ARM TrustZone

A hardware-enforced security architecture that partitions a single processor into two distinct environments (the Normal World and the Secure World) to protect sensitive data at the silicon level.

TrustZone provides the foundation for system-wide security by creating a Trusted Execution Environment (TEE) within ARM Cortex-A and Cortex-M processors. It uses a hardware-logic approach: a single bit (the NS bit) on the system bus determines access rights to memory and peripherals. This isolation ensures that critical assets (like biometric templates, DRM credentials, and private cryptographic keys) remain inaccessible to the primary operating system (Android or Linux). By keeping the secure kernel separate from the rich OS, TrustZone enables high-stakes applications like mobile payments and digital identity verification to run in a verified, tamper-resistant space.

https://developer.arm.com/ip-products/security-ip/trustzone