Secure data sharing in a multi-tenant database system

1. A method of providing secure views for shared data in a multi-tenant database, the method comprising:

generating a share object in a first account, the share object comprising a share role;

associating view privileges of a secure view with one or more of a plurality of underlying details of the share object such that each of the one or more underlying details of the share object comprises a secure view definition;

granting, to a second account, cross-account access rights to the share object in the first account;

receiving a request from the second account to access data or services of the first account; and

in response to receiving the request, modifying a query plan of the request to ensure that all security-related filtering occurs before any expression evaluation outside of the secure view, wherein the one or more underlying details of the share object comprising the definition of the secure view are hidden from the second account and visible to the first account.

2. The method of claim 1 , wherein an underlying detail of the share object comprises one or more of:

a data field of an underlying table of the share object;

a structural element of an underlying table of the share object; or

a quantity of data in an underlying table of the share object.

3. The method of claim 1 , wherein the share object comprises:

an object name unique to the first account;

an object role; and

a reference list comprising a list of one or more second accounts that are eligible to access the share object.

4. The method of claim 1 , wherein associating view privileges of the secure view with the one or more underlying details of the share object comprises one or more of:

altering a table data persistence object of an underlying table of the share object; and

attaching a secure flag to an underlying data field of the share object, wherein the secure flag indicates that the underlying data field of the share object is protected by a secure view.

5. The method of claim 1 , further comprising annotating the request from the second account to designate the request as coming from a secure view.

6. The method of claim 5 , further comprising restricting the request from the second account from being merged with an external query block or expression.

7. The method of claim 1 , further comprising annotating the request from the second account with a safety property indicating whether the request is safe.

8. The method of claim 7 , wherein the request is safe if:

the request is known to produce no errors; and

the request does not comprise a user-defined function.

9. The method of claim 1 , further comprising:

generating within the second account, an alias object that references the share object; and

linking the alias object to a top-most object in a shared object hierarchy, wherein the request is directed to the alias object.

10. The method of claim 9 , further comprising granting the alias object usage privileges on the share role within the share object.

11. A non-transitory computer readable storage media storing instructions that, when executed by one or more processors, cause the one or more processors to:

generate a share object in a first account, the share object comprising a share role;

associate view privileges of a secure view with one or more of a plurality of underlying details of the share object such that each of the one or more underlying details of the share object comprises a definition of the secure view;

grant, to a second account, cross-account access rights to the share object in the first account;

receive a request from the second account to access data or services of the first account; and

in response to receiving the request, modify a query plan of the request to ensure that all security-related filtering occurs before any expression evaluation outside of the secure view, wherein the one or more underlying details of the share object comprising the secure view definition are hidden from the second account and visible to the first account.

12. The non-transitory computer readable storage media of claim 11 , wherein the underlying detail of the share object comprises one or more of:

a data field of an underlying table of the share object;

a structural element of an underlying table of the share object; or

a quantity of data in an underlying table of the share object.

13. The non-transitory computer readable storage media of claim 11 , wherein the one or more processors are further to store a list of objects for which the share role has access rights.

14. The non-transitory computer readable storage media of claim 11 , wherein to grant the cross-account access rights, the one or more processors are to store an indication of the second account in a reference list of accounts that have rights to the share role or share object in the first account.

15. The non-transitory computer readable storage media of claim 11 , wherein the one or more processors are further to:

generate within the second account, an alias object that references the share object;

link the alias object to a top most object in a shared object hierarchy, wherein the request is directed to the alias object.

16. The non-transitory computer readable storage media of claim 11 , wherein the one or more processors process the request without duplicating any of the plurality of underlying details in the second account.

17. The non-transitory computer readable storage media of claim 11 , wherein the share object comprises:

an object name unique to the first account;

an object role; and

a reference list comprising a list of one or more second accounts that are eligible to access the share object.

18. The non-transitory computer readable storage media of claim 11 , wherein to associate view privileges of the secure view to an underlying detail of the share object, the one or more processors are to perform one or more of:

alter a table data persistence object of an underlying table of the share object; and

attach a secure flag to an underlying data field of the share object, wherein the secure flag indicates that the underlying data field should be protected by a secure view.

19. The non-transitory computer readable storage media of claim 11 , wherein the one or more processors are further to annotate the request from the second account to designate the request as coming from a secure view.

20. The non-transitory computer readable storage media of claim 19 , wherein the one or more processors are further to restrict the request from the second account from being merged with an external query block or expression.

21. The non-transitory computer readable storage media of claim 11 , wherein the one or more processors are further to annotate the request from the second account with a safety property indicating whether the request is safe, and wherein the request is safe if:

the request is known to produce no errors; and

the request does not comprise a user-defined function.