Question

Recently I am assigned with a problem, encrypting the database field such as SSN but still have to keep the “partial searching” working on it.

E.g: SSN 123-45-6789 is encrypted to abcdxyz in the database. When user enters “2345” to the search box then it has to come up in the result.

We have millions records in the database. We are using SQL server 2008 R2. I has been googling around but still not see any good solution yet. Is there any good solution for this ?

Thanks for help.

Answer 1

No, there isn’t. If it would be possible to search an encrypted field then by definition it would be badly encrypted. The possible alternatives are:

1. Search on decrypted values. This is unbearable slow in practice as millions of values have to be decryption for each query.
2. Only search exact matches. Since the encrypted values are salted, the exact match search is only possible if a cryptographically secure hash is stored along with the encrypted data and the search is done on the hash value.
3. Use Transparent Data Encryption instead of column encryption.

Option 3) is by far the best, but requires Enterprise Edition licensing. If TDE is not available, then the requirement for partial search must be removed, there is no realistic way to satisfy it.