A secure data transfer apparatus, where a processor in the apparatus is configured to execute a driver software to generate cryptography information, a cryptography device in the apparatus is configured to obtain a current cryptography parameter based on the cryptography information, and perform a cryptography operation using the current cryptography parameter, a Peripheral Component Interconnect Express (PCIe) interface in the apparatus configured to perform a ciphertext data exchange with a memory controller in a memory located external to the apparatus, where the ciphertext data exchange includes sending the ciphertext data from the cryptography device to the memory controller when the memory is to be written, and sending the ciphertext data from the memory controller to the cryptography device when the memory is to be read.