Samsung Patents Technology to Shield Sensitive Phone Tasks in a Separate Locked Environment
Most phones rely on a dedicated security chip to handle sensitive tasks like payments and biometrics. Samsung's new patent describes a software-only way to create the same kind of locked-off space, using a hypervisor to spin up a protected virtual machine on demand.
What Samsung's virtual isolation system actually does
Ever tried to keep a private conversation in a shared apartment, where anyone could walk in? Your phone faces the same problem every time you tap your fingerprint or authorize a payment: the app doing the sensitive work is running in the same general environment as everything else.
Samsung's patent describes a system where the moment a protected task is requested, the phone's main process is paused and a second, isolated virtual environment takes over, handles the sensitive work, and then hands control back. The switch is managed by a piece of low-level software called a hypervisor (think of it as a traffic cop that decides which environment gets to use the processor at any given moment).
The result is that your sensitive data never mingles with ordinary app activity. When the protected task is done, the virtual environment closes up and your regular session resumes, with no interruption you'd notice.
… executing a second virtual CPU of the second virtual machine by using virtual CPU preemption and pausing execution of a first virtual CPU of the first virtual machine based on a request for a first protected service during execution of a first application …
Translation: The phone pauses your normal apps to let a secure, hidden system handle sensitive tasks like banking or passwords.
How the hypervisor switches between normal and protected VMs
The patent describes a type-1 hypervisor (software that sits directly on the device hardware, before any operating system loads) that creates and manages two virtual machines from the moment the device powers on.
- First virtual machine (non-trusted environment): This is where your normal apps run, under a standard guest operating system.
- Second virtual machine (protected environment): This is a locked-off space with its own guest operating system, reserved for sensitive tasks.
When a normal app requests a protected service (a biometric check, a cryptographic operation, a payment authorization), the hypervisor uses virtual CPU preemption (essentially pausing the normal VM's processor allocation mid-task) and hands that physical processor core to the protected VM. The protected VM completes the task, returns the result to the calling app, and releases the processor core back to the normal VM.
The system also acknowledges a third tier: a trusted execution environment (TEE), which runs in a completely separate CPU state and handles the highest-sensitivity operations. The protected environment described here sits between the normal app world and that hardware-level TEE, creating a middle tier that is isolated in software rather than requiring dedicated silicon.
… booting a hypervisor (e.g., type- 1 hypervisor) installed on the computing device in response to power-on of the computing device; provisioning a first virtual machine that provides the non-trusted execution environment and a second virtual machine that provides the protected execution environment …
Translation: When you turn on the phone, it immediately sets up two separate digital spaces to keep your private data away from normal apps.
What this means for security on everyday Samsung devices
For the person using the device, this matters because it reduces dependence on specialized security hardware. Devices that cannot support a full hardware TEE, or lower-cost models in Samsung's lineup, could still offer meaningful isolation for sensitive tasks by using this software approach instead.
The practical payoff is that security protections that currently require expensive chips could be extended to more of the devices people actually buy. Security researchers and enterprise IT teams will note that software isolation is generally considered a step below hardware isolation, so the engineering tradeoff here is cost versus protection depth. Samsung's work in this area sits alongside a broader wave of new Big Tech patents exploring hypervisor-based security for mobile chips, as companies look for ways to protect sensitive tasks without adding dedicated silicon to every device.
For most users, the promise here is that security features they expect on flagship phones could eventually arrive on mid-range and budget devices without a price jump. The filing is technically careful: the three-tier model (normal, protected, trusted) is a real engineering distinction, and the CPU preemption mechanism is a plausible way to do it without a hardware security module. Whether Samsung can make the performance cost of that mid-task CPU handoff invisible to users in practice is the question the patent cannot answer.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
14 drawing sheets from US 2026/0236285 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →