Biometric authentication

Traditional user authentication relies on things you know or have, like a password or ID card. These are susceptible to human mistakes, phishing, and duplication. Biometric authentication validates a personal trait, for example: fingerprints, irises, or facial features. Biometrics can lower the false acceptance rate (FAR). Users can use biometrics to unlock devices and app containers. Through Samsung Pass, users can also use biometrics to log into apps and websites.

Unique advantages of Knox Biometrics

The Knox Platform provides the following in addition to standard Android capabilities:

• Secure storage — On Samsung devices, the authentication software doesn't share or distribute the biometric measurements of any user. The measurements are stored in a format that can't be used to reproduce the original biometric, and can only be accessed and decoded within the specific part of the TrustZone that has access to the biometric hardware. Biometrics are used only on the correct device and by the correct user. This functionality means there is a lower chance of someone spoofing biometrics credentials to access a device.
• Enforced two-factor authentication (2FA) — The Knox Platform provides IT admins the option to enforce two-factor authentication with biometrics for the Work container. For example, a user can be required to authenticate with an iris scan in addition to a standard device unlock method (password, PIN, pattern). While Android provides some combinations of two-factor authentication, the Knox Platform allows you to take your security one step further with biometric integration.
• Samsung Pass integration — Apps can use Samsung Pass APIs to enforce biometric authentication in place of a traditional login and password. This authentication method can save an organization a large amount of password management overhead, while further increasing device security. Samsung Pass features the ability to:
• Support Fast IDentification Online (FIDO) authentication
• Register and deregister a user’s biometrics
• Respond to remote wipe requests
• Manage authentication transactions
• Work in the Secure World of the TrustZone
  
• Enterprise credentials override — As required by enterprise policy, Knox devices allow you to enforce the use of enterprise AD credentials to unlock a device or Work container. This setting overrides any biometrics set by the user, and forces them to use their enterprise credentials.