Securing critical data in a storage device of a computer system

A method of securing critical data in a computer system that comprises a system on a chip (SOC) with a Reduced Instruction Set Computer (RISC) processor core that operates in a normal world and a secure world, the RISC processor core providing hardware-level isolation between the normal world and the secure world, the method comprising:

• storing one or more storage commands in a secure memory space in the secure world, wherein the secure world is a Trusted Execution Environment (TEE) and the normal world is a Rich Execution Environment (REE);
• making a secure monitor call from the normal world to the secure world;
• and
• responsive to the secure monitor call, transferring critical data between a protected data region of an external storage device and a normal memory space that is accessible in the normal world in accordance with the one or more storage commands,
• wherein the external storage device is external to the SOC.