Samsung Knox is a comprehensive set of security features for personal and enterprise use pre-installed in most of Samsung's smartphones, tablets, and wearables.
Samsung Knox provides a list of security features—both hardware and software—that allow business and personal content to securely coexist on the same handset, and allows other developers to communicate with these features throughout its SDKs. Some of these features coexist with already existing security enhancements provided by Android.
Some of my favourite Knox features are as follows:
Samsung Defex Edit
Starting from Android Oreo, Samsung has patched the kernel to prevent root access being granted to apps even after rooting was successful. This is to prevent unauthorised apps from changing the system and deter rooting.
Samsung Real-time Kernel Protection (RKP)
Samsung has implemented a feature that tracks kernel changes in real time and prevents the phone from booting as well as displaying a warning message about using "Unsecured" Samsung devices. This feature is analogous to Android dm-verity/AVB and requires a signed bootloader.
Secure Boot
Before booting in the main Kernel, Samsung runs a "pre-boot" environment where it checks for the signature match of all elements of the OS. Should an unauthorised change be detected, the e-fuse will be tripped and the system's status will change from "Official" to "Custom".
