- *BASICS*
- The Knox Ecosystem
- Samsung Knox Portal
- Knox Cloud Services
- General Knox Support
- Knox Licenses
- *FOR IT ADMINS*
- Knox Suite
- Knox Platform for Enterprise
- Introduction
- White paper
- Before you begin
- Get started with UEMs
- Introduction
- Blackberry UEM
- IBM MaaS360
- Microsoft Intune
- MobileIron Cloud
- MobileIron Core
- Samsung Knox Manage
- SOTI MobiControl
- VMware Workspace ONE UEM
- Knox Service Plugin
- Release notes
- Migrate to Android 11
- FAQs
- Troubleshoot
- KBAs
- Knox Mobile Enrollment
- Introduction
- Get started
- Features
- Register resellers
- Add an admin
- Create profiles
- Google device owner support
- MDM compatibility matrices
- Device users
- Activity log
- Enroll and unenroll devices
- Configure devices
- Provide KME feedback
- Use the Knox Deployment App (KDA)
- Recover Google FRP locked devices using KME
- Role-based access control (RBAC)
- Release notes
- FAQs
- Troubleshoot
- KBAs
- Knox Configure
- Mobile
- Wearables
- Shared Device
- Knox Capture
- Introduction
- How it works
- How-to videos
- IT admins: Get started
- Getting started with Knox Capture
- Step 1: Launch Knox Capture
- Step 2: Create a scanning profile
- Step 3: Select apps and activities
- Step 4: Configure the scanner
- Step 5: Set keystroke output rules
- Step 6: Test apps in your configuration
- Step 7: Share your configuration
- Step 8: Deploy Knox Capture in Managed mode
- End users: Get started
- Features
- Release notes
- FAQs
- Troubleshoot
- Knox Manage
- Introduction
- How-to videos
- Get started
- Configure
- Licenses
- Organization
- Users
- Sync user information
- Groups
- Devices
- Content
- Applications
- Profile
- Knox E-FOTA
- Certificates
- Advanced settings
- Monitor
- Kiosk devices
- Remote Support
- Active Directory
- Microsoft Exchange
- Mobile Admin
- Appendix
- Release notes
- FAQs
- KBAs
- Knox E-FOTA
- Introduction
- White paper
- Knox E-FOTA One
- Introduction
- How-to videos
- Get started
- Features
- EMM integration
- Appendix
- Release notes
- FAQs
- Troubleshoot
- KBAs
- Migrate from Knox E-FOTA Advanced to Knox E-FOTA One
- Knox E-FOTA Advanced
- Knox E-FOTA on MDM
- Samsung Care+ for Business
- *FOR RESELLERS*
- Knox Deployment Program
- *FOR MANAGED SERVICE PROVIDERS*
- Knox MSP Program

Knox White Paper
Feature Summary
For those wanting a quick reference to the security, manageability, and advanced VPN features offered by Samsung Knox devices, review the summary below. For details about how Samsung Knox differentiates compared to other OEM devices, speak with your Samsung account manager or contact us if you do not have one.
Feature | Summary |
---|---|
Security | |
Hardware-Backed Keystore | This feature is a hardware-dependent claim. All Samsung Knox devices have keystores backed by hardware protections. |
Secure Lockdown on Tampering
|
Upon detecting critical security compromises, the system locks down sensitive areas, preventing unauthorized enterprise data access and leakage. When there is evidence of device tampering, Samsung prevents users from accessing the data in a work profile or on a fully managed device. To unlock the device again, one needs to factory reset the device, which wipes out the data inside. |
Remote Device Health | Get visibility into which devices have security issues like unauthorized firmware, allowing you to take action right away. Knox checks the record of IMEI tampering and whether the warranty bit is blown. |
Keystore Support of eSE & Other High-Security Storage | Numerous services require credentials for access. They include Wi-Fi, VPN, email, and websites. In order to safely store sensitive credentials, developers need to write new credential storage code for any new storage hardware. Knox provides a plug-and-play framework for credential management across a variety of hardware, eliminating the need to develop in-house credential management implementation logic. |
Sensitive Data Protection (SDP) | SDP keeps data encrypted while a work profile or fully managed device is locked, even during runtime when other solutions decrypt data. |
Real-Time Kernel Protection (RKP) |
Drastically limits possible attacks on Samsung devices with best-in-class kernel attack prevention features:
|
DualDAR Encryption |
With a single instance of encryption, potential flaws in the implementation can result in a single point of failure. KPE DualDAR provides two independent layers of encryption to achieve an even higher level of reliability by enabling redundancies in protecting Data-At-Rest. You can further strengthen data encryption by using a third-party cryptographic module to customize encryption. This dual encryption is required for classified deployments. Note that there is an additional license fee to use DualDAR. |
Enforced Two-Factor Authentication |
Enables IT admins to force end-user two-factor authentication for logging in to a work profile or fully managed device. Authentication can be done through biometrics (fingerprint, iris, face) or more traditional means (password, PIN, pattern). |
Government-Grade Common Criteria Mode |
Simplifies configuring devices into a compliant state for Common Criteria (defense) deployments. |
App Isolation Groups (SEAMS) |
Unlike classic app containers with a GUI, you can manage "invisible" app isolation groups to protect a set of apps from any other set. Up to 300 groupings are possible. |
Secure Certificate Enrollment Agents (SCEP, CMP, CMC_EST protocols) | Samsung provides a free set of certificate enrollment agents that follow the latest security protocols. There is no reason to enroll certificates insecurely, or implement your own protocols. |
Manageability | |
Audit Log | Provides comprehensive and detailed device audit logs, recording numerous extra types of events in the areas of system security, authentication, app management, data protection, network connectivity, and peripheral control. Satisfies government requirements for security audit trails. |
Device Software Updates | Knox E-FOTA running on top of KPE enables IT to deploy a particular firmware version that is not necessarily the latest version. These selective firmware updates provide a stable environment for business apps and services. KPE allows firmware updates under certain conditions such as a particular time of the day, network (Wi-Fi or mobile), or battery power status. These features help optimize productivity and ensure a successful upgrade. |
Remote Control | KPE enables IT to remotely control devices, by injecting finger, keyboard, and mouse events. This is in addition to remotely viewing devices. |
Customization |
Allows IT to customize various aspects of the device software and UI. In addition to more common capabilities, KPE provides these additional abilities:
|
Granular Roaming Controls |
IT can control which mission-critical apps are allowed to use data during mobile roaming, which often incurs high call, text, and data rates. AE only allows IT admins to disable mobile data – it can't block calls or app update downloads while allowing other mobile data use. KPE Premium also enables separate roaming controls for each APN. |
Admin Device Lock | Knox allows IT admins to remotely lock a device in a way that a user cannot unlock at all. In addition, Knox allows controlling the personal space and work profile separately. For example, the personal space can be open while the work profile is locked. |
Data Sharing Policy | KPE provides data sync of Contacts, Calendar, and Notifications. Also, KPE provides a unified Calendar with both personal and work events. |
Firewall Management | Industry-exclusive ability to set on-device firewall rules. KPE can also notify IT when employees attempt to visit blocked domains. |
Granular Device Policies | Meet compliance or other deployment requirements with policies not supported on AE for SMS/MMS disclaimers, RCS/SMS/MMS logging, call restrictions, read and write restrictions on SD cards, granular Bluetooth profile restrictions, and even manage DeX deployment settings. |
Advanced Workspace Configuration | Enables strict policy enforcement for Bluetooth, SD Card, USB, and other technologies inside the work profile, while allowing full use outside the work profile. |
Unlock using Active Directory Credentials |
No need to make employees remember separate credentials for Windows laptops and mobile devices. Device users can use their existing Active Directory credentials to unlock their devices. |
Split Billing (Dual APNs) | Enables enterprises to pay only for the data usage of their approved business apps. Employees are responsible for fees for personal data usage. |
Network Analytics | Allows IT to deploy network threat detection solutions without granting such tools complete access to all network traffic. For details about the insights provided, see Network Platform Analytics. |
VPN | |
VPN Granularity: Per-App, Per-Container, or Whole Device | KPE provides the most granular VPN controls. In addition to configuring a VPN for an app, work profile, or fully managed device, KPE can configure a single VPN for the entire device — that is, work profile as well as fully managed device. |
Non-bypassable VPN | KPE has strict controls that block any traffic from bypassing a configured VPN, even in edge cases where a device is rebooting, a VPN client crashes, an app accesses the physical interface directly, or an app using a VPN is deleted and re-installed. |
On-Demand VPN | KPE can activate a VPN only when a target app is launched. Such a feature allows customers to save on service fees from unused VPNs. |
HTTP Proxy over VPN |
KPE has a wide range of network protocols that can use HTTP Proxy.
|
VPN Chaining | Allows the use of two VPN tunnels to double-encrypt traffic, enhance anonymity, and prevent a single security bug in a VPN layer from compromising network encryption. |