# Technique for Searching Data in a Cryptographically Protected SQL Database
## 4 The Proposed Technique for Searching the Required Data
With the help of this procedure, using the key \(K_{pd}\) received from the DB proxy server, one of the modules of special software is decrypted to extract the key \(K_{ss}\) from file\({}_{i}^{2}(K_{ss})\). After decrypting the corresponding module, the latter is compiled and launched for execution. As a result of the operation of the decrypted module, the key \(K_{ss}\) is extracted from file\({}_{i}^{2}(K_{ss})\), the value of which is assigned to one of the attributes of the current user session--the application context attribute--_atrc1_ (the so-called local initialization of the application context, for user session). This value, as noted above, is valid within this session and is not available from other sessions. After determining the appropriate attribute of the application context, the decrypted module of the special software for extracting the key \(K_{ss}\) from file\({}_{i}^{2}(K_{ss})\) is deleted. Moreover, using the \(P_{DS}\) procedure, which uses the set value of the _atrc1_ application context attribute during its execution, the next module of special software is decrypted, followed by its compilation and execution to extract the \(K_{sec}\) key from file\({}_{i}^{1}(K_{sec})\). The resulting value of the \(K_{sec}\) key is assigned to another attribute (_atrc2_) of the current user session (local initialization of the application context). This value will later (when executing the corresponding queries) be used to enable the legitimate user to automatically extract (using decrypted special software) the appropriate keys from the encrypted table \(R^{sec}\) to decrypt sensitive data stored in the corresponding attributes of the remote database tables. This actual application context value is also only valid within this session and is not available from other sessions. 2. To execute the corresponding request \(Q_{M}\) in our solution, it is proposed to use the capabilities of technologies: RLS (with the implementation of the application context) and FGA (namely, the ability to mimic a SELECT trigger). For this purpose, within the framework of the above technologies, an additional stored procedure and function were implemented. These persistent stored modules run automatically under the appropriate conditions specified in the appropriate security policies. It is these modules that are involved in decrypting the remaining stored modules of special software, compiling, running for execution, as well as automatically deleting the latter after executing the corresponding data search operator in a cryptographically protected database. Activated stored modules of special software provide secure hidden (without leaving traces in the available documentation tools of the DBMS server) automatic extraction and decryption (without showing in the clear) of encrypted data using keys stored in \(R^{sec}\). That is, the automatically obtained intermediate results of decryption \(F_{decr}(E_{K_{3}^{\prime}})=\text{Decr}_{f(K_{1}^{R},K_{2}^{\prime},K_{3}^ {\prime})}(R,j,A_{enc},M_{enc},E_{K_{3}^{\prime}})\), necessary to search for the required data among the encrypted ones (\(E_{K_{3}^{\prime}}\) is the encrypted value stored in the \(\gamma\)-th line of the \(j\)-th column of some table \(R\) of the database), are not disclosed to users, including privileged ones. 3. The DBMS server returns the result of the query \(Q_{M}\) to the database proxy server in encrypted form. 4. The database proxy server decrypts the received encrypted data and returns to the application the result of the original query (\(Q\)) of the user. The general scheme of the query execution algorithm (Algorithm 2) is presented below. ```
Input:\(Q_{M}\), file\({}_{i}^{1}(K_{sec})\), file\({}_{i}^{2}(K_{ss})\), \(K_{pd}\) OutputQ. 1: Executing a stored procedure \(P_{DS}\). 1.1: Decryption \(\left(\text{using }K_{pd}\right)\) of one of the special software modules. 1.2: Compiling and running the decrypted module of special software. 1.3: Extracting the key \(K_{ss}\) from the stegocontainer file\({}_{i}^{2}(K_{ss})\).