Device, integrated circuit and methods for detecting, responding to and removing a compromising attack

An integrated circuit for a device, the integrated circuit comprising:

• at least one host application;
• a rich execution environment (REE) for communicating with a remote server;
• and
• a security sub-system that comprises a security monitoring and control circuit coupled to the REE and connectable to the remote server via the REE and an interface;
• wherein the integrated circuit is characterised in that the security monitoring and control circuit comprises an analytics circuit configured to detect an anomaly following a compromisation of the device, and the security monitoring and control circuit is arranged to treat the REE as an untrusted component of the device and in response to a detection of a compromisation of the REE or a component in the device that is accessible by the REE by the analytics circuit, the security monitoring and control circuit is configured to initiate re-establishing a secure connection to the remote server via the interface that tunnels through the REE and at least partially removes the compromisation from the device.

A method for a security device, the method comprising:

• communicating with a remote server by and via a rich execution environment (REE);
• wherein the method is characterised by:
• treating the REE as an untrusted component by a security monitoring and control circuit coupled to the REE;
• detecting a compromisation of the REE or a component in the device that is accessible by the REE, and
• in response to a detection of a compromisation of the REE,
• initiating, by the security monitoring and control circuit, re-establishing a secure connection to the remote server from the security monitoring and control circuit that tunnels through the REE and
• removing at least partially the compromisation from the device.