There are different scenarios when it's about secure computation/storage on mobile devices, e.g., "REE only", "REE + TEE", or "REE + SE" or "REE + TEE + SE".
"Classical" REE app resides in phone memory, and all the operations are done within the REE environment - this is obvious. However, I wanted to clarify how the processes are distributed across the components (REE/TEE/SE) in the above-mentioned "multi-component" scenarios:
- Do I understand right, that there always is the "REE part" of the app, which the user interacts with (e.g., digital wallet), but when TEE is added to the solution is the "TEE part" of the app is added too? It resides on TEE, performs secure computations and TEE also serves as a container to securely store data, right? So REE part of the app plays a role of the UI "frontend", while TEE part is kind of "secure backend" - does it work that way?
- When both TEE and SE are part of the solution - which of them serves (or at least is recommended) to perform computations and which - to act as a secure data storage? Does an additional "SE part" of the app appear in this scenario, or does it rather depend on the role of SE (e.g., app is needed for computations, but is not needed if SE serves as a storage only)?
- Am I right that it's only REE or TEE that can connect developer to device hardware (e.g., biometric sensor, camera, etc.), i.e. SE does not have this functionality?