Snowflake Inc.

Justin Langseth

Matthew J Glickman

Christian Kleinerman

Benoit Dageville

Prasanna V Krishnan

Pui Kei Johnston Chu

Michael Earle Rainey

Rachel Frances Blum

William L Stratton, Jr

Thierry Cruanes

Allison Waingold Lee

Robert Muglia

Daniel Freundel

Marcus A Henderson

Christopher Peter Child

Orestis Kostakis

Monica J Holboke

Stuart Ozer

Joshua James Chacona

Jamie B Pfeiffer, Jr

Embodiments of the present disclosure may provide a data clean room allowing encryption based data analysis across multiple accounts, including different provider database user accounts that provide user data and a network service and a requesting user that generates one or more clean room requests. The data clean room may also restrict which data may be used in the analysis and may restrict the output.

Secure encrypted identifier data sharing

Secure multi-party encrypted identifier data sharing

Sharing data in a data exchange across multiple cloud computing platforms and/or cloud computing platform regions is described. An example computer-implemented method can include creating a listing in a data exchange, the listing including a data set hosted by a first cloud computing entity. The data set can be shared with a second cloud computing entity. The method further includes receiving a request associated with a customer account of the second cloud computing entity to access the data set of the listing hosted by the first cloud computing entity and replicating at least a subset of the data set of the listing from the first cloud computing entity to a provider account at the second cloud computing entity to be accessible by the customer account at the second cloud computing entity.

Creating a global data sharing listing

A request to share cloud data associated with a first account in a database system with an application is received. Based on the request, second-party application data and third-party data that is accessible by the first account is identified. The second-party application data comprises application data corresponding to a second application provided by a second-party application provider. The third-party data corresponds to a second account maintained by the database system. The second account corresponds to a third-party data provider. The application is enabled to access the cloud data associated with the first account based on the request. The cloud data comprises customer data associated with the first account, second-party application data, and the third-party data.

Enabling applications to access cloud data

A method includes performing by at least one hardware processor operations such as configuring at an account of a data consumer, a source table with personally identifiable information (PII) associated with a user. A secure view of the PII is generated based on a view object at the account of the data consumer. The secure view of the PII is shared with an account of a data provider using a share object at the account of the data consumer. The sharing is based on an update of the PII in the source table. A result table is retrieved from the account of the data provider. The result table includes identity resolution information of the user. The identity resolution information is generated based on the update.

Identity resolution and data enrichment framework

Disclosed herein are methods and systems for secure data comparison using data clean rooms. In an embodiment, a computer system generates a replica database based on a provider database, which stores a cross reference table that cross references a client dataset of a client database and a provider dataset of the provider database. The system receives, at the replica database, a table that is generated by the client database using the cross-reference table. The system transmits, from the replica database, the table to the provider database. The system receives, at the replica database, a results dataset that is generated by the provider database by applying a database statement to the provider database using the table generated by the client database. The system shares, from the replica database, the results dataset with the client database.

Secure data comparison using data clean rooms

Disclosed herein are systems and methods for query processing with restrictions in a database clean room. In an embodiment, a system receives a query directed to a combination of a first source dataset from a first database account of a distributed database and a second source dataset from a second database account of the distributed database. The system generates an approved statements table that contains database statement language that can be executed against the combination of the first and second source datasets. Based on determining that the approved statements table includes the query, the system executes the query to produce results data, and stores the results data in the first database account.

Query processing with restrictions in a database clean room

Cloud data sharing for applications

Techniques for identity resolution and data enrichment include instantiating, at an account of a data consumer, an identity resolution application using an installer stored procedure. A data object is configured, at the account of the data consumer, to share log data generated by the identity resolution application with an account of a data provider. The identity resolution application is enabled, at the account of the data consumer, for an identity resolution process using source data based on an instruction originating from the account of the data provider. The instruction is based on the configuring of the data object.

Identity resolution and data enrichment application framework

Embodiments of the present disclosure may provide a data clean room allowing secure data analysis across multiple accounts, without the use of third parties. Each account may be associated with a different company or party. The data clean room may provide security functions to safeguard sensitive information. For example, the data clean room may restrict access to data in other accounts. The data clean room may also restrict which data may be used in the analysis and may restrict the output. The overlap data may be anonymized to prevent sensitive information from being revealed.

Data clean room

Symmetric query processing in a database clean room

Sharing data in a data exchange across multiple cloud computing platforms is described. An example method can include copying, to a first cloud computing entity using a consumer account of the first cloud computing entity, a first subset of a data set associated with a provider account of a second cloud computing entity, wherein the provider account of the second cloud computing entity does not have access to the first cloud computing entity, and then copying, to a third cloud computing entity using a consumer account of the third cloud computing entity, a second subset of the data set, wherein the provider account of the third cloud computing entity does not have access to the first cloud computing entity, for which the first subset of the data set is different from the second subset of the data set.

System and method for global data sharing

Embodiments of the present disclosure may provide a data sharing system implemented as a local application of a distributed database. A query from a query template can be validated and executed against shared dataset that comprises portions of data from the database dataset and additional portions of data from another database of the distributed database.

Data clean room using defined access via native applications

Embodiments of the present disclosure may provide a data clean room architecture that dynamically restricts data included in the clean room. The data clean room architecture can implement row access policy or dynamic data masking for row and column based restrictions of data provided through the clean room. The data clean room architecture can provide a limited set of data that does not require obfuscation of data for direction matching and correlation of data in the different datasets, such as matching user identifiers or emails.

Dynamic data restriction in a database clean room

A method includes creating, by a first provider, a first listing referencing first shared data and comprising first access controls, wherein access to the first shared data by a second provider is filtered based on the first access controls, creating, by the second provider, a second listing referencing second shared data and the first shared data filtered based on the first access controls, and adding the second listing to a catalog in a data exchange, the catalog comprising metadata describing the second shared data.

Growing community of inventors

Kailua, HI, United States of America

Justin Langseth