Secure document sharing in a database system
Provided herein are systems and methods for secure document sharing in a database system. For example, a system includes at least one hardware processor and a memory. The memory stores instructions that cause the at least one hardware processor to perform operations including receiving a query for a data set from a client device. The data set is shared in a data exchange by a data provider. The operations further include retrieving a data file responsive to the query for the data set. A security function is applied to the retrieved data file to generate a modified data file. A scoped uniform resource locator (URL) associated with the modified data file is encoded for transmission to the client device. The scoped URL includes an encrypted hash with a storage location of the modified data file.
1. A system comprising:
at least one hardware processor; and
at least one memory storing instructions that cause the at least one hardware processor to perform operations comprising:
receiving a query for a data set from a client device, the data set shared in a data exchange by a data provider;
retrieving a data file responsive to the query for the data set;
applying a security function to the retrieved data file to generate a modified data file;
encoding a scoped uniform resource locator (URL) associated with the modified data file for transmission to the client device in response to the query, the scoped URL including an encrypted hash with a storage location of the modified data file and a query ID of the received query; and
granting the client device, access to the modified data file at the storage location, based on an activation of the scoped URL and a validation of the client device using the query ID.
2. The system of claim 1 , wherein the data set is shared by the data provider as a listing in the data exchange.
3. The system of claim 1 , wherein the data set is shared with an account of the client device in the data exchange.
4. The system of claim 1 , wherein the data set is one of:
a stage of the data provider; or
a secure view of the data provider.
5. The system of claim 1 , wherein the security function is a user-defined function (UDF) executing on a virtual machine of the data provider.
6. The system of claim 1 , wherein applying the security function comprises:
applying a watermark to the retrieved data file, the watermark including identification information of the client device.
7. The system of claim 1 , wherein applying the security function comprises:
generating a random password;
applying a password lock to the retrieved data file, the password lock based on the random password; and
encoding the random password for communication to the client device.
8. The system of claim 7 , wherein the password lock is a read password lock or an edit password lock.
9. The system of claim 1 , wherein the operations further comprise:
retrieving the data file from a stage of the data provider, the stage comprising an external stage or an internal stage; and
storing the modified data file in the stage.
10. The system of claim 1 , wherein the encrypted hash of the scoped URL further comprises one or more of:
identification information of the client device;
a file path associated with the storage location of the modified data file;
stage information for a stage including the storage location; and
an expiration period of the scoped URL.
11. A method comprising:
receiving at a first execution node of a set of execution nodes, a query for a data set from a client device, the data set shared in a data exchange by a data provider;
retrieving, by one or more processors of the first execution node, a data file responsive to the query for the data set;
applying, by the one or more processors, a security function to the retrieved data file to generate a modified data file;
encoding, by the one or more processors, a scoped uniform resource locator (URL) associated with the modified data file for transmission to the client device in response to the query, the scoped URL including an encrypted hash with a storage location of the modified data file and a query ID of the received query; and
granting the client device, by the one or more processors, access to the modified data file at the storage location, based on an activation of the scoped URL and a validation of the client device using the query ID.
12. The method of claim 11 , wherein the data set is shared by the data provider as a listing in the data exchange, or the data set is shared with an account of the client device in the data exchange.
13. The method of claim 11 , wherein the security function is a user-defined function (UDF) executing on a virtual machine of the data provider, and wherein the data set is one of:
a stage of the data provider; or
a secure view of the data provider.
14. The method of claim 11 , wherein applying the security function comprises:
applying, by the one or more processors, a watermark to the retrieved data file, the watermark including identification information of the client device.
15. The method of claim 11 , wherein applying the security function comprises:
generating, by the one or more processors, a random password;
applying, by the one or more processors, a password lock to the retrieved data file, the password lock based on the random password; and
encoding, by the one or more processors, the random password for communication to the client device.
16. The method of claim 15 , wherein the password lock is a read password lock or an edit password lock.
17. The method of claim 12 , further comprising:
retrieving, by the one or more processors, the data file from a stage of the data provider, the stage comprising an external stage or an internal stage; and
storing, by the one or more processors, the modified data file in the stage.
18. A non-transitory computer-storage medium comprising instructions that, when executed by one or more processors of a machine, configure the machine to perform operations comprising:
receiving a query for a data set from a client device, the data set shared in a data exchange by a data provider;
retrieving a data file responsive to the query for the data set;
applying a security function to the retrieved data file to generate a modified data file;
encoding a scoped uniform resource locator (URL) associated with the modified data file for transmission to the client device in response to the query, the scoped URL including an encrypted hash with a storage location of the modified data file and a query ID of the received query; and
granting the client device, access to the modified data file at the storage location, based on an activation of the scoped URL and a validation of the client device using the query ID.
19. The non-transitory computer-storage medium of claim 18 , wherein the data set is shared by the data provider as a listing in the data exchange, or the data set is shared with an account of the client device in the data exchange.
20. The non-transitory computer-storage medium of claim 18 , wherein the security function is a user-defined function (UDF) executing on a virtual machine of the data provider, and wherein the data set is one of:
a stage of the data provider; or
a secure view of the data provider.
21. The non-transitory computer-storage medium of claim 18 , wherein the operations further comprise:
applying a watermark to the retrieved data file, the watermark including identification information of the client device.
22. The non-transitory computer-storage medium of claim 18 , wherein the operations further comprise:
generating a random password;
applying a password lock to the retrieved data file, the password lock based on the random password; and
encoding the random password for communication to the client device.
23. The non-transitory computer-storage medium of claim 22 , wherein the password lock is a read password lock or an edit password lock.
24. The non-transitory computer-storage medium of claim 19 , wherein the operations further comprise:
retrieving the data file from a stage of the data provider, the stage comprising an external stage or an internal stage; and
storing the modified data file in the stage.