Menu

Biometric authentication

Traditional user authentication relies on things you know or have, like a password or ID card. These are susceptible to human mistakes, phishing, and duplication. Biometric authentication validates a personal trait, for example: fingerprints, irises, or facial features. Biometrics can lower the false acceptance rate (FAR). Users can use biometrics to unlock devices and app containers. Through Samsung Pass, users can also use biometrics to log into apps and websites.

Advantages of Knox Biometrics

The Knox Platform provides the following in addition to standard Android capabilities:

  • Secure storage — On Samsung devices, the authentication software doesn't share or distribute the biometric measurements of any user. The measurements are stored in a format that can't be used to reproduce the original biometric, and can only be accessed and decoded within the specific part of the TrustZone that has access to the biometric hardware. Biometrics are used only on the correct device and by the correct user. This functionality means there is a lower chance of someone spoofing biometrics credentials to access a device.
  • Enforced two-factor authentication (2FA) — The Knox Platform provides IT admins the option to enforce two-factor authentication with biometrics for the Work container. For example, a user can be required to authenticate with an iris scan in addition to a standard device unlock method (password, PIN, pattern). While Android provides some combinations of two-factor authentication, the Knox Platform allows you to take your security one step further with biometric integration.
  • Samsung Pass integration — Apps can use Samsung Pass APIs to enforce biometric authentication in place of a traditional login and password. This authentication method can save an organization a large amount of password management overhead, while further increasing device security. Samsung Pass features the ability to:
    • Support Fast IDentification Online (FIDO) authentication
    • Register and deregister a user’s biometrics
    • Respond to remote wipe requests
    • Manage authentication transactions
    • Work in the Secure World of the TrustZone
  • Enterprise credentials override — As required by enterprise policy, Knox devices allow you to enforce the use of enterprise AD credentials to unlock a device or Work container. This setting overrides any biometrics set by the user, and forces them to use their enterprise credentials.

Key Takeaways

Use Case

  • Problem — Employees in the field need to authenticate themselves quickly to use the phone while they're working. They each intermittently require access to eight different accounts throughout the day.
  • Knox Platform solution — The IT admin at the enterprise uses Knox Platform and Samsung Pass to link all eight accounts to each employees finger print. This biometric login method saves employee time and IT overhead.

Benefits

  • Faster and easier than traditional authentication
  • Preferred by consumers

Requirements

  • Samsung Knox device with:
    • Fingerprint scanning — Knox platform v2.2 (for example, Galaxy S5) or higher
    • Iris scanning — Knox platform v2.7 (for example, Galaxy Note 7) or higher
    • Facial recognition — Galaxy S8 or higher
  • EMM support
  • Samsung pass integration