Encrypting data and characterization data that describes valid contents of a column

A computer-readable storage medium encoded with instructions, wherein the instructions when executed comprise:

• in response to receiving a first command that specifies first data, a first cryptographic key, and a column identifier that identifies a column of rows in a database, encrypting the first data to encrypted data using the first cryptographic key and storing the encrypted data to a first row in the column in the database;
• in response to the receiving the first command, creating characterization data that specifies valid contents of the column of the rows, wherein the characterization data is encrypted;
• in response to receiving a query command that specifies a second cryptographic key and the column, decrypting the column using the second key to create decrypted data;
• if the decrypted data does not satisfy the valid contents specified by the characterization data, performing an invalid cryptographic key action;
• and
• if the decrypted data satisfies the valid contents specified by the characterization data, storing the decrypted data to a result set.

A computer system comprising:

• a processor;
• and
• memory communicatively coupled to the processor, wherein the memory is encoded with instructions, wherein the instructions when executed by the processor comprise
• in response to receiving a first command that specifies first data, a first cryptographic key, and a column identifier that identifies a column of rows in a database, encrypting the first data to encrypted data using the first cryptographic key and storing the encrypted data to a first row in the column in the database,
• in response to the receiving the first command, creating characterization data that specifies valid contents of the column of the rows, wherein the characterization data is encrypted,
• in response to receiving a query command that specifies a second cryptographic key and the column, decrypting the column using the second key to create decrypted data,
• if the decrypted data does not satisfy the valid contents specified by the characterization data, performing an invalid cryptographic key action,
• if the decrypted data satisfies the valid contents specified by the characterization data, storing the decrypted data to a result set, and
• if more than a threshold number of insert commands have been received within a threshold time period, disabling the creating the characterization data.