optee

OP-TEE, short for Open Portable Trusted Execution Environment, is an open-source TEE implementation designed for ARM TrustZone-enabled systems. It provides a secure execution environment outside the normal operating system, allowing trusted applications to run in isolation and protect sensitive data such as cryptographic keys, credentials, and biometric templates from potentially compromised software.

It comprises two execution worlds: the non-secure world, where the regular operating system runs, and the secure world, where the OP-TEE OS and trusted applications execute. The secure world is isolated from the normal world by hardware-enforced TrustZone separation. The OP-TEE project implements a pair of APIs: the TEEC (TEE Client API) used by client applications to request services, and the internal TEE API implemented by OP-TEE OS for trusted applications.

Key capabilities include secure storage, cryptographic operations, attestation, and access to trusted peripherals. It provides a portable interface based on the GlobalPlatform TEE specifications and a set of trusted applications (TAs) that can be developed to perform security-sensitive tasks without exposing them to the non-secure world. The Linux kernel typically provides a character device driver to route calls between the normal world and the secure world.

OP-TEE is maintained as an open-source project by Linaro and contributors, with components such as optee-os (the secure OS), optee-client (client API), optee_test, and support tooling. It runs on many ARM-based SoCs that implement TrustZone and supports common development workflows for creating and deploying trusted applications.

OP-TEE is used to implement secure storage, key management, code attestation, and other security services in mobile devices and embedded systems requiring a trusted execution environment.