A trusted execution environment (TEE) is an isolated, protected area for executing sensitive operations and safeguarding data from the main operating environment. In biometric authentication, it securely stores a mathematical template rather than a raw fingerprint, face, iris, or voice recording. section 15.1.5
The boundary matters because biometric data is difficult to replace after exposure. During enrollment, the device converts captured features into a mathematical representation; during authentication, it compares a new measurement with that template and grants access when they sufficiently match. section 15.1.5
A key blueprint instead of the key
Imagine pressing a fingerprint into wax, recording only measurements of its ridges and curves, and later comparing new measurements with that record. The system keeps the blueprint-like template rather than the fingerprint itself. section 15.1.5
Figure 15.1 Biometric authenticatation is a three-step process. First, a user registers their data. Then the user tries to authenticate and be verified by the system.
Follow the registration, authentication, and verification flow to see where protected storage supports biometric login. section 15.1.5
