File format-based transparent encryption

A system comprising one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:

• receiving, by one or more computing devices, a write request including a table with one or more columns to be stored in a storage device;
• compressing table data in a unit of block, wherein each column includes a number of blocks;
• generating a column key for each column and a block key for each block including sensitive information;
• encrypting (i) each block including sensitive information with a corresponding block key and (ii) rest of blocks in each column with a corresponding column key;
• generating wrapped keys for the column keys and block keys and storing the wrapped keys into a key file;
• storing the encrypted blocks of each column into a data file in a data folder of the storage device and storing the wrapped keys in a key file in a separate key file folder;
• and
• storing a reference to the key file in a header of each encrypted block in the data file.

A non-transitory computer-readable medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:

• receiving, by one or more computing devices, a write request including a table with one or more columns to be stored in a storage device;
• compressing table data in a unit of block, wherein each column includes a number of blocks;
• generating a column key for each column and a block key for each block including sensitive information;
• encrypting (i) each block including sensitive information with a corresponding block key and (ii) rest of blocks in each column with a corresponding column key;
• generating wrapped keys for the column keys and block keys and storing the wrapped keys into a key file;
• storing the encrypted blocks of each column into a data file in a data folder of the storage device and storing the wrapped keys in a key file in a separate key file folder;
• and
• storing a reference to the key file in a header of each encrypted block in the data file.