Knox Platform for Enterprise 3.6 release notes

April 2020

The newly launched Samsung Galaxy Note20 and Note20 Ultra provide many compelling features for enterprises adapting to new ways of working. Samsung Knox 3.6 extends Samsung's commitment to helping you customize and secure enterprise devices and lead through differentiated solutions.

The Knox 3.6 platform is built into the firmware of the new Samsung Galaxy Note20 and Note20 Ultra. Other devices such as the Galaxy S20 receive firmware updates with Knox 3.6, following the release schedule of mobile service providers.

XCover Pro hardware keys

Get the most out of the new ruggedized Samsung XCover devices by customizing the XCover and Top hardware keys. The latest version of the Knox Service Plugin lets you:

• Set up short or long key presses to launch selected device apps
• Disable hardware key options in a device's Android Settings menu

For more information, see Device Key Mapping.

Deep Settings Customization

This release expands the list of deep settings introduced with Knox 3.4, delivering options to configure the following settings through the Knox Service Plugin.

Setting	Description	Customize through	Options
Wi-Fi Direct	Allows two devices to establish a direct, peer-to-peer Wi-Fi connection without requiring a wireless router.	Device Restrictions	Allow / Do not allow
Keyboard language shortcut	Allows virtual keyboard shortcuts to change the keyboard language	Configure values in settings menu	On / Off / Use specific value / Allow user to modify setting / Hide setting

Knox VPN in work profiles

The Android VPN Management for Knox app extends the capabilities of the built-in Android VPN client, which provides only basic configuration as seen in the Android Settings app. The Knox app enables many more advanced Knox VPN capabilities on Samsung Knox devices.

Previously, the Android VPN Management for Knox app supported only Device Owner (DO) mode. Knox 3.6 now supports Profile Owner (PO) mode, enabling the same advanced Knox VPN capabilities from within a work profile. When installed inside a work profile, the new Knox app (v3.0.5) accesses an end-user/CA certificate inside the PO keystore to secure data transmission from within the work profile.

To deploy the new Android VPN Management for Knox Strongswan app in a work profile:

1. Log in to Knox Partner Portal > Dashboard > Download.
2. Download the new Android VPN Management for Knox Strongswan.
3. Configure a UEM profile to push and deploy the APK in a work profile.

For more info about the advanced Knox VPN capabilities, see the Knox White Paper.

Certificate authentication for USB-tethered laptops

With Knox 3.5, Samsung Knox devices could extend a VPN tunnel to a laptop connected through USB. This provided laptop users with the ability to access internal enterprise resources using our defense-grade mobile VPN network. In addition to providing convenience when laptops do not have network connectivity, this offers company cost savings by removing the need to buy additional VPN licenses for laptops.

Knox 3.6 enhances this feature with better security. There is a new app that enables Samsung Knox devices to verify that a laptop is owned by the device user. When the user connects a laptop to a Samsung Knox device via USB, the app validates the user certificate on the laptop with allowed certificates identified by the IT admin for the device.

To deploy the new app to authenticate connected laptops:

1. Log in to Knox Partner Portal > Dashboard > Download.
2. Download the new USB Tethering Authentication for VPN.
3. Configure a UEM profile to push and deploy the APK to devices.
4. Identify the certificates of laptops allowed to connect via USB to each device for VPN access.