PCI Express Security and TEE Integration, Part 1 - Establishing Trust

Security Foundations for PCIe: Establishing Trust Beyond the CPU

As AI infrastructure evolves toward multi-GPU servers, rack-scale architectures, composable infrastructure, and disaggregated data centers, PCI Express® (PCIe®) has become far more than a peripheral interconnect. Today, PCIe serves as the primary connectivity fabric between CPUs, GPUs, AI accelerators, SmartNICs, storage controllers, memory expanders, and chiplets. Sensitive data, proprietary models, cryptographic keys, and confidential workloads increasingly traverse PCIe links.

This evolution fundamentally changes the security requirements of PCIe-based systems. Historically, most PCIe traffic remained within a trusted server chassis. Physical access to the interconnect was difficult, and the operating system or hypervisor was generally assumed to be trustworthy. Those assumptions no longer hold. Modern deployments may involve confidential computing workloads that explicitly do not trust the hypervisor. PCIe traffic may travel across switches, retimers, cable connections, composable infrastructure fabrics, and accelerator modules that reside outside the traditional trust boundary.

As a result, protecting processor memory alone is no longer sufficient. The entire I/O path must become part of the trusted computing architecture.

To address this challenge, PCI-SIG® has developed a suite of complementary security technologies, including Data Object Exchange (DOE), Component Measurement and Authentication (CMA), Integrity and Data Encryption (IDE), and the TEE Device Interface Security Protocol (TDISP). Together, these technologies extend security beyond the CPU and memory subsystem to encompass PCIe-attached devices and the communication paths between them.

Understanding Trusted Execution Environments

Before discussing PCIe security mechanisms, it is important to understand the concept of a trusted execution environment (TEE).

A TEE is a hardware-protected execution domain that isolates sensitive applications and their data from the rest of the system. Intel TDX and AMD SEV-SNP are examples of TEE technologies. Arm Confidential Compute Architecture (CCA) uses the Realm Management Extension (RME) to support isolated execution environments called Realms. TEEs allow sensitive workloads to execute without trusting the operating system, hypervisor, or other software outside the workload's trusted computing base (TCB).

While TEEs provide strong protection for CPU execution and memory, they create a new challenge: how can a trusted workload safely communicate with external devices?

Consider a confidential AI training workload running inside a TEE. The workload may need direct access to GPUs, DPUs, storage devices, or network adapters. Simply assigning a PCIe device to the workload is insufficient because neither the communication path nor the device itself may be trusted. PCIe security technologies bridge this gap.

The Security Foundation: DOE, SPDM, and CMA

Before devices can exchange encrypted traffic, trust must first be established. Therefore, PCIe security begins with three foundational technologies.

DOE

Data Object Exchange (DOE) provides a standardized mechanism for exchanging management and security messages between PCIe components. Think of DOE as a mailbox built into the PCIe fabric through which security protocols communicate.

Rather than defining security itself, DOE provides the transport mechanism used by higher-level protocols. PCI-SIG describes DOE as the mechanism for transporting security-related data objects between hosts and PCIe devices.

SPDM

Security Protocol and Data Model (SPDM) is a security protocol developed by the Distributed Management Task Force (DMTF).

SPDM enables:

• Device authentication
• Firmware measurement collection
• Secure session establishment
• Key exchange
• Attestation

In practical terms, SPDM allows a host platform to verify that a PCIe device is genuine, running approved firmware, and operating in an expected security state before trusting it.

CMA

Component Measurement and Authentication (CMA) is the PCI-SIG architecture that applies SPDM specifically to PCIe systems.

CMA establishes how PCIe components perform authentication, collect measurements, and exchange attestation information. Together, DOE, SPDM, and CMA form the control-plane foundation used by higher-level PCIe security protocols.

A useful analogy is transport layer security (TLS) on a secure website. Before encrypted communication begins, both parties must establish identity and exchange cryptographic information. CMA and SPDM serve a similar purpose for PCIe devices.

From Trust Establishment to Trusted Communications

DOE, SPDM, and CMA establish the control-plane trust needed before a PCIe device can exchange protected traffic or be assigned to a confidential workload. Once a device has been authenticated and its security state validated, IDE protects data moving across the PCIe fabric while TDISP enables secure assignment of the device to a TEE.

Together, these technologies extend the chain of trust beyond processor execution and memory, allowing confidential workloads to communicate securely with PCIe-attached accelerators, storage devices, and network interfaces. Figure 1 illustrates how these capabilities build upon one another within the PCIe confidential computing architecture.

Figure 1: PCIe Confidential Computing Security Architecture (image generated by Microsoft Copilot)

Establishing the Foundation for Protected PCIe Communications

DOE, SPDM, and CMA establish the control-plane trust required to authenticate devices and validate their security state. Once trust is established, the next step is to protect transaction data as it moves between components.

Part 2 of this series will examine how IDE provides confidentiality, integrity protection, and replay protection across PCIe links and fabrics.

For more information on Cadence's controller and PHY IP solutions for PCIe, visit the PCIe and CXL landing page.