A runtime environment for a mobile end device, comprising: - a normal runtime environment implemented in the end device for client applications; - a secure runtime environment utilizable for trusted applications by the end device; wherein the normal runtime environment and the secure runtime environment are devised to cooperatively establish and operate a communication connection between the normal and the secure runtime environment (REE, TEE), so that service requests can be transferred from the normal to the secure runtime environment and security services can be supplied from the secure to the normal runtime environment; wherein - the secure runtime environment is implemented as an external secure runtime environment (TEEaaS) on a server arranged outside the end device, wherein the security services are also reachable when the end device is switched off; - the normal runtime environment and the external secure runtime environment (TEEaaS) are devised to execute a client/ server protocol between the normal runtime environment and the external secure runtime environment (TEEaaS) for establishing the communication connection, and the runtime environment further comprises: - a client API implemented in the normal runtime environment and a core API implemented in the secure runtime environment which are devised to pass service requests for security services from client applications to trusted applications as well as to pass security services requested by service requests from trusted applications to client applications; and an REE agent implemented in the normal runtime environment and a TEE agent implemented in the secure runtime environment are devised to cooperatively establish and operate a communication connection between the normal and the secure runtime environment (REE, TEE), so that service requests can be transferred from the normal to the secure runtime environment and security services can be transferred from the secure to the normal runtime environment; wherein the REE agent and the TEE agent are devised to execute the client/server protocol between the normal runtime environment and the external secure runtime environment (TEEaaS) for establishing the communication connection. - a normal runtime environment implemented in the end device for client applications; - a secure runtime environment utilizable for trusted applications by the end device; wherein the normal runtime environment and the secure runtime environment are devised to cooperatively establish and operate a communication connection between the normal and the secure runtime environment (REE, TEE), so that service requests can be transferred from the normal to the secure runtime environment and security services can be supplied from the secure to the normal runtime environment; wherein - the secure runtime environment is implemented as an external secure runtime environment (TEEaaS) on a server arranged outside the end device, wherein the security services are also reachable when the end device is switched off; - the normal runtime environment and the external secure runtime environment (TEEaaS) are devised to execute a client/ server protocol between the normal runtime environment and the external secure runtime environment (TEEaaS) for establishing the communication connection, and the runtime environment further comprises: - a client API implemented in the normal runtime environment and a core API implemented in the secure runtime environment which are devised to pass service requests for security services from client applications to trusted applications as well as to pass security services requested by service requests from trusted applications to client applications; and an REE agent implemented in the normal runtime environment and a TEE agent implemented in the secure runtime environment are devised to cooperatively establish and operate a communication connection between the normal and the secure runtime environment (REE, TEE), so that service requests can be transferred from the normal to the secure runtime environment and security services can be transferred from the secure to the normal runtime environment; wherein the REE agent and the TEE agent are devised to execute the client/server protocol between the normal runtime environment and the external secure runtime environment (TEEaaS) for establishing the communication connection. - a client API implemented in the normal runtime environment and a core API implemented in the secure runtime environment which are devised to pass service requests for security services from client applications to trusted applications as well as to pass security services requested by service requests from trusted applications to client applications; and an REE agent implemented in the normal runtime environment and a TEE agent implemented in the secure runtime environment are devised to cooperatively establish and operate a communication connection between the normal and the secure runtime environment (REE, TEE), so that service requests can be transferred from the normal to the secure runtime environment and security services can be transferred from the secure to the normal runtime environment; wherein the REE agent and the TEE agent are devised to execute the client/server protocol between the normal runtime environment and the external secure runtime environment (TEEaaS) for establishing the communication connection.