January 19, 2020

Samsung Knox File Encryption 1.0 - The first certified integrated Dual Data-at-Rest solution for mobile devices

Brian Wood

As more organizations look for data isolation capabilities, one of the key tools is encrypting data only until it is needed. This isn’t a new solution; it is the backbone of most security. The difference has always been in how easy (or hard) it is to deploy the encryption for the organization, and how hard it is to use once it has been deployed, especially on mobile devices. With Samsung Knox File Encryption, a Work Profile can have an independent layer of encryption, without the need to deploy additional components or change how users (or their applications) work.


What is Data-at-Rest?

Data-at-Rest (DAR) is simply encrypting data when it is stored. Samsung devices encrypt all user data by default, so when your mobile device is off, the data cannot be read (as plain text) until your password has been entered. DAR protection happens automatically, in the background, without the user needing to do anything different than to unlock the device.


So what is Dual Data-at-Rest?

So if DAR is encrypting all your files when they are written to storage, DualDAR is encrypting files twice, with two different keys. For example, encrypting an individual file (say by zipping the file and placing a password on it), on a device that already has all the files encrypted, is DualDAR. It provides additional protection on the protected file(s) when the system is running and the main DAR layer is unlocked.


If Dual Data-at-Rest is so great, why don’t we use it all the time?

As with any encryption solution, there are always 4 major questions:

  1. Do I have data to protect that needs the additional security?
  2. How hard is it to deploy?
  3. How hard will it be to use?
  4. What is the overhead of using the solution?

The first question is probably the most important. If you have data that should remain confidential most of the time, then it may be a high priority to add an encryption layer to that data. But this needs to be balanced with the rest of the questions. Many security solutions are difficult to deploy and maintain. Complicated deployments and a lot of administrator time means the solutions are unlikely to be used. Similarly, if the solution is hard for an end user, they will either try to ignore it (that is, not use it), or even actively work around it. Lastly, if the implementation slows down the system noticeably, or drains the battery faster, then users will come to the same conclusion that it is hard to use.

In most cases, while an organization may say the answer to the first question is that they should have the additional security on the data, the answers to deploying a solution to do so, in terms of additional overhead (both administrative and end user) are sufficient to mean the organization will not add the additional security.


The Samsung Knox File Encryption approach

The difference with Samsung Knox File Encryption is that the answers to the last three questions become:

  1. Easy
  2. Easy
  3. Not noticeable

This makes the answer to the first question more about the data security than it does about how to add the protection.

Samsung Knox File Encryption is a simple setting to be enabled in a Work Profile when it is deployed. The end user opens the Work Profile the same way they would normally, but all files inside the Work Profile are now automatically encrypted. For performance, Samsung has integrated with the hardware accelerated encryption engines already available on the device, so performance is fast and impacts on things like battery life are minimal.


What is the certification?

On December 9, 2019, the National Information Assurance Partnership (NIAP) certified Samsung Knox File Encryption 1.0 to the requirements in the PP-Module for File Encryption Version 1.0 and Protection Profile for Application Software Version 1.3. This certification means the Knox File Encryption components have been evaluated to meet US government requirements for functionality, including the encryption requirements for securing classified data.


Who would use this?

Samsung designed Knox File Encryption around the NSA requirements found in the Data-at-Rest Capability Package. While these requirements are specifically written for classified environments, Samsung focused on creating a simple solution that would be easy for anyone to use, not just the NSA. Any organization that has confidential data that may be stored on mobile devices should consider implementing our DualDAR encryption on their Work Profiles.


What next?

Browse the KPE White PaperWhitepaper Check the Knox Service Plugin Admin GuideAdmin Guide Review the Knox SDK Developer GuideDeveloper Guide Reach out to our Knox Partner Program

[Icon] close

Get the right solution for your business

Join 25,000+ organizations around the world.

[Icon] suitcase
Are you a reseller or solution partner?

Get access to the Knox Partner Program for helpful partner tools, such as the Knox Deployment Program portal, Knox MSP portal, partner SDKs, and more.

[Icon] info
Unified Endpoint Management
Knox Suite
Rebranding and customization
Knox Configure
Fraud and theft protection
Knox Guard
Device protection plan
Samsung Care + for Business
Other products & services

Get started with

[Image] Knox Suite

All-in-one solution bundle for enterprise mobility.

[Icon] Check mark

Join us and get a 90-day free trial for Knox Suite and other Knox products. *Approval required

[Icon] Check mark

A complete set of tools to secure, deploy, manage, and analyze your enterprise's corporate mobile devices.

[Icon] Check mark

Try powerful features bundled with Knox Suite, such as Knox Remote Support.

Knox Suite include:

[Icon] Knox Platform for Enterprise Knox Platform for Enterprise
[Icon] Knox E-FOTA Knox E-FOTA
[Icon] Knox Mobile Enrollment Knox Mobile Enrollment
[Icon] Knox Asset Intelligence Knox Asset Intelligence
[Icon] knox manage Knox Manage
[Icon] knox capture Knox Capture

Get started with

[Image] Knox Configure Logo

Remotely configure Samsung devices in bulk and tailor them to specific needs, right out of the box.

[Icon] Check mark

After approval, you can try both the:

  • Setup edition — designed for a one-time deployment
  • Dynamic edition — deploy and update policies as many times without a factory reset.
[Icon] Check mark

Try either the Setup edition or Dynamic edition of Knox Configure on up to 30 devices.

[Icon] Check mark

Get a free Knox Suite trial upon approval to try our UEM.

Get started with

[Icon] Knox Guard Logo

Remotely control Samsung devices to reduce financial risks and protect assets.

[Icon] Check mark

After you get approved, generate your free trial license for 90 days.


Try all the features of Knox Guard on up to 30 devices, including SIM control and device locking.

[Icon] Check mark

Get a free Knox Suite trial upon approval to try our UEM.

Get started with

[Image] Samsung Care Plus For Business Logo

Protect your business devices against accidental damage and mechanical breakdowns.

[Icon] Check mark

Are you already a Samsung Care+ for Business customer? Create an account and access the Samsung Care+ for Business console.

[Icon] Check mark

Contact the Samsung sales team and get peace of mind for your devices.

Other products & services

[Image] Others logo
[Icon] Check mark

Samsung offers additional solutions to serve the unique needs of your business. Talk to a Samsung expert today.

Back to top