Secure execution of encrypted software in an integrated circuit

A method for processing, in an integrated circuit, addressable encrypted data representing addressable cleartext data, the integrated circuit including a processor circuit and a first storage circuit in a first circuit region of the integrated circuit having a first level of security, the processor circuit having a first memory interface for providing an address from the processor circuit and communicating corresponding addressable data to or from the processor circuit, the method comprising processing the addressable cleartext data in the processor circuitry without storing said cleartext data outside the processor circuit, the processing comprising:

• maintaining addressable mask data in the first storage circuitry, the mask data having a plurality of segments, each segment being associated with a corresponding address, wherein the mask data for a segment depends at least in part on the corresponding address of said segment;
• providing an address via the first memory interface from the processor circuit in the first circuit region to the first storage circuitry and to a second memory interface associated with a second storage circuitry in a second circuit region of the integrated circuit having a second level of security less than the first level of security;
• accessing a mask segment corresponding to said provided address from the first storage circuitry;
• accessing encrypted data associated with the provided address from the second storage circuitry according to the provided address, the accessing including one of a) reading the encrypted data from the provided address and b) storing the encrypted data at the provided address;
• and
• combining the accessed mask segment with data passing between the first memory interface of the processor circuit and the second storage circuitry without storing corresponding cleartext data outside the processor circuitry, wherein combining the accessed mask segment with the data includes one of a) combining the mask segment with the accessed encrypted data read from the second storage circuitry and b) combining the mask segment with the cleartext data provided by the processor circuitry for storing the encrypted data to the second storage circuitry.