Database system providing SQL extensions for automated encryption and decryption of column data

A database system providing automated encryption support for column data, the system comprising:

• a processor;
• a memory coupled to the processor;
• a parser that supports Structured Query Language (SQL) extensions for use in SQL statements to create and manage named encryption keys for encrypting column data, and for creating and managing database tables with column data encrypted with said named encryption keys;
• and
• an execution unit, operating in response to SQL statements parsed by the parser, that:
• creates in response to parsing a first SQL statement employing said SQL extensions a particular named encryption key having a user-assigned syntactically unique name that can be parsed from within other SQL statements employing said SQL extensions, said particular named encryption key being identified in said first SQL statement by said user-assigned syntactically unique name,
• creates in response to parsing a second SQL statement employing said SQL extensions one or more database tables having particular column data encrypted with said particular named encryption key, said particular named encryption key being identified in said second SQL statement by said user-assigned syntactically unique name , and
• automatically decrypts the particular column data for use by a subsequent database operation that requires the particular column data that has been encrypted.

In a database system, a method for encrypting column data, the method comprising:

• defining query language extensions for use in SQL statements to create and manage named column encryption keys, and for creating and managing database tables with encrypted column data, each named encryption key being identified in SQL statements by a user-assigned syntactically unique name;
• in response to a first query language statement employing said extensions, creating a named encryption key for encrypting a particular column of a database table, said named encryption key being created with a user-assigned syntactically unique name so that it can be referenced within other query language statements employing said extensions, said named encryption key being identified in said first query language statement by said user-assigned syntactically unique name;
• in response to a second query language statement employing said extensions, encrypting the particular column using said named encryption key, said named encryption key being identified in said second query language statement by said user-assigned syntactically unique name;
• and
• during a subsequent database operation requiring column data inserted to or selected from the particular column, automatically encrypting or decrypting the column data as necessary for carrying out the database operation.