February 26, 2019

Knox Deep Dive: Knox DualDAR Encryption

Prarthna Srivathsan

The new Samsung smartphones—scheduled to reach consumers in early 2019—add support for File-based Encryption (FBE), which is a feature of the Android OS. Along with adding support for FBE, the Knox framework also adds a new feature called Knox DualDAR encryption. This blog post provides a high-level overview of Knox DualDAR encryption as well as links to other information about DualDAR.

 

 

 

Overview

The Samsung Knox Sensitive Data Protection (SDP) feature addresses the issue of protecting Data-At-Rest (DAR) on mobile devices. SDP decrypts data only after authentication, providing per-file and per-data decryption keys, offering per-app password checks, and meeting MDFPP requirements for US government and military use. Knox DualDAR secures all Workspace data on devices by adding two separate layers of encryption, further meeting the requirements of classified deployments.

In simple terms, the solution’s efficiency rests on the following two components:

  1. Data storage: The solution restricts apps from writing or saving data to the unencrypted space on the device.
  2. Data encryption: Knox DualDAR uses two layers of data encryption to secure all data saved to the encrypted space on the device. The solution provides two layers—inner and outer—of encryption and key generation. All data placed inside the Workspace is dually encrypted by both layers and needs separate authentication at both layers for access.

DualDAR is supported on all devices compatible with Android FBE and running Knox 3.3 or later. For more information on finding your Knox version, see the DualDAR Prerequisite section in the Knox Developer Guide.

 

Benefits of DualDAR

DualDAR encryption has the following significant advantages over traditional single-layer encryption methods:

  • Mitigate risks of implementation flaws – DualDAR reduces the likelihood of unauthorized data access with two layers of encryption since chances are very low that security vulnerabilities are present on both layers of encryption.
  • Mitigate risks of password configuration flaws – DualDAR uses two layers of encryption and two methods of authentication for each of the layers, and ensures that encrypted data remains protected even in the event of a breach on one layer.
  • Provide access using strict security evaluation criteria – Both the inner and outer layers of encryption in DualDAR use FIPS 140 certified cryptographic modules and target the use of file encryption keys using AES-GCM 256.
  • Ease of deployment – DualDAR leverages the in-built Android FBE framework and builds additional layers of security on top of this framework. DualDAR is available for all compatible devices, whether they use the DO, PO, or a combination of both models for deployment. For more information on configuring this solution for your supported device, see the DualDAR configuration section in the Knox SDK Developer guide.
  • Customize the second layer of encryption – DualDAR allows IT admins to use and configure any third-party cryptographic modules, including solutions that meet FIPS 140 certification criteria.
  • Flexible deployment methods – IT admins can implement and configure DualDAR on all kinds of devices, including BYOD and company-issued devices. Whether the devices use a PO or a DO deployment model, IT admins can use this superior data security solution on all devices within their enterprise.

For more information on DualDAR and its unique design, see the DualDAR topic in the Knox White Paper and the DualDAR topic in the KPE Developer Guide.

 

Next steps

 

[Icon] close

Get the right solution for your business

Join 25,000+ organizations around the world.

[Icon] suitcase
Are you a reseller or solution partner?

Get access to the Knox Partner Program for helpful partner tools, such as the Knox Deployment Program portal, Knox MSP portal, partner SDKs, and more.

[Icon] info
Unified Endpoint Management
Knox Suite
Rebranding and customization
Knox Configure
Fraud and theft protection
Knox Guard
Device protection plan
Samsung Care + for Business
Other products & services

Get started with

[Image] Knox Suite

All-in-one solution bundle for enterprise mobility.

[Icon] Check mark

Join us and get a 90-day free trial for Knox Suite and other Knox products. *Approval required

[Icon] Check mark

A complete set of tools to secure, deploy, manage, and analyze your enterprise's corporate mobile devices.

[Icon] Check mark

Try powerful features bundled with Knox Suite, such as Knox Remote Support.

Knox Suite include:

[Icon] Knox Platform for Enterprise Knox Platform for Enterprise
[Icon] Knox E-FOTA Knox E-FOTA
[Icon] Knox Mobile Enrollment Knox Mobile Enrollment
[Icon] Knox Asset Intelligence Knox Asset Intelligence
[Icon] knox manage Knox Manage
[Icon] knox capture Knox Capture

Get started with

[Image] Knox Configure Logo

Remotely configure Samsung devices in bulk and tailor them to specific needs, right out of the box.

[Icon] Check mark

After approval, you can try both the:

  • Setup edition — designed for a one-time deployment
  • Dynamic edition — deploy and update policies as many times without a factory reset.
[Icon] Check mark

Try either the Setup edition or Dynamic edition of Knox Configure on up to 30 devices.

[Icon] Check mark

Get a free Knox Suite trial upon approval to try our UEM.

Get started with

[Icon] Knox Guard Logo

Remotely control Samsung devices to reduce financial risks and protect assets.

[Icon] Check mark

After you get approved, generate your free trial license for 90 days.

check-mark

Try all the features of Knox Guard on up to 30 devices, including SIM control and device locking.

[Icon] Check mark

Get a free Knox Suite trial upon approval to try our UEM.

Get started with

[Image] Samsung Care Plus For Business Logo

Protect your business devices against accidental damage and mechanical breakdowns.

[Icon] Check mark

Are you already a Samsung Care+ for Business customer? Create an account and access the Samsung Care+ for Business console.

[Icon] Check mark

Contact the Samsung sales team and get peace of mind for your devices.

Other products & services

[Image] Others logo
[Icon] Check mark

Samsung offers additional solutions to serve the unique needs of your business. Talk to a Samsung expert today.

CONTACT SALES
Back to top