How a trusted execution environment works
The processor runs two worlds side by side. The rich operating system, Android for example, runs ordinary apps, and the TEE runs authorised programs called trusted applications. An ordinary app calls one through a narrow interface, and only the result comes back.
GlobalPlatform's TEE standards define, among other features:
- Isolation from the rich operating system, and between trusted applications
- Trusted storage, bound to the device
- Trusted access to peripherals such as the screen and biometric sensors
- A trusted user interface, in which the TEE controls what is displayed and entered
What a TEE is used for in payments and banking
Phone keystores keep an app's keys in the TEE where there is no dedicated chip, fingerprint and face matching run there, and device binding relies on keys held there. SoftPOS apps use the TEE where a phone offers one, together with monitoring of the device from a server, to protect card data and PIN entry.
The EU's standards on strong customer authentication point the same way. Where authentication runs on a multi-purpose device, the provider's mitigating measures include the use of separated secure execution environments (Delegated Regulation (EU) 2018/389, Article 9).
TEE or secure element?
- Secure element
- A separate tamper-resistant chip with its own processor. Stronger against physical attack, but small, slow and controlled by its owner.
- Confidential computing
- The same idea on cloud servers: workloads run in hardware-isolated enclaves that the cloud operator cannot inspect.
Where a trusted execution environment shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Custody & walletsWallets on every major chain, with MPC custody from leading providers or your own keys.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
- GlobalPlatform, Introduction to Trusted Execution Environments, May 2018
- Delegated Regulation (EU) 2018/389, the technical standards on strong customer authentication, Article 9 (EUR-Lex)
General information, not legal advice: what applies to you depends on your services and your market.