Granted Patent B2

US 12,562,898 · App. 18/508,865 · Granted Feb 24, 2026

Inventors: Maynard Daniels Bryant, Jr. (Roswell, GA); James Pan (Oakville, CA)

Assignee: Snowflake Inc.

H04L9/088G06F8/61H04L9/30

Abstract

Claims (53)

1 . A method comprising:

providing, from a provider account in a multi-tenant database system, an application package to a consumer account, the application package including provider key information;

installing, by at least one hardware processor, a consumer application in the consumer account based on the application package;

registering the consumer account in the provider account using an onboard service user and the provider key information;

registering a unique consumer service user corresponding to the consumer account in the application package stored in the provider account;

generating, by the consumer application, a consumer-specific private key and a consumer-specific public key:

encrypting, by the consumer application, the execution request using the consumer-specific private key and a username for the unique consumer service user;

transmitting, from the consumer application, to the provider account an the execution request using a direct application programming interface (API); and

executing the execution request in the provider account using the unique consumer service user.

2 . The method of claim 1 , further comprising:

transmitting, by the consumer application, to the provider account the consumer-specific public key; and

registering the unique consumer service user with the consumer-specific public key.

3 . The method of claim 1 , further comprising:

authenticating, by the provider account, the unique consumer service user based on the consumer-specific public key.

4 . The method of claim 3 , wherein the consumer-specific private key is inaccessible to the consumer account outside of the consumer application.

5 . The method of claim 4 , wherein the consumer-specific private key is inaccessible to the provider account.

6 . The method of claim 4 , wherein the consumer-specific private key is stored in a local storage associated with the consumer account.

7 . A machine-storage medium embodying instructions that, when executed by a machine, cause the machine to perform operations comprising:

providing, from a provider account in a multi-tenant database system, an application package to a consumer account, the application package including provider key information;

installing a consumer application in the consumer account based on the application package;

registering the consumer account in the provider account using an onboard service user and the provider key information;

registering a unique consumer service user corresponding to the consumer account in the application package stored in the provider account;

generating, by the consumer application, a consumer-specific private key and a consumer-specific public key;

encrypting, by the consumer application, the execution request using the consumer-specific private key and a username for the unique consumer service user;

transmitting, from the consumer application, to the provider account an the execution request using a direct application programming interface (API); and

executing the execution request in the provider account using the unique consumer service user.

8 . The machine-storage medium of claim 7 , further comprising:

transmitting, by the consumer application, to the provider account the consumer-specific public key; and

registering the unique consumer service user with the consumer-specific public key.

9 . The machine-storage medium of claim 7 , further comprising:

authenticating, by the provider account, the unique consumer service user based on the consumer-specific public key.

10 . The machine-storage medium of claim 9 , wherein the consumer-specific private key is inaccessible to the consumer account outside of the consumer application.

11 . The machine-storage medium of claim 10 , wherein the consumer-specific private key is inaccessible to the provider account.

12 . The machine-storage medium of claim 10 , wherein the consumer-specific private key is stored in a local storage associated with the consumer account.

13 . A system comprising:

at least one hardware processor; and

at least one memory storing instructions that, when executed by the at least one hardware processor, cause the at least one hardware processor to perform operations comprising:

providing, from a provider account in a multi-tenant database system, an application package to a consumer account, the application package including provider key information;

installing a consumer application in the consumer account based on the application package;

registering the consumer account in the provider account using an onboard service user and the provider key information;

registering a unique consumer service user corresponding to the consumer account in the application package stored in the provider account;

generating, by the consumer application, a consumer-specific private key and a consumer-specific public key;

encrypting, by the consumer application, the execution request using the consumer-specific private key and a username for the unique consumer service user;

transmitting, from the consumer application, to the provider account an the execution request using a direct application programming interface (API); and

executing the execution request in the provider account using the unique consumer service user.

14 . The system of claim 13 , the operations further comprising:

transmitting, by the consumer application, to the provider account the consumer-specific public key; and

registering the unique consumer service user with the consumer-specific public key.

15 . The system of claim 13 , the operations further comprising:

authenticating, by the provider account, the unique consumer service user based on the consumer-specific public key.

16 . The system of claim 15 , wherein the consumer-specific private key is inaccessible to the consumer account outside of the consumer application.

17 . The system of claim 16 , wherein the consumer-specific private key is inaccessible to the provider account.

18 . The system of claim 16 , wherein the consumer-specific private key is stored in a local storage associated with the consumer account.

Assignments (1)

Continuity (1)

References Cited (27)