A trust zone-based operating system, wherein the operating system is applied to a terminal device, the operating system comprises a secure world subsystem, a trusted execution environment TEE, a TEE monitoring area, and a security switching apparatus run in the secure world subsystem, and the TEE and the TEE monitoring area are separately connected to the security switching apparatus and are isolated by the security switching apparatus; the TEE is configured to: after a first sensitive operation request sent by a trusted application TA in the TEE is received, store, in a general-purpose register, a first sensitive instruction identifier corresponding to the first sensitive operation request and a first operation parameter of the first sensitive operation request, and send a first switching request carrying a first switching identifier to the security switching apparatus, wherein the first switching identifier is used to identify that a running environment of the secure world subsystem needs to be switched from the TEE to the TEE monitoring area; the security switching apparatus is configured to: receive the first switching request, and switch the running environment of the secure world subsystem from the TEE to the TEE monitoring area according to the first switching request; and the TEE monitoring area is configured to: store a sensitive instruction in the operating system; after the running environment of the secure module subsystem is switched from the TEE to the TEE monitoring area, read the first sensitive instruction identifier and the first operation parameter from the general-purpose register, call a corresponding first sensitive instruction based on the first sensitive instruction identifier, and perform a corresponding first sensitive operation by using the called first sensitive instruction and the first operation parameter. the TEE is configured to: after a first sensitive operation request sent by a trusted application TA in the TEE is received, store, in a general-purpose register, a first sensitive instruction identifier corresponding to the first sensitive operation request and a first operation parameter of the first sensitive operation request, and send a first switching request carrying a first switching identifier to the security switching apparatus, wherein the first switching identifier is used to identify that a running environment of the secure world subsystem needs to be switched from the TEE to the TEE monitoring area; the security switching apparatus is configured to: receive the first switching request, and switch the running environment of the secure world subsystem from the TEE to the TEE monitoring area according to the first switching request; and the TEE monitoring area is configured to: store a sensitive instruction in the operating system; after the running environment of the secure module subsystem is switched from the TEE to the TEE monitoring area, read the first sensitive instruction identifier and the first operation parameter from the general-purpose register, call a corresponding first sensitive instruction based on the first sensitive instruction identifier, and perform a corresponding first sensitive operation by using the called first sensitive instruction and the first operation parameter.