Granted Patent B2

US 12,568,090 · App. 18/160,801 · Granted Mar 3, 2026

Inventors: Damien Carru (Rhinebeck, NY); Jeremy Yujui Chen (Newark, CA); Laxman Mamidi (Redwood City, CA); Bowen Zhang (Newark, CA)

Assignee: Snowflake Inc.

H04L63/105G06F21/6218

Abstract

Claims (98)

1 . A method performed by a database system executing instructions on at

least one hardware processor, the method comprising:

receiving a first database-mounting request from a data-consumer account;

establishing, in the data-consumer account in response to receiving the first database mounting request, a first mounted database that resides in the data-consumer account of the database system, the first mounted database being a shadow database comprising references to table data stored in a provider-side database in a data-provider account;

receiving a database-role-grant request to grant a provider-side database-level role to a consumer-side account-level role in the data-consumer account for the first mounted database, the provider-side database-level role having one or more database-level-role privileges, the database level-role privileges comprising at least one of: read access, write access, visibility access, usage access, or administrative access;

performing, responsive to receiving the database-role-grant request, a set of database-role granting operations comprising granting a first hidden provider-side database-level role to a hidden consumer-side account-level role in the data-consumer account for the first mounted database without granting the first hidden provider-side database-level role to the consumer-side account level role, the hidden consumer-side database-level role enabling the data-consumer account to perform one or more functions on a particular set of data with the role being hidden from the data consumer account, the hidden provider-side database-level role being hidden from the data-provider account;

receiving a second database-mounting request from the data-consumer account;

establishing, in the data-consumer account in response to receiving the second database mounting request, a second mounted database, the first and second mounted databases being shadow databases storing reference pointers to data stored in a provider-side database;

receiving a database-role-grant request to grant a provider-side database-level role to a consumer-side account-level role in the data-consumer account for the second mounted database;

granting a second hidden consumer-side database-level role to the consumer-side account level role in the data-consumer account for the second mounted database;

receiving a request to demount the first mounted database; and

in response to receiving the request to demount the first mounted database, revoking a first hidden consumer-side database-level role without revoking the second hidden consumer-side database-level role leaving the second mounted database mounted on the data-consumer account.

2 . The method of claim 1 , wherein:

the provider-side database comprises a table; and

the one or more database-level-role privileges comprise access to the table.

3 . The method of claim 1 , wherein the set of database-role-granting operations further comprises:

creating a hidden provider-side database-level role in a data-provider account;

granting the provider-side database-level role to the hidden provider-side database-level role; and

creating the first hidden consumer-side database-level role in the data-consumer account.

4 . The method of claim 3 , further comprising:

receiving a database-mounting request from the data-consumer account; and

establishing, in the data-consumer account in response to receiving the database-mounting request, a mounted database corresponding to the provider-side database,

wherein the first hidden consumer-side database-level role is created in the mounted database in the data-consumer account.

5 . The method of claim 4 , wherein the mounted database in the data-consumer account corresponding to the provider-side database comprises the mounted database being a shadow database of references to table data stored in the provider-side database in the data-provider account.

6 . The method of claim 4 , further comprising:

establishing, in the data-consumer account, a second mounted database corresponding to the provider-side database;

receiving a second database-role-grant request to grant the provider-side database-level role to the consumer-side account-level role in the data-consumer account in connection with the second mounted database;

performing, responsive to receiving the second database-role-grant request, a second set of database-role-granting operations comprising:

creating, in the second mounted database, a second hidden consumer-side database-level role;

granting the hidden provider-side database-level role to the second hidden consumer-side database-level role; and

granting the second hidden consumer-side database-level role to the consumer-side account-level role in the data-consumer account in connection with the second mounted database.

7 . The method of claim 1 , wherein receiving the database-role-grant request comprises receiving the database-role-grant request from the data-consumer account.

8 . The method of claim 1 , further comprising receiving a second database-role-grant request to grant the provider-side database-level role to a second consumer-side account-level role in the data-consumer account, and responsively granting the first hidden consumer-side database-level role to the second consumer-side account-level role in the data-consumer account.

9 . The method of claim 3 , further comprising:

receiving a database-role-revoke request to revoke the provider-side database-level role from the consumer-side account-level role; and

revoking, responsive to receiving the database-role-revoke request, the hidden provider-side database-level role from the first hidden consumer-side database-level role.

10 . The method of claim 1 , wherein granting the first hidden provider-side database-level role to the hidden consumer-side account-level role in the data-consumer account for the first mounted database without granting the first hidden provider-side database-level role to the consumer-side account-level role comprises granting privileges of the first hidden provider-side database-level role to the hidden consumer-side account-level role while the consumer-side account-level role itself being hidden from the data-consumer account.

11 . The method of claim 1 , wherein granting the first hidden provider-side database-level role to the hidden consumer-side account-level role in the data-consumer account for the first mounted database without granting the first hidden provider-side database-level role to the consumer-side account-level role comprises granting privileges of the first hidden provider-side database-level role to the hidden consumer-side account-level role without granting at least some privileges of an unhidden provider-side database-level role to the consumer-side account-level role while the consumer-side account-level role itself being hidden from the data-consumer account.

12 . The method of claim 1 , wherein the hidden consumer-side database- level role enabling visibility of the particular set of data to the data-consumer account while the role being hidden from the data-consumer account.

13 . A database system comprising:

at least one hardware processor; and

one or more non-transitory computer readable storage media containing instructions that, when executed by the at least one hardware processor, cause the at least one hardware processor to perform operations comprising:

receiving a first database-mounting request from a data-consumer account;

establishing, in the data-consumer account in response to receiving the first database mounting request, a first mounted database that resides in the data-consumer account of the database system, the first mounted database being a shadow database comprising references to table data stored in a provider-side database in a data-provider account;

receiving a database-role-grant request to grant a provider-side database-level role to a consumer-side account-level role in the data-consumer account for the first mounted database, the provider-side database-level role having one or more database-level-role privileges, the database level-role privileges comprising at least one of: read access, write access, visibility access, usage access, or administrative access;

performing, responsive to receiving the database-role-grant request, a set of database-role granting

operations comprising granting a first hidden provider-side database-level role to a hidden consumer-side account-level role in the data-consumer account for the first mounted database without granting the first hidden provider-side database-level role to the consumer-side account level role, the hidden consumer-side database-level role enabling the data-consumer account to perform one or more functions on a particular set of data with the role being hidden from the data consumer account, the hidden provider-side database-level role being hidden from the data-provider account;

receiving a second database-mounting request from the data-consumer account;

establishing, in the data-consumer account in response to receiving the second database mounting request, a second mounted database, the first and second mounted databases being shadow databases storing reference pointers to data stored in a provider-side database;

receiving a database-role-grant request to grant a provider-side database-level role to a consumer-side account-level role in the data-consumer account for the second mounted database;

granting a second hidden consumer-side database-level role to the consumer-side account level role in the data-consumer account for the second mounted database;

receiving a request to demount the first mounted database; and

in response to receiving the request to demount the first mounted database, revoking a first hidden consumer-side database-level role without revoking the second hidden consumer-side database-level role leaving the second mounted database mounted on the data-consumer account.

14 . The database system of claim 13 , wherein:

the provider-side database comprises a table; and

the one or more database-level-role privileges comprise access to the table.

15 . The database system of claim 13 , wherein the set of database-role- granting operations further comprises:

creating a hidden provider-side database-level role in a data-provider account;

granting the provider-side database-level role to the hidden provider-side database-level role; and

creating the first hidden consumer-side database-level role in the data-consumer account.

16 . The database system of claim 15 , the operations further comprising:

receiving a database-mounting request from the data-consumer account; and

establishing, in the data-consumer account in response to receiving the database-mounting request, a mounted database corresponding to the provider-side database,

wherein the first hidden consumer-side database-level role is created in the mounted database in the data-consumer account.

17 . The database system of claim 16 , wherein the mounted database in the data-consumer account corresponding to the provider-side database comprises the mounted database being a shadow database of references to table data stored in the provider-side database in the data-provider account.

18 . The database system of claim 16 , the operations further comprising:

establishing, in the data-consumer account, a second mounted database corresponding to the provider-side database;

receiving a second database-role-grant request to grant the provider-side database-level role to the consumer-side account-level role in the data-consumer account in connection with the second mounted database;

performing, responsive to receiving the second database-role-grant request, a second set of database-role-granting operations comprising:

creating, in the second mounted database, a second hidden consumer-side database-level role;

granting the hidden provider-side database-level role to the second hidden consumer-side database-level role; and

granting the second hidden consumer-side database-level role to the consumer-side account-level role in the data-consumer account in connection with the second mounted database.

19 . The database system of claim 13 , wherein receiving the database-role-grant request comprises receiving the database-role-grant request from the data-consumer account.

20 . The database system of claim 13 , the operations further comprising receiving a second database-role-grant request to grant the provider-side database-level role to a second consumer-side account-level role in the data-consumer account, and responsively granting the first hidden consumer-side database-level role to the second consumer-side account-level role in the data-consumer account.

21 . The database system of claim 15 , the operations further comprising:

receiving a database-role-revoke request to revoke the provider-side database-level role from the consumer-side account-level role; and

revoking, responsive to receiving the database-role-revoke request, the hidden provider-side database-level role from the first hidden consumer-side database-level role.

22 . One or more non-transitory computer readable storage media containing instructions that, when executed by at least one hardware processor of a database system, cause the database system to perform operations comprising:

receiving a first database-mounting request from a data-consumer account;

establishing, in the data-consumer account in response to receiving the first database mounting request, a first mounted database that resides in the data-consumer account of the database system, the first mounted database being a shadow database comprising references to table data stored in a provider-side database in a data-provider account;

receiving a database-role-grant request to grant a provider-side database-level role to a consumer-side account-level role in the data-consumer account for the first mounted database, the provider-side database-level role having one or more database-level-role privileges, the database level-role privileges comprising at least one of: read access, write access, visibility access, usage access, or administrative access;

performing, responsive to receiving the database-role-grant request, a set of database-role granting operations comprising granting a first hidden provider-side database-level role to a hidden consumer-side account-level role in the data-consumer account for the first mounted database without granting the first hidden provider-side database-level role to the consumer-side account level role, the hidden consumer-side database-level role enabling the data-consumer account to perform one or more functions on a particular set of data with the role being hidden from the data consumer account, the hidden provider-side database-level role being hidden from a data-provider account;

receiving a second database-mounting request from the data-consumer account;

establishing, in the data-consumer account in response to receiving the second database mounting request, a second mounted database, the first and second mounted databases being shadow databases storing reference pointers to data stored in a provider-side database;

receiving a database-role-grant request to grant a provider-side database-level role to a consumer-side account-level role in the data-consumer account for the second mounted database;

granting a second hidden consumer-side database-level role to the consumer-side account level role in the data-consumer account for the second mounted database;

receiving a request to demount the first mounted database; and

in response to receiving the request to demount the first mounted database, revoking a first hidden consumer-side database-level role without revoking the second hidden consumer-side database-level role leaving the second mounted database mounted on the data-consumer account.

23 . The one or more non-transitory computer readable storage media of claim 22 , wherein:

the provider-side database comprises a table; and

the one or more database-level-role privileges comprise access to the table.

24 . The one or more non-transitory computer readable storage media of claim 22 , wherein the set of database-role-granting operations further comprises:

creating a hidden provider-side database-level role in a data-provider account;

granting the provider-side database-level role to the hidden provider-side database-level role; and

creating the first hidden consumer-side database-level role in the data-consumer account.

25 . The one or more non-transitory computer readable storage media of claim 24 , the operations further comprising:

receiving a database-mounting request from the data-consumer account; and

establishing, in the data-consumer account in response to receiving the database-mounting request, a mounted database corresponding to the provider-side database, wherein the first hidden consumer-side database-level role is created in the mounted database in the data-consumer account.

Assignments (1)

Continuity (1)

References Cited (61)