Snowflake Inc.

Rachel Frances Blum

Justin Langseth

Michael Earle Rainey

Christian Kleinerman

William L Stratton, Jr

Joshua James Chacona

William L Stratton Jr

Disclosed herein are methods and systems for secure data comparison using data clean rooms. In an embodiment, a computer system generates a replica database based on a provider database, which stores a cross reference table that cross references a client dataset of a client database and a provider dataset of the provider database. The system receives, at the replica database, a table that is generated by the client database using the cross-reference table. The system transmits, from the replica database, the table to the provider database. The system receives, at the replica database, a results dataset that is generated by the provider database by applying a database statement to the provider database using the table generated by the client database. The system shares, from the replica database, the results dataset with the client database.

Secure data comparison using data clean rooms

Disclosed herein are systems and methods for query processing with restrictions in a database clean room. In an embodiment, a system receives a query directed to a combination of a first source dataset from a first database account of a distributed database and a second source dataset from a second database account of the distributed database. The system generates an approved statements table that contains database statement language that can be executed against the combination of the first and second source datasets. Based on determining that the approved statements table includes the query, the system executes the query to produce results data, and stores the results data in the first database account.

Query processing with restrictions in a database clean room

Embodiments of the present disclosure may provide a data clean room allowing secure data analysis across multiple accounts, without the use of third parties. Each account may be associated with a different company or party. The data clean room may provide security functions to safeguard sensitive information. For example, the data clean room may restrict access to data in other accounts. The data clean room may also restrict which data may be used in the analysis and may restrict the output. The overlap data may be anonymized to prevent sensitive information from being revealed.

Data clean room

Symmetric query processing in a database clean room

Embodiments of the present disclosure may provide a data sharing system implemented as a local application of a distributed database. A query from a query template can be validated and executed against shared dataset that comprises portions of data from the database dataset and additional portions of data from another database of the distributed database.

Data clean room using defined access via native applications

Embodiments of the present disclosure may provide a data clean room architecture that dynamically restricts data included in the clean room. The data clean room architecture can implement row access policy or dynamic data masking for row and column based restrictions of data provided through the clean room. The data clean room architecture can provide a limited set of data that does not require obfuscation of data for direction matching and correlation of data in the different datasets, such as matching user identifiers or emails.

Dynamic data restriction in a database clean room

A method includes generating a defined access clean room in a provider database account, as well as installing, in a consumer account, an application instance that implements the defined access clean room. The method also includes sharing, by the provider database account, source provider data with the defined access clean room, where the sharing makes the source provider data accessible to the consumer database account via the application instance. The method further includes sharing, by the provider database account, a query template with the consumer database account via the application instance. Additionally, the method includes receiving a query generated by the consumer database account based on the query template, validating that the query is consistent with the query template, responsively generating query results by executing the query, as well as storing the query results in the consumer database account.

Query validation and processing in data clean rooms

First and second database accounts respectively share first and second source datasets with one another in a data clean room. The first database account stores a first approved-statements table that contains database statements that are permitted by the first database account to be executed against a combination of the shared first source dataset and the shared second source dataset. The second database account stores a second approved-statements table that contains database statements that are permitted by the second database account to be executed against the combination of the shared first source dataset and the shared second source dataset. One or more queries received from the first database account that are included in the second approved-statements table are processed, as are one or more queries received from the second database account that are included in the first approved-statements table.

A distributed database generates a cross reference table that cross references a first dataset from a first database account and a second dataset from a second database account. The distributed database receives a query directed to a combination of the first and second datasets, and generates an interim table in the first database account by applying the query to the cross reference table and the first dataset. The distributed database generates results data in the second database account by applying the query to the interim table and the second dataset, and stores the results data in the first database account.

Query processing using data clean rooms

Embodiments of the present disclosure may provide a data clean room architecture that restricts data included in the clean room. The data clean room architecture can implement a policy to enable data restrictions for data shared between multiple parties via a distributed database. Multiple database accounts can implement validation instances to validate queries when received from other database accounts. One or more of the database accounts can provide a query template that is congruent with the validation instance for use by the other database accounts to generate queries against the data shared in the data clean room.

Restricted queries in a database clean room

Embodiments of the present disclosure may provide a data clean room allowing secure data analysis across multiple accounts and across different regions and cloud providers. The data clean room may also restrict which data may be used in the analysis and may restrict the output. The overlap data may be anonymized to prevent sensitive information from being revealed. A version of a provider account can be created that is similar to a client account, such as in the same cloud type or the same region as the client database account. The client account can share data that is replicated to the provider account to complete client requests using an anonymized data and the cross reference table.

Growing community of inventors

South Orange, NJ, United States of America

Rachel Frances Blum