Juni 18, 2019

Knox Platform and Android Enterprise

Nick Dawson

A little over six years ago Samsung set out on journey to solve two critical issues facing our customers who wished to adopt Android devices as they updated their mobility strategies to modern platforms. On the one hand, we embedded a security platform into our mobile devices to address the concerns that our customers had about the safety of Android; and on the other, we began developing feature management controls so that our enterprise and government customers could configure, deploy, and manage Samsung devices exactly the way they wanted to.

Over the years, Knox has evolved into the industry’s leading embedded security platform and an accompanying modular, optional suite of services designed to follow the lifecycle of a mobile device throughout its enterprise journey – from setup to enrollment into your management infrastructure to OS version control and security patching (Knox IT Solutions).

Why did we do this? We knew that the power and flexibility of Android, coupled with Samsung’s innovation and capabilities as the world’s largest component and hardware manufacturer would give our customers the tools necessary for them to realize their dreams, to transform their businesses, and to serve their customers and employees in ways that hadn’t been conceived of yet. But there was a mistrust of Android in those earlier days. The same power and flexibility that has led it to become the world’s operating system market share leader (surpassing Windows in 2017) could more easily be turned against the user in the early days of Android. The fact that Android is an open source project, as well as its architecture, exposed it to more attack vectors and made it more vulnerable.

That’s why we embedded our own security platform into Samsung devices, anchored in the chipset and spanning up through the firmware as a series of overlapping defense and security mechanisms designed to ensure the integrity of the device itself, and from there the applications, services, and data being transacted on the device. Note also that Samsung devices are manufactured in Samsung factories primarily using Samsung components, thus ensuring a secure supply chain – another unique attribute of Samsung’s. We built the Knox platform as a more secure implementation of Android and we are proud that today Samsung devices are recognized as the most secure in the world.

About two and half years after Samsung first launched the Knox platform, our colleagues at Google set out to address the same core concerns of security and manageability for Android devices in the enterprise that we first did. As Android evolved it began to encompass many of the security and management features that had previously only been available in the Knox platform. Features such as hardware-backed encryption, secure booting mechanisms, isolation of work data from personal data, and more were initially core features of Samsung devices that have now found their way to the Android ecosystem at large as part of what is today called Android Enterprise.

So is there a purpose to the Knox platform anymore? The answer is yes. Has it gone away (or will it) in favor of Android Enterprise? The answer to that is no, it won’t go away. Allow me to explain why. It’s actually very simple. As some of the core security and management features that used to be exclusive to the Knox platform have gradually over the past two or three years become part of the core Android OS under the name Android Enterprise, an overlap has developed between the two.

However, the Knox platform still includes more granular as well as unique security and management features that are not in Android Enterprise. That’s why there’s still a purpose to the Knox platform, and why it isn’t going away: because as the industry’s leading mobile device manufacturer Samsung has the ability (and I would argue the responsibility) to do more than other manufacturers. Knox Platform for Enterprise is the embodiment of that ethos. It represents thousands of person years and hundreds of millions of dollars of security research and development, and it goes beyond Android Enterprise today and will continue to be an extension of it in the future.

That word – “extension” – is critical to how people should understand the Knox platform today. Whereas Samsung originally developed Knox as a unique security and management platform to meet enterprise and government needs, the growth of Android itself to incorporate some of the same features has led us to collaborate extensively with our colleagues at Google to remove the overlap between the Knox platform and Android Enterprise. By removing features from the Knox platform that now exist in Android Enterprise, the Knox platform is now effectively an extension of Android Enterprise in that it adds more granular or unique security and management features that do not exist in Android while it also relies on Android Enterprise (AE) to now provide those security and management features that have been deprecated.

Where AE provides the core security and management features, Knox adds advanced capabilities on top of it for Samsung devices. As AE grows and incorporates features that today might be unique to Knox Platform for Enterprise (KPE), Samsung will remove those features from KPE at the OS level if they provide no additional value for our customers in favor of using core AE features. However, we will simultaneously be adding our own new security, management, and analytics features to KPE. Therefore Knox will always be growing and will always be leading the industry (see the Knox vision statement from February 2019 here).

A description of features that KPE adds to AE today can be found in our white paper at

Read the KPE white paper

These include:

  • Enhanced hardware backed integrity and protection
  • Real-time Kernel Protection to ensure the integrity of the device beyond boot verification during runtime
  • Sensitive Data Protection for data encryption while the device is running, not just at rest
  • Dual Data at Rest encryption
  • Enhanced VPN controls
  • Enhanced certificate management
  • And more

As I mentioned earlier, the Samsung Knox and Android Enterprise teams collaborate extensively to ensure that the AE and Knox platforms work seamlessly with one another. This has led to cooperation in adjacent areas:

  • We have jointly developed a common integration library for our Knox Mobile Enrollment and Android zero-touch enrollment services (see blog post here); and
  • Samsung was the first Android partner to use OEMConfig as a mechanism to better deliver ubiquitous and zero-day access to Knox Platform for Enterprise features to our UEM partners and customers.

Stay tuned for further developments in the future.

— Nick Dawson, Director of Knox Strategy & Business

[Icon] schließen

Erste Schritte mit Samsung Knox

[Icon] Koffer
Sind Sie Fachhändler, Lösungsanbieter oder Serviceanbieter?

Werden Sie Knox Partner und bauen Sie Ihr Geschäft noch heute aus.

[Icon] Info

Wählen Sie ein Knox-Produkt aus, mit dem Sie beginnen möchten:

Knox Suite
Rebranding und Anpassung
Knox Configure
Schutz vor Betrug und Diebstahl
Knox Guard
Samsung Care+ for Business
Sonstige Produkte und Leistungen

Erste Schritte mit

[Image] Knox Suite

Komplettlösung für Unternehmensmobilität.

  • Sichern Sie sich eine kostenlose 90-Tage-Testversion für bis zu 30 Geräte.
  • Eine vollständige Auswahl an Tools für die Sicherung, Bereitstellung, Verwaltung und Analyse der Geräte Ihres Unternehmens.
  • Testen Sie die leistungsstarken Funktionen der Knox Suite.

Knox Suite umfasst:

Knox Mobile Enrollment Kostenlos
Knox Manage
Knox Asset Intelligence
Knox Platform for Enterprise Kostenlos
Fernsupport für Knox
Knox Capture
Knox Authentication Manager

Erste Schritte mit

[Image] Knox Configure-Logo

Umbenennen und Anpassen Ihrer Samsung Geräte.

  • Sichern Sie sich eine kostenlose 90-Tage-Testversion für bis zu 30 Geräte.
  • Konfigurieren Sie mehrere Samsung Geräte gleichzeitig per Fernzugriff und passen sie die Geräte an Ihre persönlichen Bedürfnisse, damit sie sofort einsatzbereit sind.
  • Richten Sie Ihre Geräte für eine einmalige Bereitstellung ein, oder aktualisieren Sie sie so oft Sie möchten.

Erste Schritte mit

[Icon] Knox Guard-Logo

Betrugs- und Diebstahlschutz für Samsung Geräte.

  • Sichern Sie sich eine kostenlose 90-Tage-Testversion für bis zu 30 Geräte.
  • Geringere finanzielle Risiken und Schutz Ihrer Vermögenswerte durch Fernsteuerung von Samsung Geräten.
  • Testen Sie alle Funktionen von Knox Guard, einschließlich der SIM-Steuerung oder der Gerätesperrung.

Erste Schritte mit

[Image] Samsung Care Plus For Business-Logo

Geräteschutz-Tarife für Ihre Geräte von Samsung.

  • Verringern Sie Betriebsunterbrechungen mit schnellen Reparaturen und Austausch von Geräten. Wenden Sie sich zum Durchstarten an das Samsung Vertriebsteam.
  • Alle Informationen über die Abdeckung und Ihre Ansprüche an einem zentralen Ort einsehen.
  • Sie haben Samsung Care+ for Business bereits gekauft? Erstellen Sie ein Konto und aktivieren Sie einen Tarif über die Samsung Care+ for Business-Konsole.

Sonstige Produkte und Leistungen

[Image] Sonstige Logos

Moderne Lösungen für Ihre individuellen Ansprüche.

  • Profitieren Sie von effizientem technischen Support durch einen fest zugeordneten Kundenbetreuer mit Enterprise Tech Support.
  • Erstellen Sie maßgeschneiderte Geräte für Ihr Unternehmen mit dem Samsung Software Customization Service.