Secure substring search to filter encrypted data

A non-transitory computer readable storage medium embodying a computer program for performing a method, said method comprising:

• an engine of a server receiving from a trusted third party, a search index and a plurality of ciphertexts;
• the engine storing the search index in a database;
• the engine of the server receiving from a client, a search query;
• the engine referencing the search index stored in the database of the server together with the plurality of ciphertexts encrypted according to a frequency-hiding order-preserving encryption (FHOPE) scheme, to produce candidate ciphertexts meeting the search query;
• and
• the engine communicating to the client at least one candidate ciphertext, wherein each of the plurality of ciphertexts comprise a fragment of a string encrypted according to an encryption scheme, and a position of the fragment within the string,
• and wherein the fragment and the plurality of ciphertexts are generated from processing performed by the trusted third party as a dedicated service, the trusted third party being outside the server and the client.

A computer system comprising:

• one or more processors;
• a software program, executable on said computer system, the software program configured to cause an in-memory database engine of a server to:
• receive from a trusted third party, a search index and a plurality of ciphertexts;
• store the search index in the in-memory database;
• receive from a client, a search query;
• reference the search index stored in the in-memory database of the server together with the plurality of ciphertexts, to produce candidate ciphertexts meeting the search query;
• and
• communicate to the client at least one candidate ciphertext, wherein each of the plurality of ciphertexts comprise a fragment of a string encrypted according to an encryption scheme, and a position of the fragment within the string
• and wherein the fragment and the plurality of ciphertexts are generated from processing performed by the trusted third party as a dedicated service, the trusted third party being outside the server and the client.