System architecture for encrypting external memory

1. A method comprising:

receiving at a memory controller a write request, the write request comprising first data and a first address, the memory controller being embedded in a CPU and operatively coupled to memory external to the CPU, said memory controller contained within a case;

encrypting, at the memory controller, the first data to generate encrypted first data, wherein encrypting the first data comprises:

reading at the memory controller a first cryptographic key from a volatile memory within the memory controller, and

applying the first cryptographic key to the first data;

writing the encrypted first data to the memory;

detecting a physical intrusion of the case; and

deleting the first cryptographic key and one or more encryption parameters upon detection of the physical intrusion.

2. The method of claim 1 , further comprising:

receiving at the memory controller a read request, the read request comprising a second address;

reading encrypted second data from the memory;

decrypting, at the memory controller, the encrypted second data to generate second data.

3. The method of claim 1 , further comprising:

determining a first translated address from the first address, and wherein the encrypted first data are written to the memory at the first translated address.

4. The method of claim 2 , further comprising:

determining a second translated address from the second address, and wherein the encrypted second data are read from the memory at the second translated address.

5. The method of claim 1 , further comprising:

generating the first cryptographic key upon powering of the memory controller.

6. The method of claim 3 , wherein determining the first translated address comprises:

applying a cryptographic function.

7. The method of claim 4 , wherein determining the second translated address comprises:

applying a cryptographic function.

8. The method of claim 1 , wherein encrypting the first data comprises:

reading at the memory controller a first cryptographic key of a plurality of cryptographic keys, the first cryptographic key being selected on the basis of the first address; and

applying the first cryptographic key to the first data.

9. A system comprising:

a case;

a memory controller contained within the case, the memory controller being embedded in a CPU and being operatively coupled to a memory external to the CPU, the memory controller adapted to:

receive a write request, the write request comprising first data and a first address;

encrypt the first data to generate encrypted first data, wherein encrypting the first data comprises:

reading at the memory controller a first cryptographic key from a volatile memory within the memory controller, and

applying the first cryptographic key to the first data;

write the encrypted first data to the memory;

detect a physical intrusion of the case; and

delete the first cryptographic key and one or more encryption parameters upon detection of the physical intrusion.

10. The system of claim 9 , wherein the memory controller is further adapted to:

receive a read request, the read request comprising a second address;

read encrypted second data from the memory;

decrypt at the memory controller the encrypted second data to generate second data.

11. The system of claim 9 , wherein the memory controller is further adapted to:

determine a first translated address from the first address, and wherein the encrypted first data are written to the memory at the first translated address.

12. The system of claim 10 , wherein the memory controller is further adapted to:

determine a second translated address from the second address, and wherein the encrypted second data are read from the memory at the second translated address.

13. The system of claim 9 , wherein the memory controller is further adapted to:

generate the first cryptographic key upon powering of the memory controller.

14. The system of claim 9 , wherein encrypting the first data comprises:

reading a first cryptographic key of a plurality of cryptographic keys, the first cryptographic key being selected on the basis of the first address; and

applying the first cryptographic key to the first data.