Granted Patent B2

US 12,537,799 · App. 18/582,313 · Granted Jan 27, 2026

Inventors: Robert Bengt Benedikt Gernhardt (Seattle, WA); Mikhail Kazhamiaka (Bellevue, WA); Eric Robinson (Sammamish, WA); Rodney Weaver (Kenmore, WA)

Assignee: Snowflake Inc.

H04L63/0272G06F16/27H04L63/0281H04L63/0435

Abstract

Claims (77)

1 . A method comprising:

encoding, by at least one hardware processor, database data in a first portion of a first data file of a plurality of data files, the encoding of the database data based on a first encryption key;

encoding the first encryption key in a second portion of the first data file, the encoding of the first encryption key based on a second encryption key associated with a second data file of the plurality of data files; and

causing transmission of the plurality of data files from a first database deployment to a second database deployment.

2 . The method of claim 1 , further comprising:

receiving the plurality of data files as a data stream at the first database deployment, wherein the second data file precedes the first data file in the data stream.

3 . The method of claim 2 , further comprising:

decoding the second encryption key using the second data file and a public encryption key, the public encryption key associated with the second database deployment.

4 . The method of claim 3 , further comprising:

causing transmission of the second data file prior to the first data file during the transmission of the plurality of data files from the first database deployment to the second database deployment.

5 . The method of claim 1 , further comprising:

encoding a third encryption key in a third portion of the first data file, the third encryption key associated with a third data file of the plurality of data files.

6 . The method of claim 5 , further comprising:

encoding the third encryption key in the third portion of the first data file using a public encryption key, wherein the public encryption key is common to the first database deployment and the second database deployment.

7 . The method of claim 5 , further comprising:

encoding second database data in the third data file, the encoding of the database data based on a fourth encryption key; and

encoding the fourth encryption key in the third data file, the encoding of the fourth encryption key based on the third encryption key.

8 . The method of claim 1 , wherein the first encryption key is a data encryption key (DEK), the second encryption key is a wrapping replication key (WRK), and the method further comprises:

encoding the DEK using the WRK to generate an encrypted DEK; and

encoding a second WRK associated with a third data file to generate an encoded second WRK, and the encoding of the second WRK using a public key of the second database deployment.

9 . The method of claim 8 , further comprising:

encoding the first data file to include the encrypted DEK, the encoded second WRK, and the public key of the second database deployment before the transmission of the plurality of data files.

10 . The method of claim 1 , further comprising:

periodically regenerating the first encryption key and the second encryption key to generate an updated first encryption key and an updated second encryption key;

encoding a configuration message for transmission to the second database deployment, the configuration message including the updated first encryption key and the updated second encryption key for decoding a subsequent transmission of the data stream.

11 . A system comprising:

one or more processors of a machine; and

at least one memory storing instructions that, when executed by the one or more processors of a first database deployment, cause the machine to perform operations comprising:

encoding database data in a first portion of a first data file of a plurality of data files, the encoding of the database data based on a first encryption key;

encoding the first encryption key in a second portion of the first data file, the encoding of the first encryption key based on a second encryption key associated with a second data file of the plurality of data files; and

causing transmission of the plurality of data files from the first database deployment to a second database deployment.

12 . The system of claim 11 , the operations further comprising:

receiving the plurality of data files as a data stream at the first database deployment, wherein the second data file precedes the first data file in the data stream.

13 . The system of claim 12 , the operations further comprising:

decoding the second encryption key using the second data file and a public encryption key, the public encryption key associated with the second database deployment.

14 . The system of claim 13 , the operations further comprising:

causing transmission of the second data file prior to the first data file during the transmission of the plurality of data files from the first database deployment to the second database deployment.

15 . The system of claim 11 , the operations further comprising:

encoding a third encryption key in a third portion of the first data file, the third encryption key associated with a third data file of the plurality of data files.

16 . The system of claim 15 , the operations further comprising:

encoding the third encryption key in the third portion of the first data file using a public encryption key, wherein the public encryption key is common to the first database deployment and the second database deployment.

17 . The system of claim 15 , the operations further comprising:

encoding second database data in the third data file, the encoding of the database data based on a fourth encryption key; and

encoding the fourth encryption key in the third data file, the encoding of the fourth encryption key based on the third encryption key.

18 . The system of claim 11 , wherein the first encryption key is a data encryption key (DEK), the second encryption key is a wrapping replication key (WRK), and the operations further comprising:

encoding the DEK using the WRK to generate an encrypted DEK; and

encoding a second WRK associated with a third data file to generate an encoded second WRK, and the encoding of the second WRK using a public key of the second database deployment.

19 . The system of claim 18 , the operations further comprising:

encoding the first data file to include the encrypted DEK, the encoded second WRK, and the public key of the second database deployment before the transmission of the plurality of data files.

20 . The system of claim 11 , the operations further comprising:

periodically regenerating the first encryption key and the second encryption key to generate an updated first encryption key and an updated second encryption key;

encoding a configuration message for transmission to the second database deployment, the configuration message including the updated first encryption key and the updated second encryption key for decoding a subsequent transmission of the data stream.

21 . A computer-storage medium embodying instructions that, when executed by a machine of a first database deployment, cause the machine to perform operations comprising:

encoding database data in a first portion of a first data file of a plurality of data files, the encoding of the database data based on a first encryption key;

encoding the first encryption key in a second portion of the first data file, the encoding of the first encryption key based on a second encryption key associated with a second data file of the plurality of data files; and

causing transmission of the plurality of data files from the first database deployment to a second database deployment.

22 . The computer-storage medium of claim 21 , the operations further comprising:

receiving the plurality of data files as a data stream at the first database deployment, wherein the second data file precedes the first data file in the data stream.

23 . The computer-storage medium of claim 22 , the operations further comprising:

decoding the second encryption key using the second data file and a public encryption key, the public encryption key associated with the second database deployment.

24 . The computer-storage medium of claim 23 , the operations further comprising:

causing transmission of the second data file prior to the first data file during the transmission of the plurality of data files from the first database deployment to the second database deployment.

25 . The computer-storage medium of claim 21 , the operations further comprising:

encoding a third encryption key in a third portion of the first data file, the third encryption key associated with a third data file of the plurality of data files.

26 . The computer-storage medium of claim 25 , the operations further comprising:

encoding the third encryption key in the third portion of the first data file using a public encryption key, wherein the public encryption key is common to the first database deployment and the second database deployment.

27 . The computer-storage medium of claim 25 , the operations further comprising:

encoding second database data in the third data file, the encoding of the database data based on a fourth encryption key; and

encoding the fourth encryption key in the third data file, the encoding of the fourth encryption key based on the third encryption key.

28 . The computer-storage medium of claim 21 , wherein the first encryption key is a data encryption key (DEK), the second encryption key is a wrapping replication key (WRK), and the operations further comprising:

encoding the DEK using the WRK to generate an encrypted DEK; and

encoding a second WRK associated with a third data file to generate an encoded second WRK, and the encoding of the second WRK using a public key of the second database deployment.

29 . The computer-storage medium of claim 28 , the operations further comprising:

encoding the first data file to include the encrypted DEK, the encoded second WRK, and the public key of the second database deployment before the transmission of the plurality of data files.

30 . The computer-storage medium of claim 21 , the operations further comprising:

periodically regenerating the first encryption key and the second encryption key to generate an updated first encryption key and an updated second encryption key;

encoding a configuration message for transmission to the second database deployment, the configuration message including the updated first encryption key and the updated second encryption key for decoding a subsequent transmission of the data stream.

Assignments (1)

Continuity (9)

References Cited (109)