WO2007107658A1

WO2007107658A1 - Method for access control, method for using a database, installation, computer program and database

Info

Publication number: WO2007107658A1
Application number: PCT/FR2007/050857
Authority: WO
Inventors: Didier Guerin
Original assignee: France Telecom
Priority date: 2006-03-22
Filing date: 2007-02-28
Publication date: 2007-09-27

Abstract

The invention relates to a method for controlling the access of a user (Uk) to data (Di) stored in at least one database (10), said method comprising a step of authorisation allocation and/or prohibition of access to data (Di) in the database (10). For each datum (Di), the authorisation allocation and/or prohibition depend on the date (d(Di)) of creation or modification of the datum (Di).

Description

Access control method, method of using a database, installation, computer program and database.

The present invention relates to a method of controlling access of a user to data stored in at least one database, a method of using a database, an installation for using a database of data, a computer program and a database.

It is known in the state of the art a method of controlling access of a user to data stored in at least one database, of the type comprising a step of granting authorization and / or prohibition of access to data from the database.

This method is implemented for example as follows. First of all, the user authenticates himself to a server in the database. Then, the server consults a digital file including the access rights of all users of the database, including the authenticated user. This file is managed by an administrator of the database.

Finally, depending on the access rights of the authenticated user, the server assigns an authorization and / or a prohibition of access to data of the database.

Usually, the database administrator manages a user's access rights to data in the database globally, relative to a set of data.

For example, in the case of a database comprising digital document storage means classified in digital folders, the administrator of the database manages the user's access rights to an entire folder. and not to each of the documents contained in the digital file.

In particular, when the database administrator allows the user access to a digital folder, this authorization remains valid regardless of the changes made to the contents of the folder.

Similarly, when the database administrator prohibits the access of the user to documents in the database, this access prohibition is assigned globally, for the entire digital folder to which the user had access.

Thus, following a prohibition of access to a digital file, the user, during the access control, will be granted a prohibition of access to all documents in this digital file. As a result, the prohibition legitimately concerns documents that are generally unknown to the user and that are added to the digital file after the date of the prohibition. However, the prohibition of access concerns, in a more questionable way, documents that the user was able to see that existed in the digital file prior to the date of prohibition.

The invention aims to allow a more relevant control of permissions and access bans.

For this purpose, the subject of the invention is a method for managing a user's access rights to data stored in at least one database, of the aforementioned type, characterized in that for each datum the attribution authorization and / or prohibition depends on a date associated with the data, said date being a date of creation or modification of said data.

Thus, this method allows a more relevant control of the access rights of the user since the access rights do not only depend on a possible membership of the data to a subset of data but also an associated date to the data. In addition, with the method according to the invention access is allowed to all data previously assigned access authorization and not only during a predefined time interval.

A control method according to the invention may further include one or more of the following features.

The granting of authorization and / or prohibition also depends on at least one date associated with the user.

The method includes a step of comparing the date associated with the data and the date associated with the user.

The granting of authorization and / or prohibition depends on first and second dates associated with the user and defining a subscription period of the user to a data class to which the data belongs, the first date being earlier on the second date. The user may subscribe during a subscription period to different classes of data, and the method includes a step of consulting a user's subscription history to the data classes, the history including, for each data class, two dates defining the subscription period of the user to the data class.

- The allocation step is such that an access authorization is assigned to each data item of a data class to which the user has subscribed, whose modification or creation date is earlier than the second date of the user's subscription period to the data class.

- The assignment step is such that a prohibition of access is assigned to each data item of a data class to which the user has subscribed, whose modification or creation date is earlier than the first date of the user's subscription period to the data class.

Thus, thanks to the invention, it is ensured that if the user was able to become acquainted with a datum because he has subscribed to a data class comprising the datum, this user will be given an authorization of access to this data regardless of the classes of data to which the user is subscribed later.

The control of the access of the user to the database is therefore much more relevant than in the state of the art since we do not encounter questionable situations in which a user no longer has access to a data item he could have seen before.

The invention also relates to a method of using a database, of the type comprising a data loading method in the database, a method for controlling access to data from the database, and a method of downloading data from the database, characterized in that the access control method is according to the invention defined above.

Preferably, the method of loading, by a user, a piece of data in a data class of the database comprises the following steps:

random generation of an identifier of the data, calculation of a first key associated with the users subscribing to the data class at the moment of loading, calculation of an encryption key of the data function of the identifier of the data. the data and the first key, encrypting the data by means of the encryption key of the data, - loading the encrypted data in the data class of the database.

Thanks to this loading method, each piece of data is encrypted by means of an encryption key of its own which increases the security of the database.

Preferably, the calculation of the first key is performed by calculating, for each user subscribed to the data class, a key that depends on an identifier of the user and a root key common to all users. This is particularly advantageous because there is only one key to keep in the database. Preferably, the loading method further comprises the steps of: storing, in a data consultation server, the identifier of the data, calculating, for the encrypted data, an index based on the encryption key of the data, and when loading the encrypted data into the data class of the database, the data is associated with the index.

Thus, it is particularly difficult for an attacker to find the documents stored in the database since they are not classified according to their identifier but according to an index whose meaning can only be understood as after calculating the encryption key of the document. This therefore improves the security of the database.

Optionally, the method for downloading a user of a data from a data class of the database comprises the following steps: - selection from the data consultation server of the identifier of the data to be downloaded for which a been granted access authorization when implementing the access control method,

calculation of the encryption key of the data from: o the identifier of the data, o identifiers associated with each of the users who, at the date of loading the data in the database, were subscribed to the class of data. data of which the data belongs, and o of the root key,

calculation of the index of the data from the encryption key of the data,

- Search for the encrypted data in the database through the index, decryption of the encrypted data by means of the encryption key.

The invention also relates to an installation for the use of a database, characterized in that it comprises means for implementing a method of use as defined above.

The invention also relates to a computer program, characterized in that it comprises instructions for the execution of a method of use as previously defined.

The invention also relates to a database, characterized in that it is part of an installation as previously defined. The invention will be better understood on reading the description which follows, given solely by way of example and with reference to the appended drawings in which:

FIG. 1 is a diagram of a database access installation according to the invention; FIG. 2 is a diagram of the steps of a method of authenticating a user with the database; represented in FIG.

FIG. 3 is a diagram of the steps of a method according to the invention for controlling a user's access to data stored in the database represented in FIG. 1; FIG. 4 is a diagram of the steps of FIG. a method of downloading data stored in the database shown in the figure

1, FIG. 5 is a diagram of the steps of a method of loading a datum in the database represented in FIG. 1. FIG. 1 diagrammatically shows an installation 8 for the use of a database of FIG. data 10 capable of storing data D ₁ in digital form.

In addition to the database 10, the installation 8 includes an authentication server 12, a server 14 for consulting the data D ₁ stored in the database 10 and an encryption server 16. The database 10 comprises three units 18, 30 and 34 of storage respectively connected to the servers 16, 12 and 14.

The first unit 18 is a data storage unit D ₁ . The data D, stored in the storage unit 18 are classified in n classes CD ₁ ,..., CD _j ,..., CD _n of data. We denote CD (D ₁ ) = CD _j the data class comprising the data D ₁ .

The data D ₁ of the database 10 are intended to be downloaded by users U ₁ ,..., U _k ,..., U _m from the database 10. Each user U _k belongs to at least one CU class ₁ , ..., CU _j , ..., CU _n of users and can access the data D ₁ stored in the database 10 from terminals connected to the database 10 by the Internet network 28.

Each user U _k has three types of keys: a first pair of keys public and private encryption, a second pair of public and private key signature and a third key K (U _k ) used when encrypting the data to be stored in the server. 18. Each user U _k also has a personal identifier l (U _k ) which is stored in the storage base 30. The user Ui accesses the database 10 from the terminal 26.

The classes CD ₁ ,..., CD _j ,..., CD _n of data are respectively associated with the classes CU 1,..., CU 1,..., CU _n of users U 1 _,. , ..., U _m .

In the example described, the number of data classes is equal to the number of user classes and for the sake of clarity, the indices relating to two classes of users and associated data are the same.

It is also possible that these two numbers are different. However, each class of data must be associated with at least one class of users. Users U ₁ , ..., U _k , ..., U _m are likely to adhere to classes CU ₁ , ...,

CU _j , ..., CU _n users and / or resign.

The membership of a user U _k to a user class CU _j triggers the subscription of this user U _k to the data class CD _j associated with this user class CU _j . The resignation of a user U _k of a user class CU _j triggers the unsubscription of the user of the data class CD _j associated with this user class CU _j .

More particularly, the user U _1, which at a time t represented by FIG. 1, belongs to the user class CU ₁ . Since the user U ₁ belongs to the user class CU ₁ , he is subscribed to the data class CD ₁ . At times earlier than the instant t, the user U ₁ was part of other user classes than the class CU ₁ . In the example described, the user U ₁ belonged to the classes CU ₂ and CU ₃ and was therefore subscribed to the data classes CD ₂ and CD ₃ .

It is thus possible to build a subscription history Hu ₁ of the user U ₁ to the data classes CD ₁ , ..., CD _j , ..., CD _n . This history includes, for each data class CD _j , first d ^ (U ₁ , CD _j ) and second d ₂ (U ₁ , CD _J ) dates defining a subscription period of the user U ₁ to the data class CD _j , the first date being earlier than the second date.

Similarly, one can build, for any user U _k , his H _Uk subscription history to data classes CD ₁ , ..., CD _j , ..., CD _n . The authentication server 12 is connected to the second storage unit 30 which is a unit for storing the subscription histories H _Uk of the users U ₁ ,..., U _k ,..., U _m with the different classes CD ₁ , ..., CD _j , ..., CD _n of data.

The user U ₁ has a smart card 32 on which is stored a personal digital token including its history Hu ₁ subscription to classes CD ₁ to CD ₃ data. The personal digital token is issued by the authentication server 12 at the request of the user Ui. This personal digital token is certified by a signature private key of the authentication server 12. The method of issuing the personal digital token will be described later, with reference to FIG. 2. At a given instant, each user U _k of a user class CU _j has access to all data D, of the data class CD _j associated with this user class CU _j . Over time, data can be added to this class CD _j , others can be modified or deleted. In other words, the cardinal of the data class CD _j evolves over time. The consultation server 14 is connected to the third storage unit which is an identifier storage unit 1 (D ₁ ) of the data D ₁ stored in the database 10. Each identifier 1 (D ₁ ) is associated with the class CD (D ₁ ) of data to which the data belongs and a date d (D,) of creation or modification of the data D, in the base 10. The use of the database 10 by the user Ui according to the method of use of the invention, will be described in the following description.

This method of use comprises a method of loading data into the database which will be described later with reference to FIG. 5, a method for controlling access to data of the database according to the invention which will be described later. with reference to FIG. 3, and a method for downloading data from the database that will be described with reference to FIG. 4.

To access the data D ₁ stored in the database 10, the user Ui must first authenticate with the authentication server 12. The purpose of the authentication is to obtain the delivery of the personal digital token comprising the subscriber Hm history of the user U ₁ to the data classes CD ₁ to CD ₃ . The authentication method is described with reference to FIG.

During a first step 200, the user U ₁ transmits his personal identifier 1 (U ₁ ) to the authentication server 12.

During a second step 202, the authentication server 12 responds to the user by transmitting a random.

At the reception of the hazard, during a step 204, the user U ₁ signs, by means of his signature private key, the pair comprising his personal identifier 1 (U ₁ ) and the hazard transmitted during transmission. step 202 by the authentication server 12, then transmits this signed pair to the authentication server 12 during a step 206. Upon receipt of this pair, the authentication server 12 verifies the authenticity of the user Ui by verifying the validity of the signature of the couple by means of the user's public signature key associated with his private key. signature.

The authentication server 12 then generates, during a step 208, a personal digital token comprising the subscription history Hm of the user Ui to the data classes CD ₁ to CD ₃ . To obtain the subscriber Hui history of the user U ₁ , the authentication server 12 consults the storage unit 30.

This personal digital token is certified by the signature private key of the authentication server 12. The personal digital token includes in particular the date on which it was generated, that is to say the date from which this digital token personal is valid.

As mentioned above, the subscription history Hu ₁ of the user U ₁ to the data classes CD ₁ to CD ₃ includes, for each data class CD _j , first di (U _i , CD _j ) and second d ₂ (U ₁ , CD _J ) dates defining a subscription period of the user U ₁ to the data class CD _j .

For each data class CD ₂ and CD ₃ to which the user U ₁ is no longer subscribed, the first date corresponds to the date of subscription to the class and the second date corresponds to the date of unsubscription of the class.

For the data class CD ₁ to which the user U ₁ is subscribed at the time of generation of the digital token, the first date corresponds to the date of subscription to the class and the second date corresponds to the date on which the digital token is generated.

During a step 210, the authentication server 12 transmits the personal digital token user U ₁ .

The user can then store the personal digital token that has been transmitted to him by the authentication server 12 on any digital medium that he has, in particular on his smart card 32.

The subscription history Hu ₁ contained on the personal digital token allows the user U ₁ to be assigned permissions and / or prohibitions of access to data from the database 10, when it connects to the database 10. The access control method of the invention is described hereinafter with reference to FIG.

During a first step 300, the user U ₁ sends to the consultation server 14 a request to consult the data stored in the database 10 to which he has access. During a next step 302, the consultation server 14 transmits the user U ₁ a random. Upon receipt of this hazard, the user signs, during a step 304, his personal digital token and the random received from the consultation server 14 by means of his private key signature and transmits them during a step 306 to the consultation server 14. After verifying the validity of the personal token received, the consultation server

14 during a step 308, consults the subscription history Hui of the user Ui to the data classes, contained in the personal digital token.

With the storage unit 34, the consultation server 14 has access, for each data item D ₁ stored in the database 10, to its date d (D,) of creation and / or modification and to the data class CD (D ₁ ) to which the data D ₁ belongs.

By relating the information contained in the storage unit 34 to the information contained in the personal digital token transmitted to it by the user Ui, the consultation server 14 is able to implement the control method of the user. Ui user access to data stored in the database of the invention.

This method comprises a step of granting authorization and / or prohibition of access to data of the database in which the granting of authorization and / or prohibition depends on a date associated with the data, at least one date associated with the user and a data class to which the data belongs. Permissions and access bans are assigned as follows.

An access authorization is given to each data item D, of a data class CD (D ₁ ) to which the user Ui subscribes, whose modification, creation date d (D,) is earlier than the second date d ₂ (Ui, CD (D,)) of the subscription period of the user Ui to the data class CD (D ₁ ). For example, in the example described, an access authorization is assigned to each data item D ₁ of the data class CD ₂ to which the user U ₁ has subscribed, whose modification or creation date is earlier than the date d ₂ (U ₁ , CD ₂ ) of unsubscription of the user U ₁ of the class CD ₂ .

Similarly, access authorization is granted to each data item of the data class CD ₁ to which the user subscribes, the modification or creation date of which is earlier than the date Cl ₂ (U ₁ , CD ₁ ). to which the digital token has been generated.

Indeed, the consultation server 14 is assured that the user U ₁ is subscribed to the data class CD ₁ until the date of creation of the personal digital token.

The consultation server 14 trusts only the information of the personal digital token issued by the authentication server 12 because it can not access itself. the unit 30 for storing user subscription histories for the different classes of data.

The function of the personal digital token is to avoid submitting queries to the storage unit 30. The consultation server 14 can possibly assign a prohibition of access to each data item D, of a data class CD (D,). to which the user Ui subscribed, whose date (D,) of modification or creation is earlier than the first date di (Ui, CD (D ₁ )) of the subscription period of the user U ₁ to the data class CD (D ₁ ). In this case, the user will only have access to data created or modified during his subscription period to the data class.

For example, in the example described, the consultation server 14 can assign a denial of access to each data item D, of the data class CD ₃ to which the user Ui has subscribed, whose date d (D, ) modification or creation is prior to the first date di (Ui, CD ₃ ) of the subscription period of the user Ui to the data class CD ₃ .

At the end of the implementation of this access control method, the consultation server 14 is able to transmit to the user Ui, during a step 310, a list, stored in the control unit. storage 34, identifiers I (D,) of data to which the user is authorized to access.

The data is stored in the data storage unit 18 in encrypted form.

The encryption key of a data D, of a data class CD (D,) depends on the identifier 1 (D ₁ ) of the data D ₁ and a key of the user class associated with the data class CD (D ₁ ). The key of the user class is calculated from the third keys K (U _k ) of each of the users belonging to the class of users at the moment at which the data has been stored in the storage unit 18. third key

K (U _k ) of a user U _k depends on the identifier l (U _k ) of the user and a root key common to all users. The root key is kept in memory by the encryption server 16 which needs it to calculate the third keys K (U _k ) of the users.

Thus, each piece of data stored in the storage unit 18 of the database 10 is encrypted by means of a key of its own.

The data stored in the storage unit 18 of the database 10 are identified by an index distinct from the identifier I (D,) of the data D, this index being calculated from the encryption key of the database. given. For example, the index is the identifier 1 (D ₁ ) of the data D, encrypted by the encryption key. The method of downloading data loaded into the database is described below with reference to FIG. 4.

Using the access control method described above, the user Ui has obtained a list of identifiers I (D,) D data, which has been granted access authorization.

During a step 400, the user Ui selects and then transmits to the encryption server 16 his personal digital token, the identifier 1 (D ₁ ) of the data D ₁ that the user U ₁ wants to download and the class of data CD (D ₁ ) to which this data belongs. These three elements are signed with the signature private key of the user U ₁ .

During a step 402, the encryption server 16 verifies the signature by means of the public signature key of the user U ₁ .

During a next step 404, the encryption server 16 retrieves from the storage unit 30, the identifiers I (U _k ) of each of the users who, on the date of loading the data in the database 10, subscribed to the data class CD (D ₁ ) of which data D ₁ belongs.

During a step 406, the encryption server 16 calculates the encryption key of the data D ₁ from the identifier 1 (D ₁ ) of the data D ₁ , the identifiers I (U _k ) associated with each users, and the root key. The encryption key of the data also allows the encryption server 16 to calculate the index of the data.

During a step 408, the encryption server 16 sends the storage unit 18 data, a query containing the index of the data to download.

During a step 410, the data storage unit 18 transmits the requested data D ₁ to the encryption server 16. This data item D ₁ is encrypted by means of the encryption key calculated during the step 406.

During a next step 412, the encryption server 16 encrypts all the encrypted data and the encryption key of the data by means of the public encryption key of the user U ₁ . Then, it transmits this to the user U ₁ during a step 414.

After reception, the user U ₁ uses his private encryption key to retrieve the encrypted data and the encryption key of the data then decrypts this encrypted data by means of this encryption key.

The user then obtains the data D, which he wanted to download. The method of loading, by the user subscribing to a data class, a datum D, in the database is described with reference to FIG. This method is relatively close to the download method previously described since it consists in substantially performing the inverse steps.

During a first step 500, the user Ui generates a temporary key specifically dedicated to the loading of the data D in the database. The user encrypts the data D ₁ to be loaded by means of this temporary key and encrypts the temporary key by means of the public encryption key of the encryption server 16.

In a next step 502, the user transmits the encrypted data with the temporary key and the temporary key encrypted with the encryption public key of the encryption server to the encryption server 16. The user U ₁ also transmits to the server the class of data to which it is subscribed and to which the data item to be loaded in the database must be attached.

If the user subscribes to only one class of data, then it is obvious that the data must be attached to this class of data.

During a next step 504, the encryption server 16 obtains the temporary key and decrypts the data to be loaded in the storage unit 18. It then randomly generates an identifier 1 (D ₁ ) of the data it transmits. to the consultation server 14.

The encryption server then calculates a key associated with the user class to which the user belongs, this key being a function of each of the users of the class.

For this, the encryption server 16 transmits, during a step 506, a request to the storage unit 30 so as to know the list of users subscribed to the data class. This list is transmitted to the encryption server 16 during a step 508. During a step 510, the encryption server 16 calculates, for each user subscribed to this class, the third key K (U _k ) associated with the user who depends on the identifier l (U _k ) of the user and the root key common to all users. The server 16 then calculates the key associated with the data class which is a function of each of the users subscribed to the class. Finally, the encryption server 16 calculates the encryption key of the data according to the identifier 1 (D ₁ ) of the data and the key associated with the previously calculated data class.

In step 510, the encryption server 16 encrypts the data D by means of the encryption key of the data and loads this encrypted data into the storage unit 18 during a step 512. loaded in the storage unit 18 is identified by an index calculated from the encryption key of the data.

Claims

A method for controlling a user's access (U _k ) to data (D ₁ ) stored in at least one database (10), of the type comprising an authorization assignment step and / or prohibition of access to data (D ₁ ) of the base (10), characterized in that for each datum (D,), the allocation of authorization and / or prohibition depends on a date (d (D,)) associated with the data item (D ₁ ), said date being a date of creation or modification of said data item.

2. The method according to claim 1, in which the granting of authorization and / or prohibition also depends on at least one date (d U _k , CD (D ₁ )), d ₂ (U _k , CD (D ₁ ))) associated with the user (U _k ).

3. Method according to claim 2, comprising a step of comparing the date (d (D,)) associated with the datum and the date (di (U _k , CD (D,)), d ₂ (U _k , CD (Dι))) associated with the user (U _k ).

4. Method according to claim 2 or 3, wherein the allocation of authorization and / or prohibition depends on first (di (U _k , CD (D,))) and second (d ₂ (U _k , CD (D,))) dates associated with the user (U _k ) and defining a subscription period of the user (U _k ) to a data class (CD (D ₁ )) to which the data (D ₁ ), the first date (di (U _k , CD (D,))) being earlier than the second date (d ₂ (U _k , CD (D,))).

5. Method according to claim 4, wherein the user (U _k ) is able to subscribe during a subscription period to different data classes (CD _j ), and wherein the method comprises a consultation step d a history (H _Uk ) of the user's subscription (U _k ) to the data classes (CD _j ), the history (H _Uk ) comprising, for each data class (CD _j ), two dates (di (U _k , CD _j ), d ₂ (U _k , CD _j )) defining the subscription period of the user (U _k ) to the data class (CD _j ).

The method of claim 5, wherein the assigning step is such that access permission is assigned to each data item (D ₁ ) of a data class (CD _j ) to which the user ( U _k ) has subscribed, whose date (Cl (D ₁ )) of modification or creation is earlier than the second date (d ₂ (U _k , CD _j )) of the subscription period of the user (U _k ) to the data class (CD _j ).

The method of claim 6, wherein the assigning step is such that access prohibition is assigned to each data (D,) of a data class (CD _j ) to which the user ( U _k ) has subscribed, whose date (Cl (D ₁ )) of modification or creation is earlier than the first date (di (U _k , CD _j )) of the subscription period of the user ( U _k ) to the data class (CD _j ).

8. A method of using a database (10), of the type comprising a data loading method (D,) in the database (10), a method for controlling access to data (D) ₁ ) of the database (10), and a method for downloading data (D,) from the database (10), characterized in that the access control method is according to any one of the claims preceding.

9. The method of use according to claim 8, wherein the access control method is according to any one of claims 4 to 7 and wherein the method of loading, by a user (U _k ), a data (D ₁ ) in a data class (CD _j ) of the database (10) comprises the following steps: - random generation (504) of an identifier (1 (D ₁ )) of the data item (D ₁ )

calculating a first key associated with the users (U _k ) subscribed to the data class (CD _j ) at the moment of loading, calculating (510) a data encryption key (D,) function of the identifier (1 (D ₁ )) of the datum (D ₁ ) and the first key, - encryption (510) of the datum (D,) by means of the encryption key of the datum (D ₁ ), loading (512) the encrypted data into the data class (CD _j ) of the base (10).

10. The method of use according to claim 9, wherein the calculation of the first key is performed by calculating, for each user (U _k ) subscribed to the data class (CD _j ), a key (K (U _k )). ) which depends on an identifier (l (U _k )) of the user (U _k ) and a root key common to all users (U _k ).

1 1. A method of using according to claim 10, wherein the charging method further comprises the steps of: - storing in a server (14) consulting data (D ₁₎ of the identifier (1 ( D ₁ )) of the data item (D ₁ ), calculation, for the encrypted data, of an index based on the data encryption key (D ₁ ), and in which, when the encrypted data is loaded into the data class (CD _j ) of the base (10), the data is associated with the index.

12. The method of use according to claim 1 1, wherein the method of downloading by a user (U _k ) of a data of a data class (CD _j ) of the base (10) comprises the following steps: selecting (400) from the data access server (14) of the identifier (1 (D ₁ )) of the data (D ₁ ) to be downloaded for which has been assigned an access authorization when implementing the access control method,

calculation (406) of the data encryption key (D ₁ ) from: o the identifier (1 (D,)) of the data item (D,), o identifiers (l (U _k )) associated with each of the users (U _k ) which, at the date of loading the data (D,) into the database (10), were subscribed to the data class (CD (D ₁ )) to which the data belongs ( D ₁ ), and o of the root key, - calculating the index of the data item (D ₁ ) from the data encryption key (D ₁ ),

- Search (408, 410) of the encrypted data in the database through the index, decryption of the encrypted data by means of the encryption key.

13. Installation (8) for the use of a database (10), characterized in that it comprises means for the implementation of a method of use according to any one of claims 8 to 12.

14. Computer program, characterized in that it comprises instructions for the execution of a method of use according to any one of claims 8 to 12.

15. Database (10), characterized in that it forms part of an installation according to claim 13.