# Technique for Searching Data in a Cryptographically Protected SQL Database
## 4 The Proposed Technique for Searching the Required Data  
Preparing to execute a search query  
In order to be able to generate and execute the corresponding search queries for the required data stored in encrypted form in the database on a third-party remote DBMS server, as well as queries for manipulating such data, you must first perform some operations. The main such operations are:  
A. Operations related to the creation of security tokens for legitimate users:  
* generation by a cryptographically strong PRNG of the secret (symmetric) keys \(K_{sec}\)-- for encrypting/decrypting the table \(R^{sec}\) and \(K_{ss}\)--for encrypting/decrypting modules of the special software;
* formation of stegocontainers file\({}_{i}^{1}(K_{sec})\), file\({}_{i}^{2}(K_{ss})\) with their subsequent compression, encryption (file\({}_{i,zip}^{enc}\)\(=\) Enc\({}_{P_{i}}\)(file\({}_{i}^{1}(K_{sec})\), file\({}_{i}^{2}(K_{ss}))\)) and entering this information on security tokens;
* issuance to users of the created security tokens with file\({}_{i,zip}^{enc}\). B. Operations related to the generation of secret keys, subsequently used in an appropriate way by the proxy server and the database server:  
* generation by a cryptographically strong PRNG of the secret keys \(K_{1}^{R}\), \(K_{2}^{j}\) for each corresponding table \(R_{\alpha}\) (\(\alpha=1,\ldots,A\)) of the remote database and an attribute containing sensitive data that should be encrypted;
* generation by a cryptographically strong PRNG of key \(K_{pd}\) to encrypt/decrypt the module of the program for extracting key \(K_{ss}\) from file\({}_{i}^{2}(K_{ss})\). C. Operations related to preparing for the secure operation of a remote database:
* creating a table \(R^{sec}\) in the database and writing to it the corresponding data encrypted with one of the cryptographically strong algorithms (for example, AES-256; \(K_{sec}\) is used as a key): secret keys \(K_{1}^{R}\), \(K_{2}^{j}\) along with the names of the corresponding tables and attributes for which they were created;
* encryption using the keys \(K_{ss}\) and \(K_{pd}\) and recording in the database of special software modules. Next, we will consider the actual algorithm for generating a search query implemented on a trusted application server (database proxy server). The main steps of the proposed algorithm for generating an SQL search query over encrypted databases are given below. 1. The \(i\)-th legitimate user during an active session receives: 1. compressed encrypted file file\({}_{i,zip}^{enc}\)\(=\) Enc\({}_{P_{i}}\)(file\({}_{i}^{1}(K_{sec})\), file\({}_{i}^{2}(K_{ss})\)) with stegocontainers (at the beginning of the session); 2. the original SQL query with plaintext (\(Q\)). 2. Decrypting the file with stegocontainers file\({}_{i-zip}^{enc}\) (Dec\({}_{P_{i}}(\text{file}_{i-zip}^{enc})\)), preparing them for transfer, and actually transferring the stegocontainers to the DBMS server. In the active session, when processing the first user query related to the search for the required encrypted data, the compressed file file\({}_{i-zip}^{enc}\) is decrypted and the corresponding stegocontainers file\({}_{i}^{1}(K_{sec})\), file\({}_{i}^{2}(K_{ss})\) are extracted from it. The latter are renamed in order to bring their names in line with the names known to the special software and are transmitted to the DBMS server via a secure channel. 3. Parsing the original SQL query \(Q\). Extraction from the user's original SQL query of the keywords \(w_{k}\), presented in clear text, in accordance with which it is required to search for the required data in the database on a third-party remote DBMS server. 4. Generating a random number \(x_{k}\). For this, some PRNG is used: \(x_{k}=random\_PRNG\). 5. Formation of trapdoor \(T_{k}\), on the basis of which the search will be carried out over the encrypted database. To do this, the corresponding search keyword \(w_{k}\) is encrypted using one of the cryptographically strong algorithms.