Computer system for storing and retrieval of encrypted data items, client computer, computer program product and computer-implemented method

A client computer for storing a data item in and reading the data item from a database system via a network, the client computer comprising:

• an application program, the application program comprising client computer specific log-in information,
• a communication interface for receiving a user credential, the communication interface being operational for manual entry of user credential and/or for communication with one security token of a set of security tokens, the security token being assigned to one authorized user, a user credential being stored on the security token,
• a network communication interface for communication with a database system,
• the application program being operational for processing the user credential by a predefined deterministic algorithm, wherein the processing of the user credential by the predefined algorithm provides the key and the key identifier,
• the application program being operational to perform the following steps for writing the data item to the database system:
• entry of the data item into the client computer,
• encrypting the data item with the key that has been received by the client computer,
• generating a database insert command, the insert command comprising the encrypted data item and the key identifier of the key with which the data item has been encrypted as an attribute of the encrypted data item for storing the encrypted data item in the database system with the key identifier as an attribute,
• establishing a session with the database system over the network by the network communication interface,
• transmitting the insert command via the session to the database system for processing by the one of the databases that has been determined to be assigned to the client computer by the log-in component such that the encrypted data item with the key identifier is stored in that database,
• the application program being operational to perform the following steps for reading the data item:
• establishing a session with the database system over the network,
• transmitting the client computer specific log-in information to the database system via the session,
• entry of the key and the key identifier from one of the security tokens into the client computer for use of the key by the client computer and without transmitting the key to the database system;
• entry of a search criterion into the client computer,
• generating a database query using the search criterion and the key identifier, the key identifier limiting the query to encrypted data items that have an attribute matching the key identifier,
• in response to the query, receiving an encrypted data item matching the search criterion from the database system,
• decrypting the encrypted data item using the cryptographic key.

A computer program product, in particular the digital storage medium, comprising instructions that are executable by a client computer, the computer program product being an application program, the application program being operational for processing a user credential by a predefined deterministic algorithm, wherein the processing of the user credential by the predefined algorithm provides a key and a key identifier, the application program being operational to perform the following steps for writing a data item to the database system:

• entry of the data item into the client computer,
• encrypting the data item with the key,
• generating a database insert command, the insert command comprising the encrypted data item and the key identifier of the key with which the data item has been encrypted as an attribute of the encrypted data item for storing the encrypted data item in the database system with the key identifier as an attribute,
• establishing a session with the database system over the network by the network communication interface,
• transmitting the insert command via the session to the database system for processing by the one of the databases that has been determined to be assigned to the client computer by the log-in component such that the encrypted data item with the key identifier is stored in that database,
• the application program being operational to perform the following steps for reading the data item:
• establishing a session with the database system over the network,
• transmitting the client computer specific log-in information to the database system via the session,
• entry of the key and the key identifier from one of the security tokens into the client computer for use of the key by the client computer and without transmitting the key to the database system;
• entry of a search criterion into the client computer,
• generating a database query using the search criterion and the key identifier, the key identifier limiting the query to encrypted data items that have an attribute matching the key identifier,
• in response to the query, receiving an encrypted data item matching the search criterion from the database system,
• decrypting the encrypted data item using the cryptographic key.