A method of operating a host controller interface includes receiving a buffer descriptor including sector information from a main memory, fetching data by using a source address included in the buffer descriptor, selecting one of a plurality of entries included in a security policy table by using the sector information, and determining whether to encrypt the fetched data by using a security policy included in the selected entry.