Data platform with unified privileges

    公开(公告)号:US12010147B2

    公开(公告)日:2024-06-11

    申请号:US18053956

    申请日:2022-11-09

    Applicant: Snowflake Inc.

    CPC classification number: H04L63/20

    Abstract: A data platform for developing and deploying a user application within a unified security context. The data platform authorizes a first user to use an editor to access source code of a user application based on security policies of a security context and authorizes the first user to use an application and data manager to set usage privileges for a second user to use the user application based on the security policies of the security context. To provide the user application to the second user, the data platform deploys the user application by instantiating a User Defined Function (UDF) server and an application engine of the UDF server within the security context, instantiating the user application as an application of the application engine within the security context, and authorizing access by the user application to databased on the security policies of the security context.

    Secure shared data application access

    公开(公告)号:US11775669B1

    公开(公告)日:2023-10-03

    申请号:US18060476

    申请日:2022-11-30

    Applicant: Snowflake Inc.

    CPC classification number: G06F21/6218 G06F21/629

    Abstract: A data platform for developing and deploying a data application. The data platform receives from a first user the data application and provider granted privileges including a consumer usage privilege and a consumer access to data privilege. The data platform authorizes the second user to access the data platform based on one or more consumer account privileges included in a set of account privileges. The data platform authorizes the second user to execute the data application based on the consumer usage privilege. During execution, the data platform authorizes the data application to access the provider database object based on the consumer access to data privilege, and authorizes the data application to access the consumer database object based on a provider access to data privilege provided by the second user.

    Share object discovery techniques

    公开(公告)号:US11520920B1

    公开(公告)日:2022-12-06

    申请号:US17580341

    申请日:2022-01-20

    Applicant: Snowflake Inc.

    Abstract: Embodiments of the present disclosure provide an enhanced method of discovering shared objects that utilizes share authorization in addition to role authorization when a role is attempting to discover shared objects. A consumer account may invoke an operation referencing shared objects within a provider account using an imported database as a current session database. In response, a call context of the operation may be updated to save the imported database as a current session database and the imported database may be mapped to a first share and to a shared database. A first authorization based on whether the role has access privileges to the shared objects may be performed. The shared database may be used to identify schemas and the schemas may be used to identify shares associated with the imported database. A secondary authorization may be performed based on permissions that the shares associated with the imported database have on the shared objects.

    Shared object discovery techniques
    10.
    发明授权

    公开(公告)号:US11809586B2

    公开(公告)日:2023-11-07

    申请号:US17980427

    申请日:2022-11-03

    Applicant: Snowflake Inc.

    CPC classification number: G06F21/6218 G06F16/213 G06F16/24552

    Abstract: A consumer account may invoke an operation referencing a set of shared objects stored within a database of a provider account using an imported database that makes the set of shared objects available within the consumer account. A call context of the operation may be updated to cache the imported database, which references a share created from the provider account database, the share having grants to the set of shared objects. One or more database level objects may be discovered in a context of the share and each role granted to the share may be obtained based on the one or more database level objects. Whether any role granted to the share has access to any of the set of shared objects may be determined and the operation may be executed for each of the set of shared objects to which any role granted to the share has access.

Patent Agency Ranking