How a secure element works
The chip has its own processor, memory and operating system, and is hardened against physical attack: probing, glitching the power supply, reading secrets from timing or power use. Small applications run inside, each walled off from the others.
The phone's main system cannot read the chip's memory. An app sends a command, the application in the chip performs the cryptographic step with a key that never leaves, and the answer comes back.
GlobalPlatform, the industry association that standardises the management of applications in secure elements, lists the forms: embedded and integrated secure elements, SIM cards, smart microSD cards and smart cards.
Secure elements in payments
A chip card is a secure element with contacts and an antenna. When a card is added to a phone wallet, a device token and its keys can be provisioned into the phone's embedded secure element, which then answers a terminal as a card would.
The alternative, host card emulation, keeps the payment application in the phone's ordinary software and compensates with short-lived keys fetched from a server. Access is the commercial question: the element belongs to the phone's maker, or to the mobile operator in the case of a SIM, and an app gets in only on the owner's terms.
Secure element, TEE or HSM?
- Trusted execution environment
- A protected area of the phone's main processor, isolated from the operating system but not a separate chip. Faster and roomier, with less resistance to physical attack.
- Hardware security module
- Server-side hardware that protects an institution's keys. A secure element protects one user's keys in one device.
Where a secure element shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- Custody & walletsWallets on every major chain, with MPC custody from leading providers or your own keys.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.