Enabling late-binding of security features via configuration security controller for accelerator devices

A method comprising:

• initializing a programmable portion of a security controller of a hardware accelerator device as part of a secure boot and attestation chain of trust, wherein the security controller is to manage security and configuration of the hardware accelerator device, and wherein the security controller comprises the programmable portion and a non-programmable portion;
• receiving, by the security controller, configuration data for the programmable portion of the security controller, the programmable portion comprising components of the security controller capable of re-programming;
• verifying and validating, by the security controller, the configuration data as originating from a secure and trusted source;
• and
• responsive to successful verification and validation of the configuration data, re-programming, by the security controller during runtime of the apparatus, the programmable portion of the security controller using configurations that are based on a security threat model for a given deployment.

A non-transitory machine readable storage medium comprising instructions that, when executed, cause at least one processor to at least:

• initialize a programmable portion of a security controller of a hardware accelerator device as part of a secure boot and attestation chain of trust, wherein the security controller is to manage security and configuration of the hardware accelerator device, and wherein the security controller comprises the programmable portion and a non-programmable portion;
• receive, by the security controller, configuration data for the programmable portion of the security controller, the programmable portion comprising components of the security controller capable of re-programming;
• verify and validate, by the security controller, the configuration data as originating from a secure and trusted source;
• and
• responsive to successful verification and validation of the configuration data, re-program, by the security controller during runtime of the apparatus, the programmable portion of the security controller using configurations that are based on a security threat model for a given deployment.