A memory controller, comprising: a memory interface connected to a memory; an address and control logic connected to the memory interface and a command interface, wherein the address and control logic is configured to receive a memory read request; a read inline encryption engine, IEE, connected to the memory interface, wherein the read IEE is configured to decrypt encrypted data read from the memory; a key selector configured to determine a read memory region (310, 320, 330) associated with the memory read request based upon a read address where the data to be read is stored, wherein the read address is received from the address and control logic; a key logic configured to select a first key associated with the determined read memory region (310, 320, 330) and provide the selected key to the read IEE; a write IEE connected to the memory interface, wherein the write IEE is configured to encrypt data to be stored in the memory; and a memory scrubber configured to cycle through memory locations of the memory at a first rate and at each memory location utilizing the read IEE and write IEE to: decrypt the stored data using the first key (312, 322, 332); encrypt the decrypted stored data using a new first key (314, 324, 334); store the data encrypted with the new first key (314, 324, 334); update a key update location, wherein the key update location indicates a boundary between data stored in the memory encrypted using the first key (312, 322, 332) and the new first key (314, 324, 334); and characterized by the memory scrubber being configured to: scan through the memory at a second rate to correct data errors using an error correction code, wherein the first and second rates are different. a memory interface connected to a memory; an address and control logic connected to the memory interface and a command interface, wherein the address and control logic is configured to receive a memory read request; a read inline encryption engine, IEE, connected to the memory interface, wherein the read IEE is configured to decrypt encrypted data read from the memory; a key selector configured to determine a read memory region (310, 320, 330) associated with the memory read request based upon a read address where the data to be read is stored, wherein the read address is received from the address and control logic; a key logic configured to select a first key associated with the determined read memory region (310, 320, 330) and provide the selected key to the read IEE; a write IEE connected to the memory interface, wherein the write IEE is configured to encrypt data to be stored in the memory; and a memory scrubber configured to cycle through memory locations of the memory at a first rate and at each memory location utilizing the read IEE and write IEE to: decrypt the stored data using the first key (312, 322, 332); encrypt the decrypted stored data using a new first key (314, 324, 334); store the data encrypted with the new first key (314, 324, 334); update a key update location, wherein the key update location indicates a boundary between data stored in the memory encrypted using the first key (312, 322, 332) and the new first key (314, 324, 334); and characterized by the memory scrubber being configured to: scan through the memory at a second rate to correct data errors using an error correction code, wherein the first and second rates are different. decrypt the stored data using the first key (312, 322, 332); encrypt the decrypted stored data using a new first key (314, 324, 334); store the data encrypted with the new first key (314, 324, 334); update a key update location, wherein the key update location indicates a boundary between data stored in the memory encrypted using the first key (312, 322, 332) and the new first key (314, 324, 334); and characterized by the memory scrubber being configured to: scan through the memory at a second rate to correct data errors using an error correction code, wherein the first and second rates are different.