）直推電郵(Direct-PushTechnology)S/MIME簽名和加密被ExchangeServer2003SP2支持Service

Pack2Windows

Mobile5Exchange2003SP2ExchangeServer2003ServicePack2更高的安全性CertificatebasedauthenticationLocalandRemoteWipecapabilityCentralcontrolofdevicepolicy直推技術(shù)很多的新特色DirectorysearchPicturesinContactsGZipExchangeServer2003移動(dòng)訪問服務(wù)WindowsCEbaseddevicesPocketPC,PocketPCPhoneEdition,Smartphone2002WindowsMobileTm2003(AUTDsupport)WindowsMobile5(AUTD&DPsupport)OutlookMobileAccess(real-time)MicrosoftActiveSync(synchronization)RPC/HTTPorOWAExchange2003MobileServicesSP2LaptopCellularPhonePocketPCSmartPhone基于WindowsMobile的OWA訪問小屏幕瀏覽PocketInternetExplorer（singlewindows）支持OWA

Limitedframe

基于WindowsMobile的OMA訪問BasedonWAP/WMLLegacyMobilePhonesActiveSync訪問機(jī)制AirSyncHTTP(basicauthentication)[SSL](preferred)IISMASSYNC.DLLISAPI

IISDAVEX.DLLISAPIFrontEndServerBackEndServerDS_ACCESSActiveDirectoryReadUserProperties&obtainKerberosTGTWebDAVHTTP(Integratedauthentication)ClearExchangeServerActiveSync的應(yīng)用Mobile5.0withMSFP在線聯(lián)系人查找（GAL）需要WindowsMobile5+MSFP集成的應(yīng)用導(dǎo)入GAL記錄

到本地聯(lián)系人列表Service

Pack2Windows

Mobile5Exchange直推技術(shù)真正的AUTD解決方案（always-up-to-date）不需要SMS通知支持所有的PIM數(shù)據(jù):Inbox,Calendar,ContactsandTasks不增加額外的數(shù)據(jù)流量伸縮性：全球范圍不需要額外的軟件及服務(wù)器安裝實(shí)現(xiàn)條件服務(wù)器配置激活—缺省配置支持

“SP2-ready”

的設(shè)備

該方案依賴于實(shí)時(shí)連接需要調(diào)整防火墻的連接超時(shí)時(shí)間為:15-30mins直推技術(shù)（DirectPush）Time=23minTime=15minTime=0minTime=15minTime=23minDevice:如果我在15分鐘內(nèi)有郵件請(qǐng)告訴我，否則告訴我“沒有郵件”.Server:“沒有郵件”Server:“你有新郵件”Device:給我郵件Device:如果我在15分鐘內(nèi)有郵件請(qǐng)告訴我，否則告訴我“沒有郵件”.DirectPushMail技術(shù)原理(心跳時(shí)間為15min)WindowsMobileDevicewithMSFPServerrunningExchange2003SP2Heartbeat:370Bytes/heartbeatx4heartbeats/hourx24hx30days=1,06MB(Noconsiderationtoblockrounding)ExchangeServer2003SP2配置企業(yè)Exchange消息服務(wù)

實(shí)踐架構(gòu)總攬防火墻一個(gè)或多個(gè)至少支持端口過濾支持反向代理（Publish）

前端服務(wù)器可以是企業(yè)版或標(biāo)準(zhǔn)版Pub/privateStorecanberemoved可以部署在：Internet,DMZ，insidecorporatefirewall后端服務(wù)器InsidecorporatefirewallStoresmailboxesandpublicfolders

FirewallPorts

443,993,995ExchangeServer

2003Front-End

ServersExchange2003ServerActiveDirectoryGlobalCatalogServerExchange2003ServerExchange2003ServerInternetFE/BEDeploymentScenarios

Singlefirewall（簡(jiǎn)單）Firewall

Ports

443,993,

995ExchangeFront-End

ServersExchange2003ServersActiveDirectoryGlobalCatalogServerExchange2003ServersExchange2003ServersFirewall

Ports,80

143,110,LDAP,etcDMZInternetFE/BEDeploymentScenarios

DMZ/Perimeternetwork（安全）FirewallPort

443ISAExchange2003ServerAD/GCExchange2003ServerExchange2003ServerExchangeFEFirewall

Ports443or80InternetISAReverseProxy

DMZ/Perimeternetwork（推薦）移動(dòng)消息安全

managementdevicesair

transmissions

PAN

LANWANpublic

networksprivate

networks

123applicationsmobilitywireless4VPNtraditionalsecurityMobile的安全訪問MabirWindowsCEDUTSWindowsCEBRADOR29Dec041Feb05Locknut(Gavno)Vlasco21Nov04Skulls20June04Cabir17Jul045Aug048Mar05Comwar7Mar05Dampig12Aug04Qdial4Apr05Fontal6Apr05Drever18Mar05Hobbes15Apr05Doomed4Jul05=SymbianOS(Nokia,etc)=WindowsCE(HP,etc)Source:TrendMicroMobile的安全威脅StoleninformationHostintrusion,stolendeviceUnauthorizednetwork/applicationaccessCompromisedcredentials,hostintrusionViruspropagationVirussusceptibilityLostinformationLost,stolenordamageddeviceMobile的內(nèi)容安全

（訪問安全）簡(jiǎn)單鎖定加密Privatekeystorage?Smartcard/TPMHashprivatekey(dictionaryattack)Couplewithstrong

passwordpolicies防止不安全重啟動(dòng)AnalogoustoBIOSpasswordandDrivelock身份認(rèn)證Username/PasswordEncryptedondeviceClientCertificatePreventsISAfromSSL-bridgingNon-trivialenrollmentOne-timePassword安全連接InfrastructuresimilartoOWA(HTTP)SSLcertificate-checkingbytheaccessdeviceRootCA“Known”Certificateauthorities:Thawte(serverandPremiumserverSecureServerGTECybertrustGlobalsignEClass2and3PublicPrimaryCertificatesRootCAoftheSSLCertificateMustbeinstalledontheWindowsMobileTMclientCertificateforVisualServerRootCAIssuedby2.IISpresentsthevitualServerSSLCertificate1.HTTPSconnectionActiveSyncClientValidationofRootCA強(qiáng)制安全策略目標(biāo):確保移動(dòng)設(shè)備啟用了安全策略內(nèi)容：PINcodestrengthRemoteWipeSpecificwebUIDeviceLockingExchangeServers的安全前后端直接不啟用SSLTrustedphysical/switchednetworkIPseceverythingorspecificportssuchas80IISEnableIISloggingDisablenon-essentialscriptmappingsAlwayskeepuptodateonavailablefixes使用IPsecIPsec用于加密Exchange前后端的傳輸

IPsec策略Exchangefrontend:meany;TCPany80;EncryptExchangebackend:Respondonly使用GPO推IPsecpoliciesExchange2003前后端使用Kerberosauthentication推薦配置不要end-to-end直接連接使用SSl橋接（ISA）在前端進(jìn)行認(rèn)證前后端之間使用IPSec

ISAandFE需要配置證書移動(dòng)消息管理使用移動(dòng)設(shè)備管理MDM

（MobileDeviceManagement）降低TCO,特別是技術(shù)支持消耗Centralconsole,reporting更可靠的平臺(tái)部署商務(wù)營(yíng)運(yùn)應(yīng)用程序（line-of-business）更容易使用和被用戶接受安全:可保障的配置的完整性不同的MDM產(chǎn)品基于桌面管理的AltirisMicrosoftSMS整體解決方案的GoodIntellisync*OneBridgeMDM標(biāo)準(zhǔn)的iAnywhereAfariamFormation*MDM成熟等級(jí)Infancy資產(chǎn)管理基礎(chǔ)軟件更新Adolescence軟件更新配置管理設(shè)備強(qiáng)制安全Mature數(shù)據(jù)發(fā)布和同步多平臺(tái)支持基于策略的軟件分發(fā)空中下載啟動(dòng)和維護(hù)

（OTA）擴(kuò)展的桌面管理企業(yè)MDM需求IntegratedManagementConsoleDirectory(AD/LDAP)integrationCentralizedPoliciesPolicypollingUsercannotremoveScreen-lock/Idle-lock移動(dòng)消息服務(wù)擴(kuò)展Mobility的擴(kuò)展體系架構(gòu)ManagementandSecurityInfrastructure

provisioning,usersupport,loadbalancing

identitymanagement,authorizationAccessLayerConnectivity

Roaming