Computer system for storing and retrieval of encrypted data items, client computer, computer program product and computer-implemented method

A client computer for storing a data item in and reading the data item from a database system via a network, the client computer comprising:

• an application program, the application program comprising client computer specific log-in information,
• a communication interface for receiving a user or user-group specific key and a key identifier of that cryptographic key, the communication interface being operational for manual entry of user information specifying the user or user-group specific key and a key identifier and/or for communication with one security token of a set of security tokens, the security token being assigned to one authorized user, a user or user-group specific key and a key identifier of that cryptographic key being stored on the security token,
• a network communication interface for communication with a database system, the application program being operational to perform the following steps for writing the data item to the database system:
• entry of the data item into the client computer,
• encrypting the data item with the key that has been received by the client computer,
• generating a database insert command, the insert command comprising the encrypted data item and the key identifier of the key with which the data item has been encrypted as an attribute of the encrypted data item for storing the encrypted data item in the database system with the key identifier as an attribute,
• establishing a session with the database system over the network by the network communication interface,
• transmitting the insert command via the session to the database system for processing by the one of the databases that has been determined to be assigned to the client computer by the log-in component such that the encrypted data item with the key identifier is stored in that database,
• the application program being operational to perform the following steps for reading the data item:
• establishing a session with the database system over the network,
• transmitting the client computer specific log-in information to the database system via the session,
• entry of the key and the key identifier from one of the security tokens into the client computer for use of the key by the client computer and without transmitting the key to the database system;
• entry of a search criterion into the client computer,
• generating a database query using the search criterion and the key identifier, the key identifier limiting the query to encrypted data items that have an attribute matching the key identifier,
• in response to the query, receiving an encrypted data item matching the search criterion from the database system,
• decrypting the encrypted data item using the cryptographic key.

A computer program product, in particular the digital storage medium, comprising instructions that are executable by a client computer, the computer program product being an application program, the application program being operational to perform the following steps for writing the data item to the database system:

• entry of the data item into the client computer,
• encrypting the data item with the key that has been entered into the client computer,
• generating a database insert command, the insert command comprising the encrypted data item and the key identifier of the key with which the data item has been encrypted as an attribute of the encrypted data item for storing the encrypted data item in the database system with the key identifier as an attribute and an electronic signature,
• establishing a session with the database system over the network by the network communication interface,
• transmitting the insert command via the session to the database system for processing by the one of the databases that has been determined to be assigned to the client computer by the log-in component such that the encrypted data item with the key identifier is stored in that database,
• the application program being operational to perform the following steps for reading the data item:
• establishing a network session with the database system over the network,
• transmitting the client computer specific log-in information to the database system via the session,
• entry of the key and the key identifier from one of the security tokens into the client computer for use of the key by the client computer and without transmitting the key to the database system;
• entry of a search criterion into the client computer,
• generating a database query using the search criterion and the key identifier, the key identifier limiting the query to encrypted data items that have an attribute matching the key identifier,
• in response to the query, receiving an encrypted data item matching the search criterion from the database system,
• decrypting the encrypted data item using the cryptographic key.