Self-referencing data encryption

1. A method for protecting data, the method comprising operations performed using an electronic processor, the operations comprising:

receiving a request for a first data value;

querying a data store, based on the request for the first data value, for a first stored data value associated with the first data value, wherein the first stored data value is stored in a single field in the data store;

receiving, based on the query, the first stored data value;

determining the first stored data value comprises a first security prefix and a first encrypted data value;

determining, from the first security prefix, a first cryptography algorithm;

determining, from the first security prefix, a first key;

decrypting, as the first data value, the first encrypted data value using the first key and the first cryptography algorithm; and

returning the first data value.

2. The method of claim 1 , further comprising:

determining a type of the first data value is not a character type, wherein the first stored data value is a character type; and

converting the first data value into the type of the first data value before the returning the first data value.

3. The method of claim 1 , further comprising:

receiving the first data value to store in the data store;

determining the first cryptography algorithm to encrypt the first data value;

encrypting the first data value with the first cryptography algorithm;

creating the first security prefix based on the first cryptography algorithm; and

storing the first security prefix and the encrypted data value in the single field.

4. The method of claim 3 , further comprising:

determining a second cryptography algorithm to encrypt the first data value;

encrypting the first data value with the second cryptography algorithm as a second encrypted data value;

creating a second security prefix based on the second cryptography algorithm; and

storing the second security prefix and the second encrypted data value in a single field in a second, different data store.

5. The method of claim 4 , wherein the second cryptography algorithm is different than the first cryptograph algorithm.

6. The method of claim 3 , further comprising determining the first key to encrypt the first data value, wherein the encrypting the first data value uses the first key, and wherein the first security prefix comprises an indication of the first key.

7. The method of claim 6 , further comprising determining a first key version, wherein the determining the first key is based on the first key version, and wherein the first security prefix comprises an indication of the first key version.

8. The method of claim 1 , wherein the receiving a request for the first data value comprises a request for two or more data fields, wherein the receiving the first stored data value comprises receiving a second stored data value, and wherein the method further comprises:

determining the second stored data value comprises a second security prefix and a second encrypted data value;

determining, from the second security prefix, a second cryptography algorithm;

determining, from the second security prefix, a second key, wherein the second key is different from the first key;

decrypting the second encrypted data value using the second key and the second cryptography algorithm as the second data value; and

returning the second data value.

9. The method of claim 8 , wherein the second cryptography algorithm is different from the first cryptography algorithm.

10. The method of claim 8 , further comprising:

receiving a third stored data value;

determining the third stored value comprises an unencrypted third data value; and

returning the third data value.

11. The method of claim 1 , further comprising:

encrypting the first data value using a third key, different than the first key, as updated first encrypted data;

creating a third security prefix for the first value data based on the third key; and

storing the third security prefix and the updated first encrypted data value in the single field in the data store.

12. The method of claim 11 , wherein encrypting the first data using the third key comprises using a third cryptography algorithm different from the second cryptography algorithm, wherein the third security prefix comprises an indication of the third cryptography algorithm.

13. A system to protect data, the system comprising:

a memory; and

a hardware processor coupled to the memory, wherein the hardware processor is configured to:

receive a request for a first data value;

query a data store, based on the request for the first data value, for a first stored data value associated with the first data value, wherein the first stored data value is stored in a single field in the data store;

receive, based on the query, the first stored data value;

determine the first stored data value comprises a first security prefix and a first encrypted data value;

determine, from the first security prefix, a first cryptography algorithm;

determine, from the first security prefix, a first key;

decrypt, as the first data value, the first encrypted data value using the first key and the first cryptography algorithm; and

return the first data value.

14. The system of claim 13 , wherein the hardware processor is further configured to:

determine a type of the first data value is not a character type, wherein the first stored data value is a character type; and

convert the first data value into the type of the first data value before the returning the first data value.

15. The system of claim 13 , wherein the hardware processor is further configured to:

receive the first data value to store in the data store;

determine the first cryptography algorithm to encrypt the first data value;

encrypt the first data value with the first cryptography algorithm;

create the first security prefix based on the first cryptography algorithm; and

store the first security prefix and the encrypted data value in the single field.

16. The system of claim 15 , wherein the hardware processor is further configured to:

determine a second cryptography algorithm to encrypt the first data value;

encrypt the first data value with the second cryptography algorithm as a second encrypted data value;

create a second security prefix based on the second cryptography algorithm; and

store the second security prefix and the second encrypted data value in a single field in a second, different data store.

17. A non-transitory computer-readable storage medium storing computer-executable instructions that when executed by a processor cause the processor to perform operations comprising:

receiving a request for a first data value;

querying a data store, based on the request for the first data value, for a first stored data value associated with the first data value, wherein the first stored data value is stored in a single field in the data store;

receiving, based on the query, the first stored data value;

determining the first stored data value comprises a first security prefix and a first encrypted data value;

determining, from the first security prefix, a first cryptography algorithm;

determining, from the first security prefix, a first key;

decrypting, as the first data value, the first encrypted data value using the first key and the first cryptography algorithm; and

returning the first data value.

18. The non-transitory computer-readable storage medium of claim 17 , wherein the operations further comprise:

determining a type of the first data value is not a character type, wherein the first stored data value is a character type; and

converting the first data value into the type of the first data value before the returning the first data value.

19. The non-transitory computer-readable storage medium of claim 17 , wherein the operations further comprise:

receiving the first data value to store in the data store;

determining the first cryptography algorithm to encrypt the first data value;

encrypting the first data value with the first cryptography algorithm;

creating the first security prefix based on the first cryptography algorithm; and

storing the first security prefix and the encrypted data value in the single field.

20. The non-transitory computer-readable storage medium of claim 19 , wherein the operations further comprise:

determining a second cryptography algorithm to encrypt the first data value;

encrypting the first data value with the second cryptography algorithm as a second encrypted data value;

creating a second security prefix based on the second cryptography algorithm; and

storing the second security prefix and the second encrypted data value in a single field in a second, different data store.