NIAP: Compliant Product
NIAP/CCEVS
  NIAP  »»  Product Compliant List  »»  Compliant Product  
Compliant Product - Samsung Knox File Encryption 1.2

Certificate Date:  2020.06.03

Validation Report Number:  CCEVS-VR-VID11053-2020

Product Type:    Application Software

Conformance Claim:  Protection Profile Compliant

PP Identifier:    PP-Module for File Encryption Version 1.0
  Protection Profile for Application Software Version 1.3

CC Testing Lab:  Gossamer Security Solutions


CC Certificate [PDF] Security Target [PDF] Validation Report [PDF]

Assurance Activity [PDF]

Administrative Guide [PDF]


Product Description

The Target of Evaluation (TOE) is Samsung Knox File Encryption 1.2. The TOE is a software service built into Samsung Android 10 with Knox 3.4.1 or 3.5 to provide file encryption to a Knox Workspace container. Samsung Knox File Encryption is designed to provide a second encryption layer similar to and on top of the File Based Encryption (FBE) layer for the entire device, specifically for the Knox Workspace container.

 

The Knox File Encryption service runs in the background and utilizes Samsung Android cryptographic modules to provide file encryption services for the Knox Workspace container. The service is designed to run without any user intervention as all files in the Knox Workspace container will be encrypted automatically.


Evaluated Configuration

The evaluated configuration consists of the Samsung Knox File Encryption 1.2 (the version is listed as “DualDAR”) on the following devices:

Device Name

Model
Number

Chipset Vendor

CPU

Android
Version

TEE OS

Knox Version

DualDAR Version

Galaxy S20+

SM-G986B

Samsung

Exynos 990

10

TEEGRIS 4.0

3.5

1.2.0

Galaxy S20+

SM-G986U

Qualcomm

SM8250

10

QSEE 5.8

3.5

1.2.0

Galaxy S10e

SM-G970F

Samsung

Exynos 9820

10

TEEGRIS 3.1

3.4.1

1.2.0

Galaxy S10e

SM-G970U

Qualcomm

SM8150

10

QSEE 5.2

3.4.1

1.2.0

 

 

 

In addition to the evaluated devices, the following device models are claimed as equivalent with a note about the differences between the evaluated device and the equivalent models.

Evaluated Device

CPU

Equivalent Devices

Differences

Galaxy S20+ (Samsung)

Exynos 990

Galaxy S20 Ultra (Samsung)

Galaxy S20 (Samsung)

·   All devices have same software environments (Android, Kernel, TEE)

Galaxy S20+ (Qualcomm)

SM8250

Galaxy S20 Ultra (Qualcomm)

Galaxy S20 (Qualcomm)

·   All devices have same software environments (Android, Kernel, TEE)

Galaxy S10e (Samsung)

Exynos 9820

Galaxy S10+ (Samsung)

Galaxy S10 5G (Samsung)

Galaxy S10 (Samsung)

Galaxy Note10+ 5G (Samsung)

Galaxy Note10+ (Samsung)

Galaxy Note10 5G (Samsung)

·   All devices have same software environments (Android, Kernel, TEE)

·   Note10 (Samsung) devices have Exynos 9825 CPU

Galaxy S10e (Qualcomm)

SM8150

Galaxy S10+ (Qualcomm)

Galaxy S10 5G (Qualcomm)

Galaxy S10 (Qualcomm)

Galaxy Fold 5G (Qualcomm)

Galaxy Fold (Qualcomm)

Galaxy Note10+ 5G (Qualcomm)

Galaxy Note10+ (Qualcomm)

Galaxy Note10 (Qualcomm)

Galaxy Tab S6

·   All devices have same software environments (Android, Kernel, TEE)

 

Table 1 - Equivalent Devices

 


Security Evaluation Summary

The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target.  The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017.  The product, when delivered and configured as identified in the Samsung File Encryption 1.2 Administrator Guide, Version 1.1, 03/24/2020  document, satisfies all of the security functional requirements stated in the Samsung Electronics Co., Ltd. Samsung Knox File Encryption 1.2 (PP_APP_V1.3/MOD_FE_V1.0) Security Target, Version 1.0, 05/11/2020.  The project underwent CCEVS Validator review.  The evaluation was completed in May 2020.  Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11053-2020) prepared by CCEVS.


Environmental Strengths

The logical boundaries of the Samsung Knox File Encryption 1.2 are realized in the security functions that it implements. Each of these security functions is summarized below.

Cryptographic support:

The TOE runs as part of Samsung Android 10 with Knox 3.4.1 or 3.5 and higher and includes several cryptographic libraries for encryption/decryption/cryptographic hashing functions for securing file contents and TOE keys.

User data protection:

The TOE protects all user data within the Knox Workspace container by providing an automatic encryption service for all files stored within the container; applications do not have to be made aware of the Knox File Encryption service to be protected. All keys are AES 256-bit, using AES-GCM for File Encryption Key (FEK) protection and AES-CBC for file content protection.

Identification and authentication:

The TOE utilizes the authentication services provided by the Knox Workspace container to unlock the Master Key. Unsuccessful authentication to the Knox Workspace container will prevent the Master Key from being unlocked, and hence no files in the container can be accessed.

Security management:

The services provided by the TOE are not available until a Knox Workspace container with File Encryption enabled is created on the device. Authentication management and the container lock settings are handled by the Knox Workspace management and are generic for all Knox Workspace configurations.

Privacy:

The TOE does not transmit Personally Identifiable Information over any network interfaces, nor does it request access to any applications that may contain such information.

Protection of the TSF:

The TOE relies on the physical boundary of the evaluated platform as well as the Samsung Android operating system for the protection of the TOE’s components.

The TOE relies on the Samsung Android operating system to provide updates as the software is incorporated as part of the device image. The version of the Knox File Encryption software can be seen in the About Device page with the Knox version information (as the DualDAR version).

The TOE is a Samsung component, and all code is maintained solely by Samsung. Only documented APIs available in Samsung Android (which includes the Knox Workspace and Samsung cryptographic libraries) are used.

Trusted path/channels:

The TOE does not transmit information over any network interfaces.


Vendor Information


Samsung Electronics Co., Ltd.
Brian Wood
973-440-9125
be.wood@samsung.com

www.samsung.com
Site Map              Contact Us              Home