Architecture of a secure application that encrypts data in the database

Question

I need to design an application that protects some data in a database against root attack. It means, that even if the aggressor takes control over the machine where data is stored or machine with the application server, he can't read some business critical data from the database. This is a customer's requirement. I'm going to encrypt data with some assymetric algorithm and I need some good ideas, where to store private keys, so that data is secure as well as the application usability was quite comfortable? We can assume, for simplicity, that only one key pair is used.

Answer 1

This is a customer's requirement.

Customer's requirements must be projected onto the real world.

If your application can read some business data, and if the aggresor takes control of your application, then the agressor can read that business data.

Assymetric cryptography won't do magic.

Answer 2

The place to store the private key is with the client, and decrypt it only on the client. The data would need to be at no time decrypted, read or passed through the server in unencrypted form.