Snowflake Inc.

Microsoft Technology Licensing, LLC

Oracle International Corporation

Other

Subramanian Muralidhar

Benoit Dageville

Thierry Cruanes

Damien Carru

Istvan Cseri

David Schultz

Torsten Walther Grabs

Khalid Zaman Bijon

Shreyas Narendra Desai

Pui Kei Johnston Chu

Di Wu

Sahaj Saini

Artin Avanes

Saurin Shah

Nithin Mahesh

Unmesh Jagtap

Zheng Mi

Nileema Shingte

Eric Robinson

Prasanna V Krishnan

Ganeshan Ramachandran Iyer

Vishnu Dutt Paladugu

Sameer Deshpande

Allison Waingold Lee

Durga Mahesh Arikatla

Raja Suresh Krishna Balakrishnan

Muralidhar Krishnaprasad

Jian J Xu

German Alberto Gil Echeverri

Chieh-Sheng Wang

Shakhina Pulatova

Anil Kumar Nori

Jeremy Yujui Chen

Yujie Li

Robert Bengt Benedikt Gernhardt

Bowen Zhang

Xiaodi Ke

Monica J Holboke

Laxman Mamidi

Polita Paulus

Simon Holm Jensen

Nicola Dan Onose

Vikas Jain

Ryan Michael Thomas Shelly

Brian Smith

Jaeyun Noh

Jiaqi Yan

James G Pan

Qin Yu

Ramachandran Natarajan Iyer

Raghav Ramachandran

Ravi Murthy

William H Waddington

Tyler Jones

Daniel E Sotolongo

John Morgan Oslake

Orestis Kostakis

Bhaskar Ghosh

Pablo Castro

Susan M Kotsovolos

Daniel Mills

Anil Nori

Mikhail Kazhamiaka

Jiaxing Liang

Andrew Conrad

Adiel Yoaz

Jeffrey Robert Currier

Richard Shawn Bice

Sean B House

Srinidhi Karthik Bisthavalli Srinivasa

Narayan Nevrekar

Marianne Shaw

Kenneth Van Hyning

Abdullah Al Mahmood

Nipun Agarwal

Zhen Hua Liu

Lev Novik

Eric Sedlar

Lik Wong

Namit Jain

Sivasankaran Chandrasekar

James William Stamos

Vikas Arora

Thomas Chang

Tyler Arthur Akidau

James W Warner

Michael Pizzo

Jose A Blakeley

Anand Manikutty

Chris A Suver

Visar Nimani

Gabriel Kliot

Yi Fang

Sudarshan Anand Chitre

Michael Justin Flasko

Mahesh Subramaniam

Lin Chan

Sankara J Subramanian

Hitesh Madan

Disclosed is an execution information sharing system that writes execution information to a provider target (and other targets) in a secure manner. Execution information generated by an application may be written to a consumer stage, wherein the application is shared by a provider account of a data exchange with a consumer account that executes the application. A consumer exchange service (ES) of the data exchange may send a request to a copy service of the data exchange to copy the execution information from the consumer stage to the provider stage, wherein the consumer ES is a part of the data exchange and is protected from actions of the consumer account. A copy operation may be executed to copy the execution information from the consumer stage to the provider stage using the copy service of the data exchange. The execution information is ingested from the provider stage to a provider table.

Sharing events and other metrics in native applications

A data platform creates an application in a data-provider account, where the application includes one or more application programming interfaces (APIs) corresponding to one or more underlying code blocks. The data platform shares homomorphically encrypted provider data with the application in the data-provider account. The data platform installs, in a data-consumer account, an application instance of the application. The data platform shares homomorphically encrypted consumer data with the application instance in the data-consumer account. The data platform invokes one or more of the APIs of the application instance to execute respective associated underlying code blocks, which are not visible to the data-consumer account, and which operate on the shared homomorphically encrypted provider data and the shared homomorphically encrypted consumer data. The data platform saves homomorphically encrypted output of the one or more respective associated underlying code blocks locally within the data-consumer account.

Data clean rooms using defined access with homomorphic encryption

Techniques for deduplicating files to be ingested by a database are disclosed. A bloom filter may be built for each of a first set of files to be ingested into a data exchange to generate a set of bloom filters, wherein each of the set of bloom filters is built with a number of hash functions that is based on a desired false positive rate. The set of bloom filters may be stored in the metadata storage of the data exchange. In response to receiving a set of candidate files to be ingested, identifying using the set of bloom filters, candidate files from the set of candidate files that are duplicative of a file in the first set of files and pruning from the set of candidate files, each candidate file identified as being duplicative of a file in the first set of files using the set of bloom filters.

Efficient deduplication of randomized file paths

Systems and methods for an organization-level account for an organization on a data platform, users of which can possess administrative or management privileges with respect to the organization and across one or more others accounts of the organization.

Organization-level account on data platform

An anti-abuse system is provided for a data-platform. An anti-abuse scanner of the data-platform detects a creation of an application package by a provider of content to the data platform where the application package includes a set of files for deployment on the data platform. The anti-abuse scanner performs a review o the set of files to detect malicious content where the review is based on a set of analysis rules and generates a deployment decision for the application package based on a result of the review.

Application trust framework

A process of fulfilling a database deployment request for a data platform. A compute service manager of the data platform scans one or more accounts of a consumer region of the data platform for a pending listing fulfillment request, where the pending listing request includes a request for deployment of a consumer database and an associated share of grant metadata of the consumer database within the consumer region. When the compute service manager determines that an account of the one or more accounts has a pending listing fulfillment request, the compute service manager determines a listing for the pending listing fulfillment request based on listing data of the account. The compute service manager determines that no other fulfillment task is scheduled for the pending listing fulfillment request and schedules a background fulfillment task to perform the fulfillment process for the pending listing fulfillment request.

Background job based refresh fulfillment

Techniques for continuous ingestion of files using custom file formats are described. A custom file format may include formats not natively supported by a data system. Unstructured files (e.g., images) may also be considered custom file formats. A custom file format may be set using a user defined table function and scanner options.

Continuous ingestion of custom file formats

A system for data object replication includes at least one hardware processor and at least one memory storing instructions. The instructions cause the at least one hardware processor to perform operations including parsing a replication request to obtain a data object and identification information identifying a set of databases at a first deployment of a data provider. A dependency of the data object to one or more additional data objects stored in the set of databases is detected. A sequential replication of the data object and the one or more additional data object from the first deployment to a second deployment of the data provider is performed. The second deployment is identified by the replication request. A sequence of the sequential replication is based on the detected dependency.

Data object replication using database identification

Techniques for database replication include a method performed by at least one hardware processor of a resource management node. The method includes detecting a request that a database instance of a database stored at a first network deployment is available at a second network deployment. Responsive to the request, the second network deployment is provisioned with a plurality of data objects. A first data object of the plurality of data objects includes a database shell. The database shell is reconfigured as the database instance of the database based on pushing data of the database into the database shell. Access to the database instance at the second network deployment is authorized based on at least a second data object of the plurality of data objects.

Database replication using a resource management node

Aspects of the present disclosure address systems, methods, and devices for tracking object dependencies in a cloud database system. An object dependency created between a referencing object and a referenced object is detected. Based on detecting the object dependency, a dependency record is generated. The dependency record includes dependency information describing the object dependency between the reference object and the referenced object. The dependency record is stored in a database of dependency records.

Management of object dependency records in a cloud system

A database system facilitates secure data sharing by implementing projection constraints within a query processing framework. Upon receiving a query directed to a shared dataset, the system, utilizing hardware processors, identifies a subset of data within the dataset that is subject to a projection constraint policy. The applicability of the projection constraint is determined based on the context of the query, which is derived from a data sharing agreement. The system processes the query by selectively restricting the projection of data values from constrained columns, while allowing specific operations to be performed on the data. The output generated in response to the query is compliant with the projection constraint policy, providing derived data based on the allowed operations without revealing the actual data values. This ensures the confidentiality of sensitive information while enabling collaborative data analysis and sharing among various users of the database system.

Projection constraint policies in a database system

Embodiments of the present disclosure provide a region-specific events account that is used as a central place to store the events shared by consumers of shared applications in that region. For each of a set of provider accounts in a first region, a global account object corresponding to the provider account is replicated to a second region to establish a replicated global account object in the second region. An account data persistence object (DPO) of a first provider account of the set of provider accounts is modified to designate the first provider account as an events account. The events account is a central location within the second region where execution information generated by execution of applications shared with consumer accounts in the second region is stored. The replicated global account object corresponding to the first provider account is updated to designate the first provider account as the events account.

Events account for native app event sharing

A database system can configure network devices, such as a primary database in a multi-tenant deployment and a secondary database in a private deployment, to send and receive sequence messages, such as input data indicative of a selection of a link. The database system can create a secure share area in the private deployment in response to receiving the input data indicative of the selection of the link. The database system can replicate the data from the multi-tenant deployment to the secure share area in the private deployment and share the replicated data from the secure share area to the secondary database hosted in the private deployment.

Managing database traffic between isolated database systems

In an embodiment, an application is created on a data-provider platform. The application includes one or more application programming interfaces (APIs) corresponding to one or more underlying code blocks. Provider data is shared with the application on the data-provider platform. An application instance of the application is installed in a trusted execution environment (TEE). The application instance includes one or more APIs corresponding to the one or more APIs in the application on the data-provider platform. Consumer data is shared with the application instance from a data-consumer platform. One or more of the APIs of the application instance are invoked to execute, on the TEE, respective associated underlying code blocks that are not visible on the TEE. The output of the one or more respective associated underlying code blocks is saved to the data-consumer platform.

Data clean rooms using defined access in trusted execution environment

A method includes generating at a source account of a database system user, a replication group object (RGO). The RGO includes a manifest identifying one or more data object types and one or more databases. A replication of data objects of the one or more data object types is performed from the one or more databases to a target account of the database system user. The replication of the data objects is performed as a unit. The RGO is replicated as a failover group object (FGO) within the target account of the database system user. A network failure is detected at the source account of the database system user. The target account of the database system user is promoted as a new source account based on the detecting of the network failure.

Failover configuration using replication group objects

Growing community of inventors

Mercer Island, WA, United States of America

Subramanian Muralidhar