A method comprising: storing, at a register, a virtual machine, VM, tag value identifying a VM currently executing at a first processor core; generating, at the first processor core, a first memory access request comprising a virtual address identifying first requested information; in response to identifying that a translation lookaside buffer, TLB, includes an entry for the virtual address and the VM tag value, sending a system physical address corresponding to the virtual address, the VM tag value and an indication of whether the first requested information is designated for cryptographic protection to a cache controller for a cache; in response to identifying, at the cache controller, that the cache includes an entry that stores corresponding matching values for the VM tag value, the system physical address and the indication of whether the first requested information is designated for cryptographic protection, indicating a cache hit and satisfying the first memory access request at the cache; in response to identifying, at the cache controller, that the cache does not include an entry that stores the corresponding matching values, indicating a cache miss and providing the first memory access request to a memory controller; and in response to identifying, at the memory controller, that the first requested information is designated for cryptographic protection, identifying a first key based on the VM tag value; and encrypting or decrypting, at an encryption module of the memory controller, the first requested information based on the first key and satisfying the first memory access request using the encrypted or decrypted information. storing, at a register, a virtual machine, VM, tag value identifying a VM currently executing at a first processor core; generating, at the first processor core, a first memory access request comprising a virtual address identifying first requested information; in response to identifying that a translation lookaside buffer, TLB, includes an entry for the virtual address and the VM tag value, sending a system physical address corresponding to the virtual address, the VM tag value and an indication of whether the first requested information is designated for cryptographic protection to a cache controller for a cache; in response to identifying, at the cache controller, that the cache includes an entry that stores corresponding matching values for the VM tag value, the system physical address and the indication of whether the first requested information is designated for cryptographic protection, indicating a cache hit and satisfying the first memory access request at the cache; in response to identifying, at the cache controller, that the cache does not include an entry that stores the corresponding matching values, indicating a cache miss and providing the first memory access request to a memory controller; and in response to identifying, at the memory controller, that the first requested information is designated for cryptographic protection, identifying a first key based on the VM tag value; and encrypting or decrypting, at an encryption module of the memory controller, the first requested information based on the first key and satisfying the first memory access request using the encrypted or decrypted information. in response to identifying, at the cache controller, that the cache includes an entry that stores corresponding matching values for the VM tag value, the system physical address and the indication of whether the first requested information is designated for cryptographic protection, indicating a cache hit and satisfying the first memory access request at the cache; in response to identifying, at the cache controller, that the cache does not include an entry that stores the corresponding matching values, indicating a cache miss and providing the first memory access request to a memory controller; and in response to identifying, at the memory controller, that the first requested information is designated for cryptographic protection, identifying a first key based on the VM tag value; and encrypting or decrypting, at an encryption module of the memory controller, the first requested information based on the first key and satisfying the first memory access request using the encrypted or decrypted information.