Fine-grained access control via database roles

    公开(公告)号:US11822689B2

    公开(公告)日:2023-11-21

    申请号:US18109191

    申请日:2023-02-13

    Applicant: Snowflake Inc.

    CPC classification number: G06F21/6218 G06F16/21 G06F16/256 G06F2221/2141

    Abstract: Embodiments of the present disclosure relate to sharing database roles using hidden roles. A database role may be generated within a database container having a plurality of data objects, wherein the database role exists exclusively within the database container. A set of grants to a particular subset of the plurality of data objects of the database container may be assigned to the database role and the database role may be granted to the share object. The share object is mounted within a consumer account to generate an imported database container within the consumer account, the imported database container including an imported copy of the database role. The imported copy of the database role may be granted to each of one or more account level roles of the consumer account to share the particular subset of the plurality of data objects without creating proxy objects in the consumer account that represent the particular subset of the plurality of data objects.

    Shared object discovery techniques
    12.
    发明授权

    公开(公告)号:US11809586B2

    公开(公告)日:2023-11-07

    申请号:US17980427

    申请日:2022-11-03

    Applicant: Snowflake Inc.

    CPC classification number: G06F21/6218 G06F16/213 G06F16/24552

    Abstract: A consumer account may invoke an operation referencing a set of shared objects stored within a database of a provider account using an imported database that makes the set of shared objects available within the consumer account. A call context of the operation may be updated to cache the imported database, which references a share created from the provider account database, the share having grants to the set of shared objects. One or more database level objects may be discovered in a context of the share and each role granted to the share may be obtained based on the one or more database level objects. Whether any role granted to the share has access to any of the set of shared objects may be determined and the operation may be executed for each of the set of shared objects to which any role granted to the share has access.

    SHARED OBJECT DISCOVERY TECHNIQUES
    15.
    发明申请

    公开(公告)号:US20230135712A1

    公开(公告)日:2023-05-04

    申请号:US17980427

    申请日:2022-11-03

    Applicant: Snowflake Inc.

    Abstract: A consumer account may invoke an operation referencing a set of shared objects stored within a database of a provider account using an imported database that makes the set of shared objects available within the consumer account. A call context of the operation may be updated to cache the imported database, which references a share created from the provider account database, the share having grants to the set of shared objects. One or more database level objects may be discovered in a context of the share and each role granted to the share may be obtained based on the one or more database level objects. Whether any role granted to the share has access to any of the set of shared objects may be determined and the operation may be executed for each of the set of shared objects to which any role granted to the share has access.

    Database replication to remote deployment with automated fulfillment

    公开(公告)号:US11163797B1

    公开(公告)日:2021-11-02

    申请号:US17302396

    申请日:2021-04-30

    Applicant: Snowflake Inc.

    Abstract: Disclosed herein are systems and methods for database replication to a remote deployment with automated fulfillment. In an embodiment, a data platform provisions a remote-deployment account of a data provider at a remote deployment of the data platform with a set of one or more replication-preparation objects associated with a primary-deployment database that is resident in a primary-deployment account of the data provider at a primary deployment of the data platform. After the provisioning, the data platform detects receipt of a database-replication request associated with a data consumer, requesting availability of a local instance of the primary-deployment database in the remote-deployment account of the data provider. The data platform responsively performs one or more remote-deployment-activation operations, which makes available to the data consumer a local instance of the primary-deployment database in the remote-deployment account of the data provider at the remote deployment of the data platform.

    Managing membership in a private data exchange

    公开(公告)号:US10798100B1

    公开(公告)日:2020-10-06

    申请号:US16746758

    申请日:2020-01-17

    Applicant: Snowflake Inc.

    Abstract: Systems and methods for managing membership in a private data exchange are provided herein. In one embodiment, the method comprises adding a new member to a data exchange, wherein the data exchange comprises a set of listings, each listing comprising data from one or more datasets stored on a cloud computing service. An account type is assigned to the new member, the account type comprising at least one of a consumer type, provider type, or exchange administrator type. Each of the account types associated with one or more rights with respect to the set of listings, such that the new member has a set of rights based on the account type. The set of rights of the new member are then modified with respect to one or more listings from the set of listings based on a set of visibility and access rules for each of the set of listings.

    Events account for native app event sharing

    公开(公告)号:US12250249B2

    公开(公告)日:2025-03-11

    申请号:US18604252

    申请日:2024-03-13

    Applicant: Snowflake Inc.

    Abstract: Embodiments of the present disclosure provide a region-specific events account that is used as a central place to store the events shared by consumers of shared applications in that region. For each of a set of provider accounts in a first region, a global account object corresponding to the provider account is replicated to a second region to establish a replicated global account object in the second region. An account data persistence object (DPO) of a first provider account of the set of provider accounts is modified to designate the first provider account as an events account. The events account is a central location within the second region where execution information generated by execution of applications shared with consumer accounts in the second region is stored. The replicated global account object corresponding to the first provider account is updated to designate the first provider account as the events account.

Patent Agency Ranking