Data query against an encrypted database

A computer program product (CPP) comprising:

• a set of non-transitory storage device(s);
• and
• computer code stored collectively in the set of non-transitory storage device(s), with the computer code including data and instructions to cause a processor(s) set to perform at least the following operations:
• receiving a plurality of unencrypted sensitive data records with each unencrypted sensitive data record including plain text data;
• for each given unencrypted sensitive data record of the plurality of sensitive data records, encrypting the plain text of the given unencrypted data record with a SHA-512 hash function to generate a respectively corresponding fixed length hash value for the plain text of the given unencrypted sensitive data record;
• generating a cryptographic key for the given unencrypted sensitive data record using
• a password-based derivation function combined with a secret key,
• a random salt parameter,
• an SHA-512—(Secure Hash Algorithm 512) pseudorandom function and
• an iterations number;
• for each given unencrypted sensitive data record of each the plurality of unencrypted sensitive data record, reversibly encrypting the given unencrypted sensitive data record using an AES (Advanced Encryption Standard) encryption algorithm to generate a respectively corresponding reversibly encrypted sensitive data record, wherein generating the reversibly encrypted sensitive data record comprises generating a cipher text as an AES block cipher combined with the cryptographic key and a unique nonce parameter;
• for each given reversibly encrypted sensitive data record, storing the given reversibly encrypted sensitive data record at a respectively corresponding storage address;
• for each fixed length hash value, creating an entry in a mapping table to map the fixed length hash value to the storage address of the corresponding reversibly encrypted sensitive data record;
• receiving, by one or more processing units, a query string from a requestor for a first reversibly encrypted sensitive data record, with the query string including a first fixed length hash value corresponding to the first reversibly encrypted sensitive data record;
• and
• acquiring, by one or more processing units, the first reversibly encrypted sensitive data record using the fixed length hash value and the mapping table to locate the storage address of the first reversibly encrypted sensitive data record.

A computer system (CS) comprising:

• a processor(s) set;
• a set of storage device(s);
• and
• computer code stored collectively in the set of storage device(s), with the computer code including data and instructions to cause the processor(s) set to perform at least the following operations:
• receiving a plurality of unencrypted sensitive data records with each unencrypted sensitive data record including plain text data;
• for each given unencrypted sensitive data record of the plurality of sensitive data records, encrypting the plain text of the given unencrypted data record with a SHA-512 hash function to generate a respectively corresponding fixed length hash value for the plain text of the given unencrypted sensitive data record;
• generating a cryptographic key for the given unencrypted sensitive data record using
• a password-based derivation function combined with a secret key,
• a random salt parameter,
• an SHA-512—(Secure Hash Algorithm 512) pseudorandom function and
• an iterations number;
• for each given unencrypted sensitive data record of each the plurality of unencrypted sensitive data record, reversibly encrypting the given unencrypted sensitive data record using an AES (Advanced Encryption Standard) encryption algorithm to generate a respectively corresponding reversibly encrypted sensitive data record, wherein generating the reversibly encrypted sensitive data record comprises generating a cipher text as an AES block cipher combined with the cryptographic key and a unique nonce parameter;
• for each given reversibly encrypted sensitive data record, storing the given reversibly encrypted sensitive data record at a respectively corresponding storage address;
• for each fixed length hash value, creating an entry in a mapping table to map the fixed length hash value to the storage address of the corresponding reversibly encrypted sensitive data record;
• receiving, by one or more processing units, a query string from a requestor for a first reversibly encrypted sensitive data record, with the query string including a first fixed length hash value corresponding to the first reversibly encrypted sensitive data record;
• and
• acquiring, by one or more processing units, the first reversibly encrypted sensitive data record using the fixed length hash value and the mapping table to locate the storage address of the first reversibly encrypted sensitive data record.