Modern computing architectures must address increasing concerns regarding off-chip data confidentiality. Key drivers for these concerns are data privacy for attacks with physical access to memory, confidential computing using zero trust computing architectures, regulatory frameworks, and secure encrypted resource virtualization e.g., multi-tenancy support among others. Inline memory encryption (IME) is a key enabler for protecting data that is stored in off-chip memory (typically, DDR memory). This is also referred to as protection of “data-in-use.” The low latency encryption and decryption is handled by an IME engine with the required cryptographic primitives in the datapath connected to off-chip memory via the on-chip memory controller. The IME-IP-339 IME engine can be seamlessly integrated into a customer’s SoC to address security and privacy concerns of data-in-use in DDR memory. The IME-IP-339 provides an AXI-4 compliant wrapper around the industry-proven Rambus ICE-IP-338 (inline cipher engine). This allows the IME-IP-339 to act as a transparent data processing pipeline on the Read and Write AXI data channels. At its heart, it is an encryption/decryption engine deploying AES/SM4-XTS cryptographic primitives. The IME-IP-339 supports compliance with the FIPS-197, IEEE-P1619/D16, and NIST SP800-38E standards, supporting AES-XTS (and optionally SM4-XTS) with 128 and 256-bit keys. The IME-IP-339 is delivered with fully verified parameterized RTL, directed test benches and UVM verification environment. How it Works At startup, the IME-IP-339 engine receives an ephemeral key from the SoC, which it autonomously converts into appropriate keys for encryption and decryption. It snoops information from the AXI4 address channels and transparently converts them into tweak computation inputs for the cryptography engine. When data is input, appropriate cryptographic operation is employed by arbitrating over the Read and Write 128-bit data channels. SoC Read-data from the DDR controller implies decryption, Write-data from the AXI-master implies encryption. The IME-IP-339 assumes XTS sector sizes of 64 Byte (= cache line width) and 16 Byte data access granularity. The IME-IP-339 engine acts as an AXI-to-AXI wedge in between the SoC AXI bus fabric, and the DDR memory controller operating as an AXI slave. It supports standard AMBA interfaces (AXI4 for datapath and AMBA (APB) interface for key management), thereby, enabling seamless integration with standard SoC components. The internals of the IP (such as command and data buffering) can be configured as required by the SoC.