Samsung Knox integration for corporate Android app

Integrating Samsung Knox for Corporate Android Apps

Samsung Knox—security technology stack embedded in hardware and firmware of Samsung devices. Not EMM platform, but API set atop Android available only on Samsung. For corporate app, Knox enables capabilities unavailable through standard Android Enterprise: hardware-isolated Keystore (Knox Vault), Dual Persona (personal + work mode without Work Profile), TIMA KeyStore, SIM and NetworkPolicy management below OS level.

Knox Vault: Hardware Key Protection

Knox Vault—isolated security processor physically separate from main ARM on Galaxy S21+ and Knox-certified devices. Private keys created in Knox Vault can't be extracted even with full Android OS compromise or physical flash memory analysis.

Access via standard Android Keystore API with additional flag:

val keyPairGenerator = KeyPairGenerator.getInstance(
    KeyProperties.KEY_ALGORITHM_EC,
    "AndroidKeyStore"
)

val parameterSpec = KeyGenParameterSpec.Builder(
    "corporate_signing_key",
    KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY
).apply {
    setDigests(KeyProperties.DIGEST_SHA256)
    setUserAuthenticationRequired(true)
    setUserAuthenticationParameters(0, KeyProperties.AUTH_BIOMETRIC_STRONG)
    // Knox Vault used automatically if device supports StrongBox
    setIsStrongBoxBacked(true)
}.build()

keyPairGenerator.initialize(parameterSpec)
val keyPair = keyPairGenerator.generateKeyPair()

setIsStrongBoxBacked(true)—requires StrongBox-compatible HSM. On Samsung Galaxy S21+ this is Knox Vault. If device doesn't support StrongBox—throws StrongBoxUnavailableException. Handle: fallback to regular Android Keystore with logging to MDM.

Knox SDK: Extended Policy Management

Knox SDK (separate from standard DevicePolicyManager) provides API for:

• APN and SIM policy management—corporate traffic via specific APN.
• Device firewall rules—block specific IP/domains for app.
• Kiosk Mode (Enhanced Kiosk)—Single App Mode with custom placeholder, can't exit even via notification shade.
• Factory Reset Protection (FRP) bypass for corporate redeploy.
• Knox Container management (Dual Persona)—separate Android instance in container.

Knox SDK requires Samsung Knox license:

// Initialize Knox with Enterprise license key
val licenseManager = KnoxEnterpriseLicenseManager.getInstance(context)
licenseManager.activateLicense(KNOX_LICENSE_KEY)

// Listener for activation result
val receiver = object : BroadcastReceiver() {
    override fun onReceive(context: Context, intent: Intent) {
        val status = intent.getIntExtra(KnoxEnterpriseLicenseManager.EXTRA_LICENSE_STATUS, -1)
        if (status == KnoxEnterpriseLicenseManager.ERROR_NONE) {
            initKnoxPolicies()
        }
    }
}
registerReceiver(receiver, IntentFilter(KnoxEnterpriseLicenseManager.ACTION_LICENSE_STATUS))

License per-device activated via Samsung Knox License Management Service (KLMS). For enterprise deploy, licenses issued in bulk via Samsung Knox Reseller Portal.

Per-app VPN via Knox VPN Framework

Knox VPN Framework allows per-app VPN without MDM profile—directly from app with Device Owner rights:

val vpnManager = EnterpriseDeviceManager.getInstance(context).vpnManager
val vpnProfile = KnoxVpnProfile().apply {
    profileName = "CorporateVPN"
    vpnType = KnoxVpnProfile.VpnType.IPSEC_HYBRID_RSA
    gatewayAddress = "vpn.corp.example.com"
    packageNames = listOf("com.company.app") // only our app
}
vpnManager.addVpnProfile(vpnProfile)
vpnManager.enableVpnProfile("CorporateVPN")

Difference from standard VpnService: Knox VPN set at SIM stack level; traffic tunneled before Android networking stack. Harder to bypass from device malware.

Samsung Knox Platform for Enterprise (KPE): Knox SDK Successor

Since 2021, Samsung recommends KPE instead of deprecated Knox SDK. KPE—unified API combining Knox EMM, Knox Customize, and device management:

// Get policy manager via KPE
val enterpriseDeviceManager = EnterpriseDeviceManager.getInstance(context)
val applicationPolicy = enterpriseDeviceManager.applicationPolicy

// Block specific app
applicationPolicy.addPackageToBlacklist("com.example.gaming_app")

// Force permissions
applicationPolicy.addPackageToWhitelistForPermission(
    "com.company.app",
    Manifest.permission.CAMERA
)

Knox Attestation: Device Integrity on Server

Knox Attestation lets server verify device isn't rooted and Knox status not compromised. Client requests nonce-based attestation report:

val attestationManager = KnoxAttestationManager.getInstance(context)
attestationManager.getAttestation(serverNonce) { report ->
    // Send report to server
    // Server verifies signature via Samsung Knox Attestation API
    sendAttestationToServer(report)
}

Server validates report via Samsung Knox Attestation REST API—verifies boot chain not compromised, knox_state = "ACTIVE", no root or FRP bypass signs.

Implementation Stages

Get Knox license → register app in Samsung Knox Portal → Knox SDK / KPE integration → Knox Vault for critical keys → policy setup (VPN, Kiosk, App Whitelist) → Knox Attestation for server verification → test on Knox-certified devices → deploy via Samsung Knox Mobile Enrollment.

Timeline: basic Knox Keystore integration—2–3 weeks. Full project with KPE policies, VPN, Attestation—6–10 weeks. Cost is calculated individually.