A method, comprising: - providing memory locations for storing encrypted data (RDATA_extmem), said memory locations having respective addresses and being accessible via a communication bus (10, 20) for reading data stored therein, - receiving over said communication bus, from a processing unit coupled to said communication bus (10, 20), access requests to said memory locations, wherein said access requests comprise burst requests for access to respective sets of said memory locations starting from respective start addresses (ADDR), the burst requests conveying said respective start addresses (ADDR), - calculating, as a function of said start addresses (ADDR), encryption/decryption cryptographic masks based on cryptographic keys, - receiving plain text data (plain_text) for encryption and applying said cryptographic masks to said plain text data (plain_text) to obtain therefrom encrypted data, - including said encrypted data into output data (RDATA_otfdec) and transmitting said output data (RDATA_otfdec) to said processing unit via said communication bus, - applying said cryptographic masks to said stored encrypted data (RDATA_ extmem) retrieved via said communication bus from said memory locations starting from said respective start addresses (ADDR) to obtain therefrom decrypted data, and - including said decrypted data into output data (RDATA_otfdec) for transmission over said communication bus, the method being characterized in that it includes: - sensing a secure mode signal (sec_mode) indicative of said processing unit operating in a secure mode wherein security resources of said processing unit are available, - applying said cryptographic masks to encrypt said plain text data (plain_text) or to decrypt said stored encrypted data (RDATA_extmem) as a function of a control signal, said control signal depending on the value of said secure mode signal (sec_mode). - providing memory locations for storing encrypted data (RDATA_extmem), said memory locations having respective addresses and being accessible via a communication bus (10, 20) for reading data stored therein, - receiving over said communication bus, from a processing unit coupled to said communication bus (10, 20), access requests to said memory locations, wherein said access requests comprise burst requests for access to respective sets of said memory locations starting from respective start addresses (ADDR), the burst requests conveying said respective start addresses (ADDR), - calculating, as a function of said start addresses (ADDR), encryption/decryption cryptographic masks based on cryptographic keys, - receiving plain text data (plain_text) for encryption and applying said cryptographic masks to said plain text data (plain_text) to obtain therefrom encrypted data, - including said encrypted data into output data (RDATA_otfdec) and transmitting said output data (RDATA_otfdec) to said processing unit via said communication bus, - applying said cryptographic masks to said stored encrypted data (RDATA_ extmem) retrieved via said communication bus from said memory locations starting from said respective start addresses (ADDR) to obtain therefrom decrypted data, and - including said decrypted data into output data (RDATA_otfdec) for transmission over said communication bus, - sensing a secure mode signal (sec_mode) indicative of said processing unit operating in a secure mode wherein security resources of said processing unit are available, - applying said cryptographic masks to encrypt said plain text data (plain_text) or to decrypt said stored encrypted data (RDATA_extmem) as a function of a control signal, said control signal depending on the value of said secure mode signal (sec_mode).