A device for supporting Input/Output, IO, channel protection, the device being configured to: maintain one or more channel protection enclaves, CPEs, wherein each CPE is associated with a different I/O channel , wherein each I/O channel is associated with a different address space of a memory , and wherein each CPE is allocated verification information comprising the address space associated with its associated I/O channel ; receive a transaction on a given I/O channel , the transaction comprising access information including one or more target addresses; determine a correlation of the transaction's access information and the verification information of the CPE associated with the given I/O channel ; wherein the device comprises a context database configured to store the verification information, wherein the verification information is included in one or more of - an identity manager , - a policy manager , - a behavioral database , and wherein the device is further configured to: extract, by the identity manager , a transactor identity from the received transaction; extract, by the policy manager , a channel enclave policy from the received transaction; determine the correlation based on the extracted transactor identity and the extracted channel enclave policy; and allow execution of the transaction, when the determined correlation meets a predefined criterion or abort the transaction, when the determined correlation does not meet the predefined criterion. maintain one or more channel protection enclaves, CPEs, wherein each CPE is associated with a different I/O channel , wherein each I/O channel is associated with a different address space of a memory , and wherein each CPE is allocated verification information comprising the address space associated with its associated I/O channel ; receive a transaction on a given I/O channel , the transaction comprising access information including one or more target addresses; determine a correlation of the transaction's access information and the verification information of the CPE associated with the given I/O channel ; wherein the device comprises a context database configured to store the verification information, wherein the verification information is included in one or more of - an identity manager , - a policy manager , - a behavioral database , - an identity manager , - a policy manager , - a behavioral database , and wherein the device is further configured to: extract, by the identity manager , a transactor identity from the received transaction; extract, by the policy manager , a channel enclave policy from the received transaction; determine the correlation based on the extracted transactor identity and the extracted channel enclave policy; and allow execution of the transaction, when the determined correlation meets a predefined criterion or abort the transaction, when the determined correlation does not meet the predefined criterion. extract, by the identity manager , a transactor identity from the received transaction; extract, by the policy manager , a channel enclave policy from the received transaction; determine the correlation based on the extracted transactor identity and the extracted channel enclave policy; and allow execution of the transaction, when the determined correlation meets a predefined criterion or abort the transaction, when the determined correlation does not meet the predefined criterion. <EOS>