Securing platform link with encryption

A method comprising:

• setting up a protected Peripheral Component Interconnect Express (PCIe) link between a first computing device and a second computing device;
• generating a plurality of packets for transmission over the protected PCIe link, the plurality of packets comprising first packets having a message type of Posted Request, second packets having a message type of Completion, and third packets having a message type of Non-Posted Request;
• and
• encrypting data of the plurality of packets for transmission over the protected PCIe link, wherein the first packets, second packets, and third packets are encrypted in respective streams, wherein each stream utilizes a separate cryptographic key and counter.

At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

• exchange, with a Peripheral Component Interconnect Express (PCIe) endpoint, a plurality of cryptographic keys to encrypt data of a plurality of packets communicated over a PCIe link between the machine and the PCIe endpoint, wherein:
• a first cryptographic key of the plurality of cryptographic keys is dedicated to encrypt first packets having a message type of Posted Request;
• a second cryptographic key of the plurality of cryptographic keys is dedicated to encrypt second packets having a message type of Completion;
• and
• a third cryptographic key of the plurality of cryptographic keys is dedicated to encrypt third packets having a message type of Non-Posted Request.

A server comprising:

• a first computing device comprising:
• a processor core;
• and
• a controller coupled to the processor core, the controller comprising:
• first circuitry to generate a plurality of packets for transmission over a Peripheral Component Interconnect Express (PCIe) link between the computing device and a second computing device, the packets comprising first packets having a message type of Posted Request, second packets having a message type of Completion, or third packets having a message type of Non-Posted Request;
• and
• second circuitry to encrypt data of the plurality of packets for transmission over the PCIe link, wherein the second circuitry is to encrypt data of the first packets of the Posted Request message type based on a first cryptographic key and a first counter, encrypt data of the second packets of the Completion message type based on a second cryptographic key and a second counter, or to encrypt data of the third packets of the Non-Posted Request message type based on a third cryptographic key and a third counter.