Method and system for transparently encrypting sensitive information

A computer program product including non-transitory computer-readable medium, the computer-readable medium comprising software instructions operable to enable a computer to perform a function of transparently encrypting sensitive information flowing from at least a client to a database server over a network, the instructions comprising instructions for:

• detecting at least one literal of a database command that includes sensitive information at an encryption gateway placed on a segment of the network between the at least a client and the database server;
• extracting the literal from the database command;
• encrypting the literal thereby forming an encrypted string;
• and
• replacing the literal by the encrypted string in the database command.

A method for transparently decrypting at least a literal of a database command previously identified as sensitive information flowing between a database server and at least a client over a network, comprising:

• for each encrypted literal of a database command included in data retrieved by the at least a client from the database server:
• checking against a predefined policy if a client requesting the data is authorized to view sensitive information contained in the data at an encryption gateway placed on a segment of the network between the at least a client and the database server;
• decrypting the encrypted literal of a database command to construct the sensitive information of the database command if the client is authorized to view the sensitive information contained in the data;
• and
• sending the constructed sensitive information to the client.

A computer program product including a non-transitory computer-readable medium comprising software instructions operable to enable a computer to perform a method for transparently decrypting at least a literal of a database command previously identified as sensitive information flowing between a database server and at least a client over a network, the method comprising:

• for each encrypted literal of a database command included in data retrieved by the at least a client from the database server:
• checking against a predefined policy if a client requesting the data is authorized to view sensitive information contained in the data at an encryption gateway placed on a segment of the network between the at least a client and the database server;
• decrypting the encrypted literal of the database command to construct the sensitive information of the database command if the client is authorized to view the sensitive information of the database command;
• and
• sending the constructed sensitive information to the client.

A secure database system, comprising:

• a database server for servicing requests from clients for computational or data storage resources;
• a database coupled to the database server and operable to save sensitive information;
• and
• an encryption gateway installed between the clients and the database server and operable to perform transparent encrypting of at least a literal of a database command that contains sensitive information.