Concept - Database Encryption

Databases are valuable and protected in layers: firewalls, authentication, O/S access control, DB access control and database encryption (s.30).

What to encrypt	Verdict (s.30)
Entire database	inflexible: the user would have to download entire tables, decrypt and work with the results
Records (rows) or columns (attributes)	best; attribute indexes are also needed for retrieval

To be flexible it must be possible to work with the database in its encrypted form (s.30).

Architecture (s.31): user $\to$ (1) original query $\to$ client query processor (with metadata and encrypt/decrypt) $\to$ (2) transformed query $\to$ server query executor on the encrypted database $\to$ (3) encrypted result $\to$ client $\to$ (4) plaintext result. The data owner provides metadata and the encrypted database.

Related: Concept - Querying an Encrypted Database. Appears in 05 Database Security - Chunk 01 (s.1-38).