15. The computer-implemented method of claim 8 , further comprising: receiving, by the database access system, a request to make the field in the database; selecting the one or more keys to associate with the field; and preparing the one or more underlying fields in the database in place of the field, the one or more underlying fields including an encrypted data field and a protected range field, the encrypted data field encrypted by a key from the one or more keys, the protected range field representing a range segment of encrypted data values within the encrypted data field.
8. A computer-implemented method for providing database services, comprising: receiving a query from a client specifying a protected field within a database, the field being protected and having underlying fields stored in the database, the underlying fields having been protected with one or more keys inaccessible to a database engine associated with the database, the one or more keys accessible to a database access system, the query comprising a requested range of values within the field; altering the query to form a modified query, the modified query having query terms associated with the field modified to use one or more of the underlying fields, the altering comprising: obtaining a list of range segments, the range segments having discrete values representing a range of values within the field; and modifying the query to request a set of the range segments from the field, the set of the range segments comprising the requested range of values; sending the modified query to the database engine; receiving a query result from the database engine, the query result including one or more underlying field results associated with the field; modifying the one or more underlying field results using the one or more keys in the query result to form a modified query result, the one or more underlying field results used to form a field result for the field; and filtering the modified query result to match the requested range of the query.