OP-TEE project

OP-TEE project
Name	OP-TEE project
Developer	Linaro; contributors from ARM; STMicroelectronics; NXP Semiconductors; Intel; Google; Huawei Technologies; Texas Instruments; Qualcomm
Released	2015
Programming language	C; Assembly
Operating system	Linux (rich execution environment); Trusted Execution Environment
Platform	ARM architecture (TrustZone)
License	BSD-2-Clause

OP-TEE project

OP-TEE project is an open-source Trusted Execution Environment implementation designed for ARM architecture TrustZone platforms. It provides a reference secure-world operating system and runtime to host Trusted Applications alongside a rich-world client running on Linux or other host systems. The project is led by Linaro with contributions from major semiconductor and software organizations such as ARM, Google, STMicroelectronics, and NXP Semiconductors.

Overview

OP-TEE project implements a small, auditable Trusted Execution Environment based on the ARM TrustZone technology used in devices from Samsung Electronics to Qualcomm. The codebase follows the BSD license model and integrates with the Linux kernel through a kernel driver and user-space libraries. It aims to provide a stable reference for secure services such as cryptography, key management, and secure storage used by platforms from embedded devices by Intel partners to consumer products by Huawei Technologies. The project coordinates with standards and ecosystems including GlobalPlatform specifications and tooling from Open Embedded and Yocto Project.

Architecture

OP-TEE project separates execution into a rich execution environment running on Linux and a secure world running OP-TEE OS on ARM Cortex-A cores using TrustZone. The architecture includes a Trusted OS, a Trusted Applications framework, and a host-side client library that communicates over a standard secure monitor call interface compatible with vendors such as ARM and silicon providers like MediaTek. Trusted Applications are written in C and compiled for the secure world, while rich-world counterparts use user-space APIs on Linux or Android from projects such as AOSP. Communication flows are mediated by a secure monitor and platform-specific firmware from vendors such as STMicroelectronics or NXP Semiconductors.

Security Model and Threats

OP-TEE project assumes a threat model where the rich world, including kernels like Linux and environments like Android, can be compromised, while the secure world remains isolated via ARM TrustZone hardware mechanisms. The security model defends against attacks such as compromised device drivers, exploitation of user-space services, and physical attacks mitigated by secure boot chains implemented by vendors like Qualcomm and Samsung Electronics. The project supports cryptographic primitives often based on standards from organizations such as NIST and interoperability targets including GlobalPlatform APIs to establish attestation and measured boot chains with platforms developed by Intel and Broadcom. Known threats include speculative execution side channels first publicly discussed in contexts like the Spectre and Meltdown disclosures, which influence mitigations implemented at firmware and OS levels by ecosystem partners such as Google (company).

Development and Contribution

OP-TEE project is hosted as an open-source repository managed through collaboration tools used by contributors from Linaro, ARM, STMicroelectronics, NXP Semiconductors, and downstream integrators such as Samsung Electronics and Qualcomm. Development follows public code review workflows and continuous integration patterns common in projects supported by Yocto Project and build systems like CMake and GNU Make. Contributors submit patches, discuss design on mailing lists, and coordinate with industrial consortia including Linaro working groups and GlobalPlatform. The project integrates testing with hardware platforms from vendors like Texas Instruments and adopts secure coding practices influenced by standards from ISO and guidance from organizations such as OWASP.

Deployment and Use Cases

OP-TEE project is deployed across a wide range of products from embedded platforms by STMicroelectronics and NXP Semiconductors to smartphones by vendors such as Samsung Electronics and Huawei Technologies. Use cases include secure key storage for Android Keystore, DRM implementations alongside Widevine and similar content protection systems, secure payment applications interfacing with services like Mastercard and Visa, and industrial IoT gateways using secure firmware update mechanisms by partners including Intel and Qualcomm. The project serves as a reference TEE for OEMs integrating with services from cloud providers such as Google (company) and for research published by institutions like University of Cambridge and ETH Zurich.

Performance and Compatibility

OP-TEE project targets low overhead to preserve performance of rich-world workloads on platforms based on ARM Cortex-A cores. Benchmarks compare context switch costs and cryptographic throughput against vendor TEEs provided by Qualcomm and others, with optimizations for memory isolation on SoCs from MediaTek and Broadcom. Compatibility is maintained via adherence to GlobalPlatform interfaces and testing against multiple Linux distributions and build systems such as Yocto Project and OpenEmbedded. Integration guides and sample Trusted Applications help vendors achieve interoperability with trusted firmware stacks from suppliers like ARM and silicon vendors such as STMicroelectronics and NXP Semiconductors.

Category:Trusted Execution Environment