OP-TEE for Linux and Android provide a Trusted Execution Environment (TEE) that helps protect sensitive applications, data, and operations on ARM-based embedded systems. As connected edge and IoT devices handle increasingly sensitive information, hardware-backed security has become an essential part of embedded system design.
OP-TEE is an open-source Trusted Execution Environment that runs alongside a Rich Operating System (Rich OS) such as Linux or Android. While Linux or Android operates in the normal world, OP-TEE runs in an isolated secure environment. Hardware and software mechanisms prevent applications running in the normal world from accessing protected resources in the secure world.
This architecture enables developers to execute security-sensitive operations without exposing critical assets to potentially compromised applications or operating-system components.
OP-TEE for Linux and Android: Trusted Execution Environment
A Trusted Execution Environment provides an isolated execution area within an application processor. Applications running in the normal or Rich Execution Environment (REE) are separated from trusted applications (TAs) running inside the TEE.
OP-TEE provides this secure environment while leveraging the processing capabilities of the underlying ARM processor. Trusted applications can securely handle sensitive operations such as cryptographic processing, key management, authentication, and protected data access
The OP-TEE ecosystem consists primarily of:
- OP-TEE OS: The trusted operating system running in the secure world.
- OP-TEE Client: Provides communication between applications in the normal world and trusted applications.
- OP-TEE Test: Test framework used to validate OP-TEE functionality and trusted applications.
Key Design Principles of OP-TEE for Linux and Android
OP-TEE is designed around three fundamental principles:
Isolation: Trusted applications and their data remain separated from the normal operating system and other applications.
Small Footprint: The trusted operating system is designed to maintain a relatively small footprint, making it suitable for resource-constrained ARM-based platforms.
Portability: The architecture can be adapted across different processors, platforms, operating systems, and hardware configurations.
ARM TrustZone Architecture
ARM TrustZone provides the hardware foundation for creating separate secure and non-secure execution environments. It divides system resources between the Secure World and Normal World.
Linux or Android applications execute in the Normal World, while OP-TEE and its trusted applications execute in the Secure World. Access to protected memory, peripherals, and other security-sensitive resources can be restricted to the Secure World.
The transition between the two environments is controlled through secure monitor mechanisms. On ARMv8-A systems, Secure Monitor Calls (SMCs) are used to request services from the secure environment.
For example, when a Linux application requires a security-sensitive service, the request can be passed through the Linux TEE driver and OP-TEE client components. The request is then transferred to OP-TEE through the secure monitor interface, allowing the trusted application to perform the required operation securely.
OP-TEE for Linux and Android: i.MX 8 Boot Flow
On ARMv8-based i.MX 8 platforms, OP-TEE works together with ARM Trusted Firmware (ATF), U-Boot, and Linux or Android to establish the secure boot environment.
A typical boot configuration includes:
- flash.bin: Contains boot components such as U-Boot, ATF, and OP-TEE.
- Kernel image: Linux or Android kernel.
- Device Tree Blob (DTB): Describes the hardware configuration to the operating system.
During the boot sequence, ARM Trusted Firmware executes at EL3 and establishes the secure execution environment. It loads and initializes OP-TEE, which executes in the Secure World. U-Boot is then loaded to continue the system boot process and prepare the device tree before launching Linux or Android.
On ARMv8 platforms, the ATF secure monitor and OP-TEE dispatcher work together to manage communication between the Normal and Secure Worlds.
Security Capabilities of OP-TEE for Linux and Android
OP-TEE can be used to implement several security functions within embedded products.
Key capabilities include:
- Trusted Application development
- Secure key management
- Cryptographic operations
- Secure storage
- Protected peripheral access
- Secure and non-secure memory configuration
- Tamper detection
- Secure boot integration
- Trusted application and driver isolation
Secure storage can also be implemented using an REE file system or hardware-backed Replay Protected Memory Block (RPMB) storage, depending on the platform and security requirements.
iWave’s OP-TEE for Linux and Android Expertise
iWave provides embedded security expertise for integrating OP-TEE into application processors and System on Modules.
The implementation support includes:
- OP-TEE OS porting across platforms such as i.MX 6 and i.MX 8
- Secure boot integration with OP-TEE
- Trusted Application development
- OP-TEE driver and peripheral integration
- APIs for secure and non-secure peripheral access
- Secure and non-secure memory configuration
- TZASC-based memory protection
- Secure storage implementation
- RPMB-based protected storage
- Key management
- Tamper detection
- Signing and verification of OP-TEE and boot components
- Chain-of-trust implementation
iWave has also developed secure BSP implementations using OP-TEE for NXP i.MX platforms.
Securing Edge IoT Devices
For connected edge and IoT devices, security needs to extend beyond network protection. Sensitive credentials, encryption keys, trusted applications, firmware, and user data must also be protected at the device level.
OP-TEE provides a hardware-isolated environment for implementing these security functions while allowing Linux or Android to continue handling application-level workloads.
iWave complements its OP-TEE expertise with an embedded Security Suite designed to address multiple layers of device security. The solution can include secure boot, Wi-Fi security, event logging, OS hardening, access control, software firewall, secure firmware updates, encryption, secure storage, and certificate management.
OP-TEE for Linux and Android provide practical foundation for implementing hardware-backed security in modern embedded and edge IoT products. By separating trusted applications and sensitive resources from the normal operating system, OP-TEE helps create a protected environment for security-critical operations.
With experience in OP-TEE porting, Trusted Application development, secure storage, driver integration, secure boot, and chain-of-trust implementation, iWave helps product developers integrate security into ARM-based embedded platforms and accelerate the development of secure connected devices.
For more information, visit www.iwave-global.com or contact mktg@iwave-global.com
