ARM TrustZone.

A hardware security extension on ARM CPUs that partitions the SoC into a Secure World and a Normal World, providing a TEE for keys, DRM, and biometric data. It belongs to the Cryptography category of cybersecurity.

A hardware security extension on ARM CPUs that partitions the SoC into a Secure World and a Normal World, providing a TEE for keys, DRM, and biometric data.

ARM TrustZone is a system-wide security architecture introduced in ARMv6 (TrustZone-A for Cortex-A and TrustZone-M for Cortex-M). The SoC is split into two worlds - Secure and Non-Secure - signalled by the NS bit, with the CPU, memory controller, bus fabric, and peripherals aware of the partition. The Secure World runs a small trusted OS (e.g. OP-TEE, Qualcomm QSEE, Samsung TEEgris, Trustonic Kinibi) that exposes Trusted Applications via SMC calls (GlobalPlatform TEE API). TrustZone hosts the Android Keystore, iOS Secure Enclave-equivalent flows, Widevine L1 DRM, fingerprint matchers, fTPMs, and mobile-payment crypto. Recent attacks (CLKSCREW, downgrade flaws in vendor TAs) have shown that Secure World code still needs careful auditing.

Defences for ARM TrustZone typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: TrustZone, ARM TEE.