Enabling DualDAR with Knox Service Plugin

Prerequisites

• Enable DualDAR in Knox Mobile Enrollment or Knox Mobile Enrollment Direct profile configuration
• UEM to deploy Knox Service Plugin
• Knox DualDAR license Key
• Device with DualDAR 1.1.0 or higher

Supported devices

Android 9

^*Enabling DualDAR 1.0.2 and 1.0.3 with Knox Service Plugin is not supported.

For more information on equivalent devices, see the NIAP evaluation.

Android 10

For more information on equivalent devices, see the NIAP evaluation.

Android 11

For more information on equivalent devices, see the NIAP evaluation.

Android 12

For more information on equivalent devices, see the Spring NIAP evaluation and Fall NIAP evaluation.

Android 13

For more information on equivalent devices, see the Spring NIAP evaluation and Fall NIAP evaluation.

Android 14

For more information on equivalent devices, see the NIAP evaluation.

How to enable DualDAR for Fully managed or WP-C devices

1. On your UEM portal, go to KSP Configuration.

2. On the KPE configuration page:

   1. If your UEM uses profiles, enter the profile name.

   2. Enter the KPE Premium key.

      

3. Under Device-wide policies, set Enable device policy controls to True.

   

4. Set Enable password policy controls with KSP > Passcode Policy to True.

5. Expand Dual Data-at-Rest (DAR) Encryption, then set the following:

   1. Enable Dual DAR Controls — true.

   2. Data lock timeout type — Select a data lock type. This feature locks the credential encrypted (CE) storage and flushes the key from memory. Once locked, apps can’t use the CE until the device user provides the credential again.

   3. Data lock timeout value (in minutes) — Enter a lockout duration higher than 5.

   4. Restrict access to device encrypted (DE) storage — false.

   5. List of apps approved to access DE storage — Enter one or more app package names For example, com.android.messages.

   6. Set password minimum length for inner layer — Enter a password minimum length for the inner layer password at DualDAR for fully managed devices.

   7. Set a new password for inner layer — Enter a new password for the inner layer at DualDAR for fully managed devices. The password must be stronger than the minimum quality. For example, if the minimum quality is numeric, then you must enter an alphanumeric password.

   

How to enable DualDAR for work profiles

1. On your UEM portal, go to the KSP Configuration.

2. Under the initial KPE Screen.

   1. Enter profile name if applicable (some UEMs don’t require this).

   2. Enter the KPE Premium key.

      

3. Click on Work Profile Policies (which drops down additional configurations) under Enable Work Profiles set to True.

   

4. Set Enable password policy controls with KSP > Passcode Policy to True.

5. Set Work Profile Configuration > Enable Work Profile Configuration Controls to True.

   

6. Click on Dual Data-at-Rest (DAR) Encryption (which drops down additional configurations).

   1. Enable Dual DAR Controls set to True.

   2. Data lock timeout type set to any option in the drop down.

      • Use this control to set a data lock type. This locks the credential encrypted (CE) storage and flushes the key from memory. Once locked, apps can’t use the CE until user provides the credential again.

   3. Data lock timeout value (in minutes) set to any value above 1.

      • Use this control to specify the data lock timeout value in minutes. To use this feature, you must set the data lock timeout type to specified value.

   4. List of apps approved to access DE storage.

      • List application’s package name (example com.android.messages).

      

How to verify if DualDAR is enabled on a device

Verify through Knox Service Plugin

1. Go to your Work Profile and click on Knox Service Plugin.

2. Click on Configuration on date & time.

3. Configuration results show Dual Data-at-rest(DAR) Encryption as successful.

Verify through device settings

1. Go to Settings (gear icon).

2. Navigate to About phone > Software information.

3. Under the Knox version section, check the DualDAR version.

   If DualDAR is enabled, it’s indicated next to the DualDAR version. If not, only the DualDAR version number is shown.