Data query against an encrypted database
A query string for an encrypted database storing a plurality of encrypted data records is received from a requestor. The query string is segmented to obtain at least one word. The at least one word is encrypted with the irreversible encryption algorithm to obtain at least one encrypted word. At least one first encrypted item with a co-occurrence weight higher than a preset threshold based on the at least one encrypted word and a co-occurrence statistics model is acquired. The co-occurrence statistics model is built to provide co-occurrence weights, each indicating a probability that the at least one encrypted word appears in a first encrypted data item of the plurality of encrypted data records. At least one second encrypted data item corresponding to the at least one first encrypted data item is acquired from the plurality of encrypted data records.
1. A method comprising:
receiving a plurality of unencrypted sensitive data records with each unencrypted sensitive data record including plain text data;
for each given unencrypted sensitive data record of the plurality of sensitive data records, encrypting the plain text of the given unencrypted data record with a SHA-512 hash function to generate a respectively corresponding fixed length hash value for the plain text of the given unencrypted sensitive data record;
generating a cryptographic key for the given unencrypted sensitive data record using
a password-based derivation function combined with a secret key,
a random salt parameter,
an SHA-512—(Secure Hash Algorithm 512) pseudorandom function and
an iterations number;
for each given unencrypted sensitive data record of each the plurality of unencrypted sensitive data record, reversibly encrypting the given unencrypted sensitive data record using an AES (Advanced Encryption Standard) encryption algorithm to generate a respectively corresponding reversibly encrypted sensitive data record, wherein generating the reversibly encrypted sensitive data record comprises generating a cipher text as an AES block cipher combined with the cryptographic key and a unique nonce parameter;
for each given reversibly encrypted sensitive data record, storing the given reversibly encrypted sensitive data record at a respectively corresponding storage address;
for each fixed length hash value, creating an entry in a mapping table to map the fixed length hash value to the storage address of the corresponding reversibly encrypted sensitive data record;
receiving, by one or more processing units, a query string from a requestor for a first reversibly encrypted sensitive data record, with the query string including a first fixed length hash value corresponding to the first reversibly encrypted sensitive data record; and
acquiring, by one or more processing units, the first reversibly encrypted sensitive data record using the fixed length hash value and the mapping table to locate the storage address of the first reversibly encrypted sensitive data record.
2. A computer program product (CPP) comprising:
a set of non-transitory storage device(s); and
computer code stored collectively in the set of non-transitory storage device(s), with the computer code including data and instructions to cause a processor(s) set to perform at least the following operations:
receiving a plurality of unencrypted sensitive data records with each unencrypted sensitive data record including plain text data;
for each given unencrypted sensitive data record of the plurality of sensitive data records, encrypting the plain text of the given unencrypted data record with a SHA-512 hash function to generate a respectively corresponding fixed length hash value for the plain text of the given unencrypted sensitive data record;
generating a cryptographic key for the given unencrypted sensitive data record using
a password-based derivation function combined with a secret key,
a random salt parameter,
an SHA-512—(Secure Hash Algorithm 512) pseudorandom function and
an iterations number;
for each given unencrypted sensitive data record of each the plurality of unencrypted sensitive data record, reversibly encrypting the given unencrypted sensitive data record using an AES (Advanced Encryption Standard) encryption algorithm to generate a respectively corresponding reversibly encrypted sensitive data record, wherein generating the reversibly encrypted sensitive data record comprises generating a cipher text as an AES block cipher combined with the cryptographic key and a unique nonce parameter;
for each given reversibly encrypted sensitive data record, storing the given reversibly encrypted sensitive data record at a respectively corresponding storage address;
for each fixed length hash value, creating an entry in a mapping table to map the fixed length hash value to the storage address of the corresponding reversibly encrypted sensitive data record;
receiving, by one or more processing units, a query string from a requestor for a first reversibly encrypted sensitive data record, with the query string including a first fixed length hash value corresponding to the first reversibly encrypted sensitive data record; and
acquiring, by one or more processing units, the first reversibly encrypted sensitive data record using the fixed length hash value and the mapping table to locate the storage address of the first reversibly encrypted sensitive data record.
3. A computer system (CS) comprising:
a processor(s) set;
a set of storage device(s); and
computer code stored collectively in the set of storage device(s), with the computer code including data and instructions to cause the processor(s) set to perform at least the following operations:
receiving a plurality of unencrypted sensitive data records with each unencrypted sensitive data record including plain text data;
for each given unencrypted sensitive data record of the plurality of sensitive data records, encrypting the plain text of the given unencrypted data record with a SHA-512 hash function to generate a respectively corresponding fixed length hash value for the plain text of the given unencrypted sensitive data record;
generating a cryptographic key for the given unencrypted sensitive data record using
a password-based derivation function combined with a secret key,
a random salt parameter,
an SHA-512—(Secure Hash Algorithm 512) pseudorandom function and
an iterations number;
for each given unencrypted sensitive data record of each the plurality of unencrypted sensitive data record, reversibly encrypting the given unencrypted sensitive data record using an AES (Advanced Encryption Standard) encryption algorithm to generate a respectively corresponding reversibly encrypted sensitive data record, wherein generating the reversibly encrypted sensitive data record comprises generating a cipher text as an AES block cipher combined with the cryptographic key and a unique nonce parameter;
for each given reversibly encrypted sensitive data record, storing the given reversibly encrypted sensitive data record at a respectively corresponding storage address;
for each fixed length hash value, creating an entry in a mapping table to map the fixed length hash value to the storage address of the corresponding reversibly encrypted sensitive data record;
receiving, by one or more processing units, a query string from a requestor for a first reversibly encrypted sensitive data record, with the query string including a first fixed length hash value corresponding to the first reversibly encrypted sensitive data record; and
acquiring, by one or more processing units, the first reversibly encrypted sensitive data record using the fixed length hash value and the mapping table to locate the storage address of the first reversibly encrypted sensitive data record.