Protecting data transfer between a secure application and networked devices

A method comprising:

• generating, by a processor executing an application running in a trusted execution environment (TEE) of the processor, encrypted data of the application;
• copying, by the processor using the application in the TEE, the encrypted data to a local shared buffer;
• interfacing, by the processor using the application in the TEE, with a source network interface card (NIC) to initiate a copy, over a network, of the encrypted data from the local shared buffer to a remote buffer of a remote platform, wherein the source NIC operates outside of a trust boundary of the TEE;
• and
• communicating, by the processor using the application in the TEE, at least one message with the remote platform to indicate that the encrypted data is available and to enable the remote platform to verify integrity of the encrypted data, wherein the one least one message comprises an authentication tag calculated over a payload of the at least one message using a shared secret key.

A non-transitory machine readable storage medium having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• generating, by a processor executing an application running in a trusted execution environment (TEE) of the processor, encrypted data of the application;
• copying, by the processor using the application in the TEE, the encrypted data to a local shared buffer;
• interfacing, by the processor using the application in the TEE, with a source network interface card (NIC) to initiate a copy, over a network, of the encrypted data from the local shared buffer to a remote buffer of a remote platform, wherein the source NIC operates outside of a trust boundary of the TEE;
• and
• communicating, by the processor using the application in the TEE, at least one message with the remote platform to indicate that the encrypted data is available and to enable the remote platform to verify integrity of the encrypted data, wherein the one least one message comprises an authentication tag calculated over a payload of the at least one message using a shared secret key.