A device for supporting Input/Output, IO, channel protection, the device being configured to: maintain one or more channel protection enclaves, CPEs, (111, 112, 113) wherein each CPE (111, 112, 113) is associated with a different I/O channel (121, 122, 123), wherein each I/O channel (121, 122, 123) is associated with a different address space of a memory, and wherein each CPE (111, 112, 113) is allocated verification information comprising the address space associated with its associated I/O channel (121, 122, 123); receive a transaction on a given I/O channel (121, 122, 123), the transaction comprising access information including one or more target addresses; determine a correlation of the transaction's access information and the verification information of the CPE (111, 112, 113) associated with the given I/O channel (121, 122, 123); wherein the device comprises a context database configured to store the verification information, wherein the verification information is included in one or more of - an identity manager, - a policy manager, - a behavioral database, and wherein the device is further configured to: extract, by the identity manager, a transactor identity from the received transaction; extract, by the policy manager, a channel enclave policy from the received transaction; determine the correlation based on the extracted transactor identity and the extracted channel enclave policy; and allow execution of the transaction, when the determined correlation meets a predefined criterion or abort the transaction, when the determined correlation does not meet the predefined criterion. maintain one or more channel protection enclaves, CPEs, (111, 112, 113) wherein each CPE (111, 112, 113) is associated with a different I/O channel (121, 122, 123), wherein each I/O channel (121, 122, 123) is associated with a different address space of a memory, and wherein each CPE (111, 112, 113) is allocated verification information comprising the address space associated with its associated I/O channel (121, 122, 123); receive a transaction on a given I/O channel (121, 122, 123), the transaction comprising access information including one or more target addresses; determine a correlation of the transaction's access information and the verification information of the CPE (111, 112, 113) associated with the given I/O channel (121, 122, 123); wherein the device comprises a context database configured to store the verification information, wherein the verification information is included in one or more of - an identity manager, - a policy manager, - a behavioral database, - an identity manager, - a policy manager, - a behavioral database, and wherein the device is further configured to: extract, by the identity manager, a transactor identity from the received transaction; extract, by the policy manager, a channel enclave policy from the received transaction; determine the correlation based on the extracted transactor identity and the extracted channel enclave policy; and allow execution of the transaction, when the determined correlation meets a predefined criterion or abort the transaction, when the determined correlation does not meet the predefined criterion. extract, by the identity manager, a transactor identity from the received transaction; extract, by the policy manager, a channel enclave policy from the received transaction; determine the correlation based on the extracted transactor identity and the extracted channel enclave policy; and allow execution of the transaction, when the determined correlation meets a predefined criterion or abort the transaction, when the determined correlation does not meet the predefined criterion.