DEVICE, INTEGRATED CIRCUIT AND METHODS THEREFOR

A device (210) and methods (600, 700) are described that comprise at least one host application (122, 124) and a rich execution environment (REE 220). At least one interface (235) is operably coupled to the REE (220) for communicating with a remote server (140). A security sub-system (228) comprises a security monitoring and control circuit (212) coupled to the REE (220) and connectable to the remote server (140) via the REE (220) and the at least one interface (235). The security monitoring and control circuit (212) comprises an analytics circuit (214) configured to detect an anomaly following a compromisation of the device (210). The security monitoring and control circuit (212) is arranged to treat the REE (220) as an untrusted component and in response to a detection of a compromisation of the REE (220) or a component in the device that is accessible by the REE (220) by the analytics circuit (214), the security monitoring and control circuit (212) is configured to re-establish a secure connection to the remote server (140) that tunnels through the REE (220) and at least partially removes the compromisation from the device (210).