Acronym · Safety & Security
TEE (Trusted Execution Environment)
An isolated execution context on the main processor with its own memory and peripherals, separated from the rich operating system by hardware, so sensitive code and data stay protected even if that OS is compromised.
- Also known as
- Secure world
- Type
- Acronym
- Domain
- Safety & Security, Security architecture
Notes
GlobalPlatform specifies the TEE API surface, while TrustZone, SGX, TDX and SEV are the common hardware substrates.
Overview
A TEE (trusted execution environment) is an isolated part of a main processor where sensitive code and data run under hardware protection, so that they stay confidential and unaltered even if the everyday operating system is compromised. The ordinary environment, often called the rich execution environment, runs Linux, Android or another full operating system, while the TEE runs a small trusted operating system and trusted applications. The isolation is enforced by the chip itself, which is why TEEs are a core concern for SoC and processor designers.
How it works
On Arm Cortex-A processors the most common basis is TrustZone. The processor and the system around it are split into a secure world and a non-secure world; memory regions, peripherals, interrupts and debug access can each be marked secure, and the bus fabric blocks non-secure software from reaching them. A small piece of software called the secure monitor switches between the worlds. Secure boot loads a trusted operating system, such as the open-source OP-TEE, into the secure world before the rich operating system starts.
Applications in the normal world call trusted applications through standard interfaces. GlobalPlatform defines the client and internal APIs that many TEEs implement, along with compliance and security certification programmes, so that trusted applications can move between devices. Typical tasks include protecting keys, biometric matching, payment credentials and content protection.
Other architectures take different routes. Some server processors create encrypted, isolated regions or whole confidential virtual machines, an approach promoted by the Confidential Computing Consortium for protecting data while it is in use. A TEE protects against software attacks well but is weaker against physical attacks or side channels than a separate secure element, and a flaw in the trusted operating system can undo the isolation for everything inside it.
Examples
- An Android phone storing fingerprint templates and payment keys in a TrustZone-based TEE rather than in the main operating system.
- OP-TEE running beside Linux on an Arm Cortex-A SoC, using the GlobalPlatform TEE Client API to serve requests from normal-world applications.
- A cloud server running a customer's workload in a confidential virtual machine whose memory is encrypted from the host.
- A car's infotainment SoC using a TEE to hold the keys that authenticate its connection to the vehicle maker's servers.
Related terms
- TrustZone
- Attestation
- Memory encryption
- Confidential computing
Part of the Safety & Security glossary, with every term in the topic and the lifecycles, tools and standards that use them.
Where it appears on the Hub
Used on 10 pages of the Hub. In each group, the pages that mention it most come first.
Roles
Suggest an improvement
Suggest an improvement to this entry
A clearer definition, an example, a correction or a source an editor can check. Editors review every suggestion before the entry changes.
Last reviewed . Written by The Semiconductor Hub editorial team. The full glossary