Data storage server and client devices for securely storing data

1 . A method performed by a client device, the method comprising:

receiving, from a data storage server, database configuration information identifying one or more encrypted data structures of a database of the data storage server, the one or more encrypted data structures being encrypted with one or more encryption keys;

storing the received database configuration information;

determining whether data to be stored in the database comprises security sensitive data to be stored in a respective encrypted data structure of the one or more encrypted data structures based on the received database configuration information;

in response to determining that the data to be stored in the database comprises the security sensitive data, encrypting the security sensitive data with a respective encryption key of the one or more encryption keys; and

providing the data to be stored in the database, including the encrypted security sensitive data, and an identifier of the respective encryption key to the data storage server for storing, based on the identifier of the respective encryption key, the security sensitive data to be stored in the respective encrypted data structure,

wherein the database is a relational database, and the respective encrypted data structure is an encrypted column of a table of the relational database.

2 . The method of claim 1 , further comprising encrypting the security sensitive data with the respective encryption key using a random encryption scheme or a deterministic encryption scheme.

3 . The method of claim 1 , further comprising:

executing an application, wherein the application is configured to generate the data to be stored in the database and to request, using a first type of data query comprising the data to be stored, storage of the data to be stored in the database in the data storage server, and

replacing the security sensitive data in the first type of data query with the encrypted security sensitive data.

4 . The method of claim 3 , further comprising:

retrieving further data from the database in response to a second type of data query from the application, wherein the further data comprises further encrypted security sensitive data stored in a further encrypted data structure of the one or more encrypted data structures; and

decrypting the further encrypted security sensitive data with the respective encryption key.

5 . The method of claim 4 , wherein the second type of data query comprises a query command for retrieving the further data from the database, wherein the further data to be retrieved from the database is identified by an argument of the query command, the method further comprising encrypting the argument of the query command with the respective encryption key.

6 . The method of claim 5 , the method further comprising identifying the security sensitive data of the further data retrieved from the database of the data storage server based on at least one of a data type of the further data and the identifier of the respective encryption key.

7 . The method of claim 1 , further comprising storing the respective encryption key for encrypting the security sensitive data.

8 . The method of claim 1 , the method further comprising obtaining the respective encryption key for encrypting the security sensitive data from the data storage server based on the database configuration information.

9 . The method of claim 8 , further comprising:

obtaining the respective encryption key in encrypted form from the data storage server;

decrypting the respective encrypted encryption key with a client device master key; and

obtaining the client device master key from a remote key management server.

10 . The method of claim 1 , further comprising extracting the security sensitive data from the data to be stored in the database of the data storage server using a syntax tree.

11 . The method of claim 1 , further comprising converting the security sensitive data from a human-readable format into a binary format; and

encrypting the security sensitive data in the binary format with the respective encryption key.

12 . The method of claim 1 , further comprising converting the security sensitive data from a binary data type to a data type defined by a query.

13 . The method of claim 1 , wherein the database configuration information comprises a table comprising, for each encrypted column of the relational database, an identifier of an encryption key of the one or more encryption keys.

14 . A computer program product comprising a non-transitory computer-readable storage medium having stored thereon processor executable instructions which, when executed by a processor, cause the processor to perform the method of claim 1 .

15 . A client device comprising processing circuitry configured to perform the method of claim 1 .

16 . A method for operating a data storage server comprising a database, the method comprising:

sending database configuration information to a client device, wherein the database configuration information allows the client device to identify one or more encrypted data structures of the database encrypted with one or more encryption keys;

receiving data, including encrypted security sensitive data encrypted with a respective encryption key, and an identifier of the respective encryption key from a client device, wherein the respective encryption key is one of the one or more encryption keys; and

storing, based on the identifier of the respective encryption key, the security sensitive data in a respective encrypted data structure of the one or more encrypted data structures of the database,

wherein the database is a relational database and the respective encrypted data structure of the one or more encrypted data structures is an encrypted column of a table of the relational database.

17 . The method of claim 16 , wherein the database configuration information comprises a table comprising, for each encrypted column of the relational database, an identifier of an encryption key of the one or more encryption keys.

18 . The method of claim 16 , further comprising providing, in response to a data request query from the client device, data from the database to the client device, wherein the data provided to the client device comprises encrypted security sensitive data stored in an encrypted data structure of the one or more encrypted data structures of the database.

19 . The method of claim 18 , further comprising storing the security sensitive data in the one or more encrypted data structures of the database,

wherein the security sensitive data is encrypted with the respective encryption key using a binary data type.

20 . The method of claim 16 , wherein storing, based on the identifier of the respective encryption key, the security sensitive data in the respective encrypted data structure of the one or more encrypted data structures of the database comprises:

identifying, based on the identifier of the respective encryption key, the encrypted column of the table of the relational database, and

storing, in the identified encrypted column of the table of the relational database, the security sensitive data.

21 . A computer program product comprising a non-transitory computer-readable storage medium having stored thereon processor executable instructions which, when executed by a processor, cause the processor to perform the method of claim 16 .

22 . A data storage server comprising:

processing circuitry configured to perform the method of claim 16 ; and

the database.