“Samsung Knox”的意思、由来-开放百科全书

Samsung Knox provides a list of security features – both hardware and software – that enable business and personal content to coexist on the same handset.

Software

One feature – named the Knox Workspace app container ^[4] – allows a user to press an icon that switches immediately between Personal and Work mode with no reboot required.^[5] The manufacturer has claimed this feature will be fully compatible with Android and Google and will provide full separation of work and personal data on mobile devices and "addresses all major security gaps in Android."^[6]

Hardware

Knox features hardware security features that are built into the device at the factory, including: ARM TrustZone (a technology similar to TPM) and a bootloader ROM.^[7] Knox Verified Boot monitors and protects during the booting process in addition to Knox security built at a hardware level (introduced in Knox 3.3).

e-fuse

Samsung Knox devices also use an e-fuse to indicate whether or not an "untrusted" (non-Samsung) boot path has ever been run. The e-fuse will be set if the device is booted with a non-Samsung bootloader, kernel, kernel initialization script or data. Rooting the device and installing a non-Samsung Android release will, therefore, set the e-fuse. Once the e-fuse is set, a device can no longer create a Knox Workspace container, or access the data previously stored in an existing Knox Workspace.^[8] This information may be used by Samsung to deny warranty service, in the United States, to devices that have been modified in this manner.^[9] This is the case even though, in the United States, voiding of consumer warranties in this manner may be prohibited by the Magnuson–Moss Warranty Act of 1975, at least in cases where the phone's problem is not directly caused by rooting.^[10] For some older versions of Knox, it may be possible to clear the e-fuse by flashing a custom firmware.^[11]

Samsung DeX

Since Knox 3.3 the options to manage Samsung DeX were added to allow or restrict access using the Knox platform for added control and security.

Notable Security mentions

In October 2014, a security researcher discovered that Samsung Knox stores PIN in plain-text instead of storing salted and hashed PIN (or better, using PBKDF2) and precessed it by obfuscated code.^[12]

In October 2014, U.S National Security Agency (NSA) approved Samsung Galaxy devices under a program for quickly deploying commercially available technologies. Approved products include Galaxy S4, Galaxy S5, Galaxy S6, Galaxy S7, Galaxy Note 3, Galaxy Note 10.1 2014.^[13]

In June 2014, five Samsung devices were included in the list of approved products for sensitive but unclassified use by the Defense Information Systems Agency (DISA) of the Department of Defense, which certifies commercial technology for defense use.^[13]

In May 2016, Israeli researchers, Uri Kanonov and Avishai Wool, found three key vulnerabilities existing in specific versions of Knox.^[14]

In December 2017, Knox received strong ratings in 25 of 28 categories in Gartner’s December 2017 Mobile OSs and Device Security: A Comparison of Platforms.^[15]

In June 2017, Samsung discontinued My Knox and urged users to switch to an alternate product, Secure Folder.^[16]

Android Enterprise

On March 5, 2018, Samsung announced devices running Knox 3.0 and above integrate seamlessly with similar Android Enterprise features.^[17]

References

1. ^{{cite web|url=https://www.samsungknox.com/en/blog/what-s-new-in-knox-3-3 |title=What's new in Knox 3.3?|publisher=Samsung Knox |date=17 March 2019}}
2. ^{{Cite web|url=https://docs.samsungknox.com/whitepapers/knox-platform/samsung-knox.htm|title=Knox Platform for Enterprise White Paper|website=Samsung Knox|publisher=Samsung|date=2018-09-12|access-date=2018-10-31}}
3. ^{{Cite web|url=https://www.samsungknox.com/en/knox-platform/supported-devices|title=Devices built on Knox {{!}} Samsung Knox|website=www.samsungknox.com|language=en|access-date=2018-11-13}}
4. ^{{Cite web|url=https://docs.samsungknox.com/whitepapers/knox-platform/app-container.htm|title=App Container {{!}} Knox Platform for Enterprise Whitepaper|last=|first=|date=|website=docs.samsungknox.com|language=en-us|archive-url=|archive-date=|dead-url=|access-date=2018-11-13}}
5. ^{{Cite news|url=http://www.itwire.com/your-it-news/mobility/59182-samsung%E2%80%99s-knox%E2%84%A2-blackberry-off-balance|title=iTWire - Samsung Knox™ BlackBerry off Balance|last=Shaw|first=Ray|date=2013-03-23|work=iTWire|access-date=2018-10-27|language=en-gb}}
6. ^{{Cite news|url=https://money.cnn.com/2013/03/12/technology/security/samsung-knox/|title=Samsung targets BlackBerry with Knox|last=Goldman|first=David|date=2013-03-12|work=CNNMoney|access-date=2018-10-27}}
7. ^{{Cite web|url=https://docs.samsungknox.com/whitepapers/knox-platform/hardware-backed-root-of-trust.htm|title=Root of Trust {{!}} Knox Platform for Enterprise Whitepaper|website=docs.samsungknox.com|language=en-us|access-date=2018-11-13}}
8. ^{{cite web|url=https://www.samsungknox.com/en/blog/about-cf-auto-root|title=About CF-Auto-Root|author=Peng Ning|date=2013-12-04|publisher=Samsung|quote=The sole purpose of this fuse-burning action is to memorize that a kernel or critical initialization scripts or data that is not under Samsung's control has been put on the device. Once the e-fuse bit is burned, a Samsung KNOX-enabled device can no longer create a KNOX Container, or access the data previously stored in an existing KNOX Container.}}
9. ^{{cite web|url=https://plus.google.com/+Chainfire/posts/LCfF5A9fsTG|title=More on KNOX warranty void|author=Chainfire|date=2013-10-09|quote=Service center instructions are indeed that devices with this status tripped will not receive any warranty repairs. (Of course, the action they take may still depend on the service center). Their excuse is that the hardware is damaged by the owner.}}
10. ^{{Cite news|url=https://motherboard.vice.com/en_us/article/yp3nax/jailbreaking-iphone-rooting-android-does-not-void-warranty|title=Companies Can’t Legally Void the Warranty for Jailbreaking or Rooting Your Phone|last=Koebler|first=Jason|date=2016-08-17|work=Motherboard|access-date=2018-10-27|language=en-us}}
11. ^{{Cite web|url=https://forum.xda-developers.com/showpost.php?p=52329946&postcount=76|title=A few things on knox / rooting and bootloaders that need more testing / development - Post #76|website=forum.xda-developers.com|language=en|access-date=2018-10-27}}
12. ^{{Cite news|url=https://threatpost.com/nsa-approved-samsung-knox-stores-pin-in-cleartext/109018/|title=NSA-Approved Samsung Knox Stores PIN in Cleartext|last=Mimoso|first=Michael|date=2014-10-24|work=Threatpost|access-date=2018-10-27|language=en-us}}
13. ^¹{{Cite news|url=http://www.pcworld.com/article/2836612/samsung-knox-devices-approved-for-government-use-by-nsa.html|title=NSA approves Samsung Knox devices for government use|last=Ribeiro|first=John|date=2014-10-21|work=PCWorld|access-date=2018-10-27|language=en}}
14. ^{{Cite news|url=https://www.techrepublic.com/article/samsung-knox-isnt-as-secure-as-you-think-it-is/|title=Samsung Knox isn't as secure as you think it is|last=Forrest|first=Conner|date=2016-05-31|work=TechRepublic|access-date=2018-10-27|language=en}}
15. ^{{Cite web|url=https://docs.samsungknox.com/whitepapers/knox-platform/samsung-knox.htm|title=Introduction {{!}} Knox Platform for Enterprise Whitepaper|website=docs.samsungknox.com|language=en-us|access-date=2018-11-13}}
16. ^{{Cite news|url=https://www.androidauthority.com/samsung-discontinues-knox-switch-secure-folder-777140/|title=Samsung discontinues My Knox, urges users to switch to Secure Folder|last=Rutnik|first=Mitja|date=2017-06-02|work=Android Authority|access-date=2018-10-27|language=en-US}}
17. ^{{Cite web|url=https://www.samsungknox.com/en/blog/android-enterprise-and-samsung-knox-your-questions-answered-here|title=Android Enterprise and Samsung Knox: Your questions answered here|last=|first=|date=2018-02-24|website=Samsung Knox|language=en|archive-url=|archive-date=|dead-url=|access-date=2018-10-27}}

Overview