Column wise encryption for lightweight DB engine

1. A method of securely storing and retrieving sensitive and non-sensitive data in a same relational database (DB), the method comprising:

determining a sensitivity classification for each column of a table in the DB;

determining a different data encryption key (DEK) corresponding to each cell of a column in the DB, wherein the sensitivity classification of the column is determined to be sensitive;

encrypting sensitive data using the DEK of a corresponding cell in the column and writing the encrypted sensitive data to the corresponding cell;

decrypting, using the DEK, the encrypted sensitive data when reading the sensitive data from the corresponding cell in the column; and

performing writing to and reading from another column of unencrypted non-sensitive data in the DB, wherein the sensitivity classification of the other column is determined to be non-sensitive;

prefixing an encoder type and related headers to the sensitive data; and

wherein performing intercepting, parsing, the encrypting, and the decrypting of the data is configured to occur at a record processing layer,

wherein the encoder type indicates an encryption used to encrypt the sensitive data.

2. The method of claim 1 , further comprising using a master key to encrypt and decrypt all DEKs in a device.

3. The method of claim 2 , wherein, in the absence of the master key, a read operation returns raw encrypted data of the column.

4. The method of claim 2 , wherein, in the absence of the master key, a write to the column is disallowed.

5. The method of claim 1 , wherein, if a write operation of the sensitive data to a cell in the column is requested, the sensitive data is encrypted using the DEK corresponding to the cell in the column.

6. The method of claim 1 , wherein the table comprises the column and the other column.

7. The method of claim 1 , further comprising enhancing records mediated through the record processing layer to interpret and identify sensitive columns in the DB.

8. The method of claim 1 , wherein the DB is accessed by an SQLite database engine.

9. The method of claim 1 , further comprising caching decrypted sensitive columns in the DB until a transaction reaches a commit state.

10. The method of claim 1 , wherein a plurality of sensitive columns in the DB are encrypted using a plurality of different encoding types.

11. An apparatus configured to securely store and retrieve sensitive and non-sensitive data in a same relational database (DB), the apparatus comprising:

a storage configured to store the DB;

a cache; and

at least one processor comprising an engine configured to read from and write to the DB,

wherein the engine comprises:

a structured query language (SQL) statement processing layer;

a byte code processing layer;

a record processing layer; and

a page processing layer,

wherein the controller is configured to:

determine a sensitivity classification for each column of a table in the DB,

determine a different data encryption key (DEK) corresponding to each cell of a column in the DB, wherein the sensitivity classification of the column is determined to be sensitive,

encrypt sensitive data using the DEK of a corresponding cell in the column and write the encrypted sensitive data to the corresponding cell,

decrypt, using the DEK, the encrypted sensitive data when reading the sensitive data from the corresponding cell in the column, and

perform writing to and reading from another column of unencrypted non-sensitive data in the DB,

wherein the sensitivity classification of the other column is determined to be non-sensitive,

wherein an encoder type and related headers are prefixed to the sensitive data,

wherein the encoder type indicates an encryption used to encrypt the sensitive data, and

wherein the record processing layer is configured to perform intercepting, parsing, the encrypting, and the decrypting of data.

12. The apparatus of claim 11 , wherein a master key is used to encrypt and decrypt all DEKs in the apparatus.

13. The apparatus of claim 12 , wherein, in the absence of the master key, a read operation returns raw encrypted data of the column.

14. The apparatus of claim 12 , wherein, in the absence of the master key, a write operation to the column is disallowed.

15. The apparatus of claim 11 , wherein, if a write operation of the sensitive data to a cell in the column is requested, the sensitive data is encrypted using the DEK corresponding to the cell in the column.

16. The apparatus of claim 11 , wherein the table comprises the column and the other column.

17. The apparatus of claim 11 , wherein records mediated through the record processing layer are enhanced to interpret and identify sensitive columns in the DB.

18. The apparatus of claim 11 , wherein the engine comprises an SQLite database engine.

19. The apparatus of claim 11 , wherein decrypted sensitive columns in the DB are cached in the cache until a transaction reaches a commit state.

20. The apparatus of claim 11 , wherein a plurality of sensitive columns in the DB are encrypted using a plurality of different encoding types.

21. The apparatus of claim 11 , wherein the apparatus is a mobile terminal.

22. A non-transitory computer readable storage medium encoded with instructions, executable by a processor, to perform a method comprising:

determining a sensitivity classification for a column of a table in a relational database (DB), wherein the table includes both a column of sensitive data and another column of non-sensitive data;

determining a different data encryption key (DEK) corresponding to each cell of the column in the DB, wherein the sensitivity classification of the column is determined to be sensitive;

encrypting sensitive data using the DEK of a corresponding cell in the column and writing the encrypted sensitive data to the corresponding cell;

decrypting, using the DEK, the encrypted sensitive data when reading the sensitive data from the corresponding cell in the column;

performing writing to and reading from the other column of unencrypted non-sensitive data in the DB, wherein the sensitivity classification of the other column is determined to be non-sensitive;

prefixing an encoder type and related headers to the sensitive data, and

wherein performing intercepting, parsing, the encrypting, and the decrypting of data is configured to occur at a record processing layer,

wherein the encoder type indicates an encryption used to encrypt the sensitive data.