Samsung KNOX SDKs: More than Security!

Transcription

1 Samsung KNOX SDKs: More than Security! Victor Okunev SEAP Developer Evangelist Samsung Electronics

2 Introduction Hello! My name is Victor Okunev. Developer Evangelist Vancouver Enterprise Lab Samsung Electronics Canada 2

3 Agenda Webinar Duration: 1 hour 1. Presenter Introduction 2. Samsung KNOX Platform 3. KNOX Standard SDK Key Features 4. KNOX ISV SDK Key Features 5. Introduction to SEAP 3

4 Mobile software requirements Consumer vs Business Performance UX Security Scalability Generic platform all that but Hardened Security Manageability Customization Best-suited platform No can do: 4

5 Samsung KNOX Platform Tamper-resistant HW/SW Security Stack Built into Samsung Galaxy devices Hardware Root of Trust Boot-time system integrity OS-level data and app protection Run-time kernel integrity Integrity-based security services Secure application and data container Includes Samsung APIs SDKs are provided free of charge In-code license activation required 5

6 Samsung KNOX Security Certifications CANADA UK USA FRANCE CHINA AUSTRALIA 6

7 Samsung KNOX SDKs 7

8 KNOX Standard SDK 8

9 Mobile Device Management 101 What is a device policy? 9

10 Advanced MDM APIs for Android KNOX Standard SDK Integrated with Samsung KNOX Platform 430+ device policies App Management, HW/SW Component Management, Expense Management, Security Management, Inventory monitoring, Services Provisioning, etc. Used in 120+ MDM products 10

11 KNOX Standard SDK: Core Features Application Management Security Management App Control App Permissions Security Firewall Password Customized Device Mode HW / SW Component Management Kiosk Mode Lock Screen Settings Backup Date and Time Voice/Data Management Restrictions Bluetooth Browser Roaming Phone Remote Configuration Exchange Wi-Fi SSO Location-based Services Android VPN LDAP Geo fencing Location APN Multi User Help Desk Device Inventory Remote Control Inventory Per user polices Per device polices 11

12 KNOX Standard SDK: Core Features Application Management Security Management App Control App Permissions Security Firewall Password Customized Device Mode HW / SW Component Management Kiosk Mode Lock Screen Settings Backup Date and Time Voice/Data Management Restrictions Bluetooth Browser Roaming Phone Remote Configuration Exchange Wi-Fi SSO Location-based Services Android VPN LDAP Geo fencing Location APN Multi User Help Desk Device Inventory Remote Control Inventory Per user polices Per device polices 12

13 Application Management KNOX Standard SDK API examples Silent install/uninstall of applications Restrict installation and un-installation of applications Disable and enable applications Use case example: POS system Silently push an app update No user interaction required Even with extra new permissions Download an APK from your server 13

14 KNOX Standard SDK: Core Features Application Management Security Management App Control App Permissions Security Firewall Password Customized Device Mode HW / SW Component Management Kiosk Mode Lock Screen Settings Backup Date and Time Voice/Data Management Restrictions Bluetooth Browser Roaming Phone Remote Configuration Exchange Wi-Fi SSO Location-based Services Android VPN LDAP Geo fencing Location APN Multi User Help Desk Device Inventory Remote Control Inventory Per user polices Per device polices 14

15 Customized Device Mode KNOX Standard SDK Hidden Notification Bar KIOSK MODE Custom Wallpaper Custom Applications API examples Customize Home screen Disable Settings changes Customize device lock screen with client's company logo No default Applications Disable Menu key Calculator Calendar Contacts Camera Disable Soft keys Use case example: In-room hospitality devices Minimize the device environment To prevent guest from misconfiguring it Provide access to relevant apps only Simplify the OS experience for non-android users Disable Hardware keys 15

16 KNOX Standard SDK: Core Features Application Management Security Management App Control App Permissions Security Firewall Password Customized Device Mode HW / SW Component Management Kiosk Mode Lock Screen Settings Backup Date and Time Voice/Data Management Restrictions Bluetooth Browser Roaming Phone Remote Configuration Exchange Wi-Fi SSO Location-based Services Android VPN LDAP Geo fencing Location APN Multi User Help Desk Device Inventory Remote Control Inventory Per user polices Per device polices 16

17 Location-Based Services KNOX Standard SDK Main gate API examples Define Polygonal, Circular, and Linear geofences Apply specific behavior based on the device location Configure frequency of GPS location querying Based on time and distance Use case example: Preventing data leakage from restricted area Detect when device enters the geofence Disable camera and Bluetooth on the device Detect when device leaves the geofence Restore device and Bluetooth functionality 17

18 KNOX Standard SDK: Core Features Application Management Security Management App Control App Permissions Security Firewall Password Customized Device Mode HW / SW Component Management Kiosk Mode Lock Screen Settings Backup Date and Time Voice/Data Management Restrictions Bluetooth Browser Roaming Phone Remote Configuration Exchange Wi-Fi SSO Location-based Services Android VPN LDAP Geo fencing Location APN Multi User Help Desk Device Inventory Remote Control Inventory Per user polices Per device polices 18

19 Help Desk: Remote Control KNOX Standard SDK Device Screen Sharing API examples Inject touch events Inject hardware key events Access the frame-buffer to capture the screen content Use case example: Customer support Need to take control of the device Via standard VNC client Build a mobile VNC server No device rooting required! The user assistance is not needed Keyboard/ Mouse Event Sharing 19

20 KNOX Standard SDK: Core Features Application Management Security Management App Control App Permissions Security Firewall Password Customized Device Mode HW / SW Component Management Kiosk Mode Lock Screen Settings Backup Date and Time Voice/Data Management Restrictions Bluetooth Browser Roaming Phone Remote Configuration Exchange Wi-Fi SSO Location-based Services Android VPN LDAP Geo fencing Location APN Multi User Help Desk Device Inventory Remote Control Inventory Per user polices Per device polices 20

21 Security Management KNOX Standard SDK API examples Configure firewall rules to allow, block, and reroute traffic, based on app or server identity Configure HTTP proxy Encrypt SD Card Install user & CA certificates Force user to change device password Use case example: Restricted data usage Allow business app only to use mobile network The rest of the apps can access data over Wi-Fi The user can't bypass this restriction 21

22 KNOX Standard SDK: Core Features Application Management Security Management App Control App Permissions Security Firewall Password Customized Device Mode HW / SW Component Management Kiosk Mode Lock Screen Settings Backup Date and Time Voice/Data Management Restrictions Bluetooth Browser Roaming Phone Remote Configuration Exchange Wi-Fi SSO Location-based Services Android VPN LDAP Geo fencing Location APN Multi User Help Desk Device Inventory Remote Control Inventory Per user polices Per device polices 22

23 HW/SW Component Management KNOX Standard SDK API examples Disable Wi-Fi, Bluetooth, NFC, SD Card Disallow factory reset Detect SIM change Disable tethering Perform full backup of application data Use case example: Fleet management solution Force the GPS On No user confirmation is required Prevents user from turning the GPS Off 23

24 KNOX Standard SDK: Core Features Application Management Security Management App Control App Permissions Security Firewall Password Customized Device Mode HW / SW Component Management Kiosk Mode Lock Screen Settings Backup Date and Time Voice/Data Management Restrictions Bluetooth Browser Roaming Phone Remote Configuration Exchange Wi-Fi SSO Location-based Services Android VPN LDAP Geo fencing Location APN Multi User Help Desk Device Inventory Remote Control Inventory Per user polices Per device polices 24

25 Remote Configuration KNOX Standard SDK API examples Control & configure Wi-Fi access points settings Configure Android VPN settings Create, update, and delete VPN profiles Provision accounts for MS Exchange ActiveSync, IMAP, and POP Use case example: Secure app traffic over untrusted data connections Detect if Wi-Fi is a trusted profile If so, disconnect corporate VPN to save VPN server load Otherwise the data connection is not trusted, enable VPN 25

26 Learn from Samsung Partner Solutions 26

27 KNOX ISV SDK 27

28 KNOX ISV SDK: Core Features Device Integrity Attestation Data Security Sensitive Data Protection (SDP) Secure Credential Storage Universal Credential Management (UCM) 28

29 KNOX ISV SDK: Core Features Device Integrity Attestation Data Security Sensitive Data Protection (SDP) Secure Credential Storage Universal Credential Management (UCM) 29

30 Device Attestation KNOX ISV SDK API examples Request trusted device measurements Use case example: Ensure device is not compromised before installing banking app Initiate attestation sequence Receive attestation verdict Whether device has been rooted or is running unofficial firmware If device is uncompromised, install the app 30

31 Device Attestation How it Works: TrustZone Attestation Agent Your App Your Server Attestation Server 1 Get nonce Start attestation (nonce) Get nonce Nonce Nonce generated and stored with timestamp Attest (nonce) Start attestation (nonce) 2 Blob with nonce, Measurements, device ID, signature and certificate Attest (blob) Attest (blob) 3 Get verdict (nonce, blob) Verdict (success/fail) Verify blob signature, certificates; parse blob data 31

32 KNOX ISV SDK: Core Features Device Integrity Attestation Data Security Sensitive Data Protection (SDP) Secure Credential Storage Universal Credential Management (UCM) 32

33 Sensitive Data Protection (SDP) KNOX ISV SDK API examples Protect selected databases and database columns Protect selected application files Create custom SDP engine Use case example: Ensure protection of patient's confidential data even in the event of security breach on the device Mark application file as sensitive Choose SDP engine Default or custom Let SDP infrastructure to do the rest 33

34 Sensitive Data Protection (SDP) How it Works: Power on Power off Unlock state Lock state Decrypted Encrypted Write Read 34

35 KNOX ISV SDK: Core Features Device Integrity Attestation Data Security Sensitive Data Protection (SDP) Secure Credential Storage Universal Credential Management (UCM) 35

36 Universal Credential Management (UCM) KNOX ISV SDK API examples Query available credential storages on the device Check if the storage is locked Install certificates to credential storage (Used by , Browser, Wi-Fi, VPN) Use case example: Provide financial application with credential storage access: Ability to support Embedded Secure Elements, Micro SD cards, SIM cards, and Common Access Card (CAC) smartcards from third-party vendors Do not create dependency on the vendor API Use generic API Take advantage of plugin architecture 36

37 Universal Credential Management (UCM) How It Works: Credential-consuming apps ( , browser, WiFi, VPN, etc.) Storage management apps 37

38 Where do I get Samsung B2B SDKs? SEAP Samsung Enterprise Alliance Program Instant registration, start developing in minutes: 38

39 Samsung Enterprise Alliance Program Sales Support Dedicated sales support from Samsung sales network based on Business Opportunities Co-Marketing Activities Partner Promotion via Samsung online channels Co-branded marketing materials Samsung event participation SEAP Newsletter & Logo Access Samsung s technology KNOX SDKs and licenses Technical Q&A ticket Priority technical support Technical consultants Marketing Sales Tech Support 39

40 Q&A and THANK YOU for your time. Victor Okunev