A method for protecting software in an arrangement having a core device, a RAM associated with the core device, and a software protection device including a memory device, the method operable on the software protection device comprising: obtaining, by the software protection device, a payload including at least one of instructions or data of the software to be protected and to be processed by the core device; establishing, by the software protection device, a realm in the RAM to serve as a main memory for the core device and to protect the software, the realm including one or more selected pages in the RAM associated with the core device; generating, by the software protection device, a realm identifier and an ephemeral encryption key for the realm, wherein the realm identifier is associated with the ephemeral encryption key; storing the realm identifier and the ephemeral encryption key in the memory device of the software protection device, wherein the ephemeral encryption key is not accessible outside the software protection device, and wherein the ephemeral encryption key is stored in the memory device of the software protection device while the realm is maintained in the RAM associated with the core device; encrypting, by the software protection device, the payload based on the ephemeral encryption key associated with the realm; and storing, by the software protection device, the encrypted payload in the realm of the RAM associated with the core device; and characterized in that: the ephemeral encryption key is a temporary encryption key that exists while the realm is maintained in the RAM during a period when instructions or data in the one or more memory pages of the realm protected with the ephemeral encryption key are being executed by the core device; and in that the method further comprises deleting the ephemeral encryption key after the instructions or data in the one or more memory pages of the realm have been executed by the core device; and each of the realms in the memory device contains different target software that has been encrypted with a unique ephemeral encryption key. obtaining, by the software protection device, a payload including at least one of instructions or data of the software to be protected and to be processed by the core device; establishing, by the software protection device, a realm in the RAM to serve as a main memory for the core device and to protect the software, the realm including one or more selected pages in the RAM associated with the core device; generating, by the software protection device, a realm identifier and an ephemeral encryption key for the realm, wherein the realm identifier is associated with the ephemeral encryption key; storing the realm identifier and the ephemeral encryption key in the memory device of the software protection device, wherein the ephemeral encryption key is not accessible outside the software protection device, and wherein the ephemeral encryption key is stored in the memory device of the software protection device while the realm is maintained in the RAM associated with the core device; encrypting, by the software protection device, the payload based on the ephemeral encryption key associated with the realm; and storing, by the software protection device, the encrypted payload in the realm of the RAM associated with the core device; and the ephemeral encryption key is a temporary encryption key that exists while the realm is maintained in the RAM during a period when instructions or data in the one or more memory pages of the realm protected with the ephemeral encryption key are being executed by the core device; and in that the method further comprises deleting the ephemeral encryption key after the instructions or data in the one or more memory pages of the realm have been executed by the core device; and each of the realms in the memory device contains different target software that has been encrypted with a unique ephemeral encryption key.