Knox is a proprietary security and management framework pre-installed on most Samsung mobile devices. Its primary purpose is to provide organizations with a toolset for managing work devices, such as employee mobile phones or interactive kiosks. Samsung Galaxy hardware, as well as software such as Secure Folder and Samsung Wallet, make use of the Knox framework.
Knox's features fall within three categories: data security, device manageability, and VPN capability. Knox also provides web-based services for organizations to manage their devices. Organizations can customize their managed mobile devices by configuring various functions, including pre-loaded applications, settings, boot-up animations, home screens, and lock screens.
Knox provides more granular control over the standard work profile to manage capabilities found only on Samsung devices. As of December 2020, organizations can use specific Samsung mobile device cameras as barcode scanners, using Knox services to capture and analyze the data.
Overview
Samsung Knox provides hardware and software security features that allow business and personal content to coexist on the same device. Knox integrates web services to assist organizations in managing fleets of mobile devices, which allows IT administrators to register new devices, identify a Unified Endpoint Management (UEM) system, define the organizational rules that govern the use of devices, and upgrade device firmware over-the-air. Developers can integrate these features with their applications using Knox SDKs and REST APIs.
Services
Samsung Knox provides the following web-based services for organizations:
To manage mobile devices: Knox Suite, Knox Platform for Enterprise, Knox Mobile Enrollment, Knox Manage, and Knox E-FOTA. To customize and rebrand devices: Knox Configure To capture and analyze data: Knox Capture, Knox Peripheral Management, Knox Asset Intelligence
Most services are registered and accessed through the Samsung Knox web consoles, with some accessed through the Samsung Knox SDK.
Knox Capture
Knox Capture uses a Samsung mobile device’s camera to capture all major barcode symbologies like UPC, Code 39, EAN, and QR. Through a web console, IT admins can manage the input, formatting, and output configuration of scanned barcode data, and associate a device app (for example, an Internet browser for QR data).
Knox Asset Intelligence
Knox Asset Intelligence helps organizations improve the management, productivity, and lifecycle of mobile devices. Through a web console, IT admins can monitor device battery management, app usage insights, comprehensive device tracking, and detailed Wi-Fi analytics.
Software
Container
When Samsung Knox debuted with the Galaxy S3 in 2013, it included a proprietary container feature that stored security-sensitive applications and data inside a protected execution environment. Device users could switch between personal and business applications by tapping a Knox icon in the lower-left corner of the device screen. The proprietary container, later called the Knox Workspace, was managed by organizations through a UEM system.
Samsung then spun off consumer versions of the container feature, which did not require a UEM system to manage. These consumer versions included Personal Knox, later called My Knox starting in 2014. My Knox was replaced by Secure Folder in 2017.
In 2018, Samsung partnered with Google to use its Android work profile to secure applications and data, and in 2019 deprecated the Knox Workspace container. Samsung continues to pre-install the Secure Folder on most flagship mobile devices, but consumers must enable it for use.
Samsung Real-Time Kernel Protection (RKP) The Samsung RKP feature tracks kernel changes in real-time and prevents the phone from booting, as well as displaying a warning message about using "Unsecured" Samsung devices. This feature is analogous to Android dm-verity/AVB and requires a signed bootloader.
Security Enhancements for Android (SE for Android) Although Android phones are already protected from malicious code or exploits by SE for Android and other features, Samsung Knox provides periodic updates that check for patches to further protect the system.
Secure Boot
During Secure Boot, Samsung runs a pre-boot environment to check for a signature match on all operating system (OS) elements before booting in the main kernel. If an unauthorized change is detected, the e-fuse is tripped and the system's status changes from "Official" to "Custom".