Systems, methods, and devices for key per input/output security

1. A device comprising:

a communications circuit configured to communicate with a storage device controller and a host device; and

a processing device configured to:

receive a first request from the storage device controller through the communications circuit, the first request requesting first data be written to a first memory address of the host device;

identify a first key tag associated with the first request based on the first memory address;

generate second data based on the first key tag, the second data being the first data in a decrypted format;

initiate transfer, through the communications circuit, of the second data to the host device;

receive a second request from the storage device controller through the communications circuit, the second request requesting third data be read from a second memory address of the host device;

identify a second key tag associated with the second request based on the second memory address;

store an association between the second key tag and a read tag of the second request; and

initiate transmission of the second request to the host device.

2. The device of claim 1 , wherein the processing device is further configured to:

receive a read command from the host device through the communications circuit, the read command identifying a memory range and the first key tag;

store an association between the memory range and the first key tag in a memory device;

identify the first key tag in response to the first memory address corresponding to the memory range based on the association; and

identify a first key based on the first key tag.

3. The device of claim 2 , wherein the processing device is further configured to initiate transfer of the read command to the storage device controller.

4. The device of claim 2 , wherein the processing device is further configured to identify an input/output (I/O) submission queue based on communications between the host device and the storage device controller.

5. The device of claim 1 , wherein the processing device is further configured to:

receive a message from the host device, the message including the read tag and the third data;

identify the second key tag based on the association between the second key tag and the read tag;

identify a second key based on the second key tag; and

encrypt the third data based on the second key.

6. The device of claim 1 , wherein the processing device comprises one or more field programmable gate array blocks, and wherein the communications circuit includes:

a first communications interface configured to communicate with the storage device controller; and

a second communications interface configured to communicate with the host device.

7. The device of claim 1 , further comprising a memory storing instructions, wherein the processing device corresponds to a central processor unit configured to execute the instructions.

8. The device of claim 1 , further comprising a memory device storing a lookup table associating key tags to address ranges and storing a key table associating key tags to keys, wherein the processing device is configured to:

identify the first key tag based on the first memory address using the lookup table; and

identify a first key based on the first key tag using the key table.

9. A method comprising:

receiving, at a device in communication with a storage device controller and a host device, a first request from the storage device controller, the first request requesting first data be written to a first memory address of the host device;

identifying a first key tag associated with the first request based on the first memory address;

generating second data based on the first key tag, the second data being the first data in a decrypted format;

initiating transfer of the second data to the host device;

receiving a second request from the storage device controller, the second request requesting third data be read from a second memory address of the host device;

identifying a second key tag associated with the second request based on the second memory address;

storing an association between the second key tag and a read tag of the second request; and

initiating transmission of the second request to the host device.

10. The method of claim 9 , further comprising:

receiving a read command from the host device, the read command identifying a memory range and the first key tag;

storing an association between the memory range and the first key tag in a memory device;

identifying the first key tag in response to the first memory address corresponding to the memory range; and

identifying a first key based on the first key tag.

11. The method of claim 10 , further comprising transferring the read command to the storage device controller.

12. The method of claim 10 , further comprising identifying an input/output (I/O) submission queue based on communications between the host device and the storage device controller.

13. The method of claim 12 , further comprising setting a filter to identify I/O commands originating from the submission queue.

14. The method of claim 9 , further comprising:

receiving a message from the host device, the message including the read tag and the third data;

identifying the second key tag based on the association between the second key tag and the read tag;

identifying a second key based on the second key tag; and

encrypting the third data based on the second key.

15. A non-transitory computer readable storage device storing instructions executable by one or more processors to:

receive, at a device in communication with a storage device controller and a host device, a first request from the storage device controller, the first request requesting first data be written to a first memory address of the host device;

identify a first key tag associated with the first request based on the first memory address;

generate second data based on the first key tag, the second data being the first data in a decrypted format;

initiate transfer of the second data to the host device;

receive a second request from the storage device controller, the second request requesting third data be read from a second memory address of the host device;

identify a second key tag associated with the second request based on the second memory address;

store an association between the second key tag and a read tag of the second request; and

initiate transmission of the second request to the host device.

16. The non-transitory computer readable storage device of claim 15 , wherein the instructions are further executable by the one or more processors to:

receive a read command from the host device, the read command identifying a memory range and the first key tag;

store an association between the memory range and the first key tag in a memory device;

identify the first key tag in response to the first memory address corresponding to the memory range; and

identify a first key based on the first key tag.

17. The non-transitory computer readable storage device of claim 16 , wherein the instructions are further executable by the one or more processors to initiate transfer of the read command to the storage device controller.

18. The non-transitory computer readable storage device of claim 16 , wherein the instructions are further executable by the one or more processors to identify an input/output (I/O) submission queue based on communications between the host device and the storage device controller.

19. The non-transitory computer readable storage device of claim 18 , wherein the instructions are further executable by the one or more processors to set a filter to identify I/O commands originating from the submission queue.

20. The non-transitory computer readable storage device of claim 15 , wherein the instructions are further executable by the one or more processors to:

receive a message from the host device, the message including the read tag and the third data;

identify the second key tag based on the association between the second key tag and the read tag;

identify a second key based on the second key tag; and

encrypt the third data based on the second key.