What is Knox Device Health Attestation?

A process by which a Galaxy device cryptographically proves its integrity state to a verifying party, using hardware-backed attestation keys and Trusted Boot measurements stored in secure hardware.

Can attestation be faked?

Attestation uses hardware-backed keys and measurements stored in secure hardware (TrustZone or Knox Vault). Because the keys are in hardware and the measurements are taken during boot before the OS is running, software on the device cannot forge the attestation result.

Samsung Knox Device Health Attestation

Device Health Attestation is the process by which a Samsung Galaxy device cryptographically proves its integrity state to a verifying party — typically an enterprise management system. It allows organisations to determine whether a device is trusted before granting access to corporate resources.

This page explains why enterprise organisations use device-attestation information when deciding whether a device is trusted.

How attestation works

When a Galaxy device boots, Trusted Boot measures the integrity of each boot stage and stores the measurements in secure hardware. When an enterprise management system requests attestation, the device signs these measurements with a hardware-backed attestation key and sends them to the verifier. The verifier compares the measurements against known-good values to determine whether the device booted with approved, unmodified software.

What attestation proves

A successful attestation proves that the device's boot chain completed without detecting tampering, the device is running Samsung-approved firmware, the bootloader has not been replaced and the Warranty Bit has not been tripped. This gives enterprise organisations confidence that the device is in a trusted state before allowing access to email, corporate apps or VPN resources.

Boot chain completed successfully
Running Samsung-approved firmware
Bootloader has not been replaced
Warranty Bit has not been tripped
Hardware-backed attestation key was used

Device health verdicts

Enterprise management systems use attestation results to assign device health verdicts. A device that passes attestation may be marked as 'compliant' or 'trusted' and granted full access. A device that fails attestation may be marked as 'non-compliant' and have access restricted, or be required to take remediation steps. These verdicts help organisations enforce security policies across fleets of devices.

Why enterprises use attestation

Enterprise organisations use attestation because it provides cryptographic proof of device integrity, not just a self-reported status. Because the attestation key is hardware-backed and the measurements are stored in secure hardware, the attestation result cannot be forged by software running on the device. This makes attestation a reliable basis for access-control decisions.

Frequently asked questions

What is Knox Device Health Attestation?: A process by which a Galaxy device cryptographically proves its integrity state to a verifying party, using hardware-backed attestation keys and Trusted Boot measurements stored in secure hardware.
Can attestation be faked?: Attestation uses hardware-backed keys and measurements stored in secure hardware (TrustZone or Knox Vault). Because the keys are in hardware and the measurements are taken during boot before the OS is running, software on the device cannot forge the attestation result.