An apparatus supporting secure address translation services, the apparatus comprising: a memory for storage of data; and an Input/Output Memory Management Unit, IOMMU, coupled to the memory via a host-to-device link, the IOMMU configured to perform operations, comprising: receiving an initial host translation request from a remote device for a translation of a virtual address to a host physical address, HPA, that identifies a physical address within the memory; in response to the initial host translation request, generating a first message authentication code, MAC, using a private key associated with the remote device; searching an invalidation tracking table, ITT, maintained by the IOMMU for an entry that matches the HPA and a page size for the HPA, said invalidation tracking table configured to track HPA invalidation requests; in response to locating an entry in the ITT that matches the HPA and the page size, removing the entry from the ITT; returning the HPA and the first MAC to the remote device; receiving a memory access request from the remote device via the host-to-device link, wherein the memory access request comprises the HPA; generating a second MAC using the host physical address received with the memory access request and the private key; and performing operations consisting of: allowing the memory access to proceed when the first MAC and the second MAC match and the HPA is not in the ITT; blocking the memory operation when the first MAC and the second MAC do not match. a memory for storage of data; and an Input/Output Memory Management Unit, IOMMU, coupled to the memory via a host-to-device link, the IOMMU configured to perform operations, comprising: receiving an initial host translation request from a remote device for a translation of a virtual address to a host physical address, HPA, that identifies a physical address within the memory; in response to the initial host translation request, generating a first message authentication code, MAC, using a private key associated with the remote device; searching an invalidation tracking table, ITT, maintained by the IOMMU for an entry that matches the HPA and a page size for the receiving an initial host translation request from a remote device for a translation of a virtual address to a host physical address, HPA, that identifies a physical address within the memory; in response to the initial host translation request, generating a first message authentication code, MAC, using a private key associated with the remote device; searching an invalidation tracking table, ITT, maintained by the IOMMU for an entry that matches the HPA and a page size for the HPA, said invalidation tracking table configured to track HPA invalidation requests; in response to locating an entry in the ITT that matches the HPA and the page size, removing the entry from the ITT; returning the HPA and the first MAC to the remote device; receiving a memory access request from the remote device via the host-to-device link, wherein the memory access request comprises the HPA; generating a second MAC using the host physical address received with the memory access request and the private key; and returning the HPA and the first MAC to the remote device; receiving a memory access request from the remote device via the host-to-device link, wherein the memory access request comprises the HPA; generating a second MAC using the host physical address received with the memory access request and the private key; and performing operations consisting of: allowing the memory access to proceed when the first MAC and the second MAC match and the HPA is not in the ITT; blocking the memory operation when the first MAC and the second MAC do not match. allowing the memory access to proceed when the first MAC and the second MAC match and the HPA is not in the ITT; blocking the memory operation when the first MAC and the second MAC do not match.