Protecting sensitive data associations

1. A method for protecting sensitive data associations within a database, comprising:

(a) receiving a set of related data values, the set of related data values including at least a first unencrypted data value and a second unencrypted data value;

(b) associating:

(i) the first unencrypted data value to a first data field; and

(ii) the second unencrypted data value to a second data field;

(c) creating first encrypted data by encrypting the first unencrypted data value using a first encryption key;

(d) creating second encrypted data by encrypting the second unencrypted data value using a second encryption key; and

(e) a computer processor storing:

(i) the first unencrypted data value in a first data table;

(ii) the second unencrypted data value in a second data table;

(iii) the first encrypted data in the second data table; and

(iv) the second encrypted data in the first data table; and

wherein:

a rule indicates that the association of the first unencrypted data value and the second unencrypted data value is secret; and

said database includes said first data table and said second data table.

2. The method according to claim 1 , further including repeating steps (a)-(e) for additional sets of related data values.

3. The method according to claim 1 , further including obtaining the first unencrypted data value by:

(a) retrieving the first encrypted data from the second table; and

(b) decrypting the first encrypted data using a first decryption key.

4. The method according to claim 1 , further including obtaining the second data value by:

(a) retrieving the second encrypted data from the first table; and

(b) decrypting the second encrypted data using a second decryption key.

5. A method for protecting sensitive data associations within a database, comprising:

(a) receiving a set of related data values, the set of related data values including at least a first unencrypted data value and a second unencrypted data value;

(b) associating:

(i) the first unencrypted data value to a first data field;

(ii) the second unencrypted data value to a second data field;

(iii) a first salt value to a first salt field; and

(iv) a second salt value to a second salt field;

(c) creating a first encrypted data by:

(i) generating a first intermediate value by performing an exclusive-or between the first unencrypted data value and the first salt value; and

(ii) encrypting the first intermediate value using a first encryption key;

(d) creating second encrypted data by:

(i) generating a second intermediate value by performing an exclusive-or between the second unencrypted data value and the second salt value; and

(ii) encrypting the second intermediate value associated with the second field using a second encryption key; and

(e) a computer processor storing:

(i) the first unencrypted data value in a first data table;

(ii) the first salt value into the second data table;

(iii) the second unencrypted data value in a first data table;

(iv) the second salt value in a second data table;

(v) the first encrypted data in the second table; and

(vi) the second encrypted data in the first table and

wherein:

a rule indicates that the association of the first unencrypted data value and the second data value is secret; and

said database includes said first data table and said second data table.

6. The method according to claim 5 , wherein the first salt value and the second salt value are random values.

7. The method according to claim 5 , wherein the first salt value and the second salt value are pseudo-random values.

8. The method according to claim 5 , further including retrieving the first unencrypted data value by:

(a) retrieving the first encrypted data from the second table;

(b) generating a third intermediate value by decrypting the first encrypted data using a first decryption key; and

(c) performing an exclusive-or between the third intermediate value and the first salt value.

9. The method according to claim 5 , further including retrieving the second unencrypted data value by:

(a) retrieving the second encrypted data from the first table;

(b) generating a fourth intermediate value by decrypting the second encrypted data using a second decryption key; and

(c) performing an exclusive-or between the fourth intermediate value and the second salt value.

10. The method according to claim 5 , wherein the first salt value and the second salt value are the same.

11. A system for protecting sensitive data associations within a database, comprising:

(a) a data receiving module configured to receive a set of related data values, the set of related data values including at least a first data unencrypted value and a second unencrypted data value;

(b) a rule indicating that the association of the first unencrypted data value and the second unencrypted data value is secret;

(c) a data association module configured to associate:

(i) the first unencrypted data value to a first data field; and

(ii) the second unencrypted data value to a second data field;

(d) an encryption module configured to:

(i) create first encrypted data by encrypting the first unencrypted data value using a first encryption key; and

(ii) create second encrypted data by encrypting the second unencrypted data value using a second encryption key; and

(e) a data storage module configured to employ a computer processor to store:

(i) the first unencrypted data value in a first data table;

(ii) the second unencrypted data value in a second data table;

(iii) the first encrypted data in the second table; and

(iv) the second encrypted data in the first table; and

wherein

said database includes said first data table and said second data table.

12. The system according to claim 11 , further including a first data retrieving module configured to retrieve the first unencrypted data value by decrypting the first encrypted data using a first decryption key.

13. The system according to claim 11 , further including a second data retrieving module configured to retrieve the second first unencrypted data value by decrypting the second encrypted data using a second decryption key.

14. The system according to claim 11 , wherein the rule is received from an external source.

15. A system for protecting sensitive data associations within a database, comprising:

(a) a data receiving module configured to receive a set of related data values, the set of related data values including at least a first unencrypted data value and a second unencrypted data value;

(b) a rule indicates that the association of the first unencrypted data value and the second unencrypted data value is secret;

(c) a data association module configured to associate:

(i) the first unencrypted data value to a first data field;

(ii) the second unencrypted data value to a second data field;

(iii) a first salt value to a first salt field; and

(iv) a second salt value to a second salt field;

(d) an encryption module configured to:

(i) to create a first encrypted data by:

(1) generating a first intermediate value by performing an exclusive-or between the first unencrypted data value and the first salt value; and

(2) encrypting the first intermediate value using a first encryption key; and

(ii) create a second encrypted data by:

(1) generating a second intermediate value by performing an exclusive-or between the second unencrypted data value and the second salt value; and

(2) encrypting the second intermediate value associated with the second field using a second encryption key; and

(e) a storage module configured to employ a computer processor to store:

(i) the first unencrypted data value in a first data table;

(ii) the first salt value into the second data table;

(iii) the second unencrypted data value in a second data table;

(iv) the second salt value in a first data table;

(v) the first encrypted data in the second table; and

(vi) the second encrypted data in the first table; and

wherein

said database includes said first data table and said second data table.

16. The system according to claim 15 , wherein the first salt value and the second salt value are random values.

17. The system according to claim 15 , wherein the first salt value and the second salt value are pseudo-random values.

18. The system according to claim 15 , further including a first data retrieving module configured to retrieve the first unencrypted data value by:

(a) retrieving the first encrypted data from the second table;

(b) generating a third intermediate value by decrypting the first encrypted data using a first decryption key; and

(c) performing an exclusive-or between the third intermediate value and the first salt value.

19. A system according to claim 15 , further including a second data retrieving module configured to retrieve the second unencrypted data value by:

(a) retrieving the second encrypted data from the first table;

(b) generating a fourth intermediate value by decrypting the second encrypted data using a second decryption key; and

(c) performing an exclusive-or between the fourth intermediate value and the second salt value.

20. The system according to claim 15 , wherein the first salt value and the second salt value are the same.

21. The system according to claim 15 , wherein the rule is received from an external source.