Cryptographic separation of memory on device with use in DMA protection

One or more non-transitory computer-readable storage media comprising a plurality of instructions stored thereon that, in response to being executed, cause a processor to:

• assign, to a trusted agent of a computing device, a first cryptographic key to a first application executing on a computing device, the first cryptographic key selected from a plurality of cryptographic keys that are to be assigned to a plurality of different applications;
• initialize an authentication tag in response to an initialization command from a trusted execution environment of the computing device;
• initiate a transfer of data between a host memory and an accelerator device memory in response to a descriptor from the trusted execution environment, wherein the descriptor comprises a target memory address and is indicative of a transfer direction;
• compare the target memory address with a plurality of address ranges and select a cryptographic key from the plurality of plurality of address range registers based on the target memory address;
• perform a cryptographic operation with the data in response to transferring the data;
• update the authentication tag in response to transferring the data;
• and
• finalize the authentication tag in response to a finalization command from the trusted execution environment.

A computer-based method, comprising:

• assigning a first cryptographic key to a first application executing on the computing device, the first cryptographic key selected from a plurality of cryptographic keys that are to be assigned to a plurality of different applications;
• initializing an authentication tag in response to an initialization command from a trusted execution environment of the computing device;
• initiating a transfer of data between a host memory and an accelerator device memory in response to a descriptor from the trusted execution environment, wherein the descriptor comprises a target memory address and is indicative of a transfer direction;
• comparing the target memory address with a plurality of address ranges and select a cryptographic key from the plurality of plurality of address range registers based on the target memory address;
• performing a cryptographic operation with the data in response to transferring the data;
• updating the authentication tag in response to transferring the data;
• and
• finalizing authentication tag in response to a finalization command from the trusted execution environment.