IP Library › Granted Patent US 11,372,995
Granted Patent B2
US 11,372,995 · App. 16/745,922 · Granted Jun 28, 2022

Container-centric access control on database objects

Inventors: Artin Avanes (Palo Alto, CA); Khalid Zaman Bijon (Santa Cruz, CA); Peter Povinec (Redwood City, CA)
Assignee: Snowflake Inc.
G06F21/6218G06F16/27
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,372,995
App. No.
16/745,922
Granted
Jun 28, 2022
Kind
B2
Abstract

Using container-centric managed access, an administrator is enabled to define a set of future grants for each object that will be created in the future in a container managed by the administrator. When a user creates a database object, the system checks the future grants to determine if any apply to the user, the database object, or the combination. Any applicable future grants are applied to the database object before the user is allowed to modify it. As a result, the administrator is enabled to control the privileges associated with the database object even before the database object is created, while restricting individual object owners from managing privileges on their owned objects.

Claims (50)

1. A system comprising:

one or more processors; and

a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, from a first user account, grant table data of a grant table specifying a set of privileges for a view object type of a database, the set of privileges in the grant table data specifying actions that can be performed by one or more user accounts on future database objects of the view object type, the first user account being associated with a grant privilege to grant privileges on database objects in a first schema of the database, and not being associated with a different grant privilege to grant privileges on database objects in a second schema of the database;

receiving, from a second user account, a create request to create a new view object in the database;

accessing the grant table to identify the second user account and privileges associated with the second user account;

creating the new view object in the database according to the privileges associated with the second user account, the new view object being created from the second user account after the grant table is stored, the new view object being in the first schema of the database; and

based on the set of privileges in the grant table, rejecting a modify request from the second user account to modify the new view object.

2. The system of claim 1 , wherein the grant table data received from the first user account comprises: an identifier of the second user account.

3. The system of claim 1 , wherein the set of privileges associated with the second user account are associated with a user role type of the second user account.

4. The system of claim 1 , wherein the set of privileges comprises an access right to database objects of the view object type that are managed by the first user account.

5. The system of claim 1 , wherein the set of privileges prohibits transfer of ownership of database objects of the view object type from the first user account.

6. The system of claim 1 , wherein the operations further comprise:

accessing a request to clone a first database schema that comprises the new view object; and

in response to the request, creating a second database schema that comprises a copy of the new view object without the set of privileges.

7. The system of claim 1 , wherein the operations further comprise:

accessing a request to clone a first database schema that comprises the new view object; and

in response to the request, creating a second database schema that comprises a copy of the new view object with the set of privileges.

8. A method comprising:

receiving, by a central server that comprises one or more processors, from a first user account, grant table data of a grant table specifying a set of privileges for a view object type of a database, the set of privileges in the grant table data specifying actions that can be performed by one or more user accounts on future database objects of the view object type, the first user account being associated with a grant privilege to grant privileges on database objects in a first schema of the database, and not being associated with a different grant privilege to grant privileges on database objects in a second schema of the database;

receiving, from a second user account, a create request to create a new view object in the database, the new view object being of the view object type specified in the grant table;

accessing, by the central server, the grant table to identify the second user account and privileges associated with the second user account;

creating the new view object in the database according to the privileges associated with the second user account, the new view object being created from the second user account after the grant table is stored, the new view object being in the first schema of the database; and

based on the set of privileges in the grant table, rejecting a modify request from the second user account to modify the new view object.

9. The method of claim 8 , wherein the grant table data received from the first user account comprises: an identifier of the second user account.

10. The method of claim 8 , wherein the set of privileges associated with the second user account are associated with a user role type of the second user account.

11. The method of claim 8 , wherein the set of privileges comprises an access right to database objects of the view object type that are managed by the first user account.

12. The method of claim 8 , wherein the set of privileges prohibits transfer of ownership of database objects of the view object type from the first user account.

13. The method of claim 8 , further comprising:

accessing a request to clone a first database schema that comprises the new view object; and

in response to the request, creating a second database schema that comprises a copy of the new view object without the set of privileges.

14. The method of claim 8 , further comprising:

accessing a request to clone a first database schema that comprises the new view object; and

in response to the request, creating a second database schema that comprises a copy of the new view object with the set of privileges.

15. A machine-readable storage device storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

receiving, from a first user account, grant table data of a grant table specifying a set of privileges for a view object type of a database, the set of privileges in the grant table data specifying actions that can be performed by one or more user accounts on future database objects of the view object type, the first user account being associated with a grant privilege to grant privileges on database objects in a first schema of the database, and not being associated with a different grant privilege to grant privileges on database objects in a second schema of the database;

receiving, from a second user account, a create request to create a new view object in the database, the new view object being of the view object type specified in the grant table;

accessing the grant table to identify the second user account and privileges associated with the second user account;

creating the new view object in the database according to the privileges associated with the second user account, the new view object being created from the second user account after the grant table is stored, the new view object being in the first schema of the database; and

based on the set of privileges in the grant table, rejecting a modify request from the second user account to modify the new view object.

16. The storage device of claim 15 , wherein the grant table data received from the first user account comprises: an identifier of the second user account.

17. The storage device of claim 15 , wherein the set of privileges associated with the second user account are associated with a user role type of the second user account.

18. The storage device of claim 15 , wherein the set of privileges comprises an access right to database objects of the view object type that are managed by the first user account.

19. The storage device of claim 15 , wherein the set of privileges prohibits transfer of ownership of database objects of the view object type from the first user account.

20. The storage device of claim 15 , wherein the operations further comprise:

accessing a request to clone a first database schema that comprises the new view object; and

in response to the request, creating a second database schema that comprises a copy of the new view object without the set of privileges.

21. The storage device of claim 15 , wherein the operations further comprise:

accessing a request to clone a first database schema that comprises the new view object; and

in response to the request, creating a second database schema that comprises a copy of the new view object with the set of privileges.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 17, 2020
From: AVANES, ARTIN; BIJON, KHALID ZAMAN; POVINEC, PETER
To: SNOWFLAKE INC.
Reel/Frame 051546/0597 →
Continuity (1)
Related Publication 20210224409A1 · Jul 22, 2021