Composable trusted execution environments

An apparatus, comprising:

• input/output (I/O) circuitry to communicate with one or more devices over an interconnect;
• and
• processing circuitry to:
• receive, via the I/O circuitry, a device signature from a first device of the one or more devices, wherein the device signature cryptographically identifies the first device;
• authenticate the first device based on the device signature;
• and
• configure a composed trusted execution environment (TEE) on a virtual machine (VM), wherein the composed TEE is distributed across the processing circuitry and the first device, and wherein an encrypted data stream is configured over the interconnect for communication between the processing circuitry and the first device within the composed TEE.

A system, comprising:

• an input/output (I/O) controller to communicate with one or more I/O devices over an interconnect;
• and
• a processor to execute one or more workloads in a composed trusted execution environment (TEE) on a virtual machine (VM);
• and
• a security controller to configure the composed TEE on the VM, wherein the composed TEE is distributed across the processor and a first device of the one or more I/O devices, and wherein an encrypted data stream is configured over the interconnect for communication between the processor and the first device within the composed TEE.

At least one non-transitory computer-readable medium having instructions stored thereon, wherein the instructions, when implemented or executed on processing circuitry, cause the processing circuitry to:

• receive, over an interconnect, a device signature from a first device, wherein the device signature cryptographically identifies the first device;
• authenticate the first device based on the device signature;
• and
• configure a composed trusted execution environment (TEE) on a virtual machine (VM), wherein the composed TEE is distributed across the processing circuitry and the first device, and wherein an encrypted data stream is configured over the interconnect for communication between the processing circuitry and the first device within the composed TEE.

A device, comprising:

• input/output (I/O) circuitry to communicate with a processor over an interconnect;
• and
• controller circuitry to:
• receive, via the I/O circuitry, a request from the processor to add the device to a composed trusted execution environment (TEE), wherein the composed TEE is to include:
• a first TEE on the processor;
• a second TEE on the device;
• and
• an encrypted data stream configured over the interconnect for communication between the first TEE and the second TEE;
• and
• configure the second TEE on the device, wherein the second TEE is to be included in the composed TEE.