Database encryption to provide write protection

A computer implemented method comprising:

• receiving a read request to a database, the read request including an original table (OT) name of one of a plurality of tables in the database and a column name of one of a plurality of columns in the OT;
• identifying a row of the OT where the data entry is to be read from, the row of the OT corresponding to an OT row identifier;
• reading a data entry from a first location in the OT corresponding to the column name and OT row identifier;
• reading a cipher text from a second location in a cipher text column of an encrypted table (ET) different than the OT, the second location being in a row of the ET where the row also stores the OT name, the column name, and the OT row identifier;
• preparing, as read from the ET, an additional authenticated data (AAD) comprising the OT name, the column name, and the OT row identifier;
• sending a decryption request to a cryptographic service, the request comprising the cipher text and the AAD;
• responsive to receiving a response that the decryption was successful, receiving a plaintext version of the cipher text and validating the encryption as successful if the plaintext version of the cipher text matches the data entry accessed from the OT.

A non-transitory computer readable medium comprising instructions that, when executed by a processor of a device, cause the processor to perform the steps of:

• receiving a write request to a database, the write request specifying an original table (OT) name of one of a plurality of tables in the database, a column name of one of a plurality of columns in the OT, and a data entry to be written;
• identifying a row of the OT where the data entry is to be written, the row of the OT corresponding to an OT row identifier;
• preparing an additional authenticated data (AAD) comprising the OT name, the column name, and the OT row identifier;
• obtaining a cipher text based on the data entry and the AAD;
• and
• writing the cipher text to a ET location in a cipher text column of an encrypted table (ET) different than the OT, the ET location being in a row of the ET where the row also stores the OT name, the column name, and the OT row identifier.