MDM Work Container: Key Hierarchy & Crypto-Shred Wipe

Key Hierarchy in MDM

In Mobile Device Management (MDM), a robust key hierarchy is crucial to ensure data security. The hardware root key serves as the foundation of this hierarchy, from which a container key-encryption key (KEK) is derived. This KEK then wraps every managed app's data encryption key (DEK). This hierarchical structure ensures that even if one DEK is compromised, it does not compromise the master keys or other DEKs.

The use of a hardware root key provides an additional layer of security by ensuring that the keys are stored in secure hardware, making them resistant to attacks. The container KEK acts as a central point of control, allowing for centralized management and revocation of access rights.

App-Sandboxing and Data Protection

App-sandboxing is a critical security measure in MDM that isolates managed apps from personal data. This means that even if an app is compromised, it cannot access or modify the user's personal files outside its sandboxed environment. This isolation ensures that sensitive enterprise data remains protected and does not get mixed with personal data.

By blocking personal apps from crossing the container boundary, MDM systems prevent unauthorized access to managed data. This separation of concerns also simplifies compliance requirements, as it is easier to track and manage which applications have access to what types of data.

Remote Wipe Mechanism

The remote wipe feature in MDM allows administrators to instantly destroy all managed data on a device. This mechanism works by crypto-shredding the container KEK, which is stored securely and not directly accessible from the user's perspective. When triggered, this process effectively renders all wrapped DEKs unusable, thus deleting the encrypted data without affecting the underlying file system or personal apps.

The remote wipe feature is particularly useful in scenarios where a device has been lost or stolen, as it ensures that sensitive enterprise data cannot be accessed by unauthorized parties.

Re-Enrollment and Fresh KEKs

In the event of a remote wipe or other security breaches, re-enrolling the device with fresh keys is essential. This process involves generating a new container KEK and wrapping all managed app DEKs with this new key. The re-enrollment ensures that data remains secure while maintaining the ability to manage and use applications on the device.

This mechanism also helps in maintaining compliance with security policies, as it allows for regular updates to encryption keys, reducing the risk of key compromise over time.

Frequently asked questions

Try it live

Everything above runs in your browser — open MDM Work Container: Key Hierarchy & Crypto-Shred Wipe and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.