US 11,727,139 B2
Row-level security
Artin Avanes, Palo Alto, CA (US); Khalid Zaman Bijon, Santa Cruz, CA (US); Zheng Mi, Palo Alto, CA (US); Subramanian Muralidhar, Mercer Island, WA (US); David Schultz, Piedmont, CA (US); and Jian Xu, San Jose, CA (US)
Assigned to Snowflake Inc., Bozeman, MT (US)
Filed by Snowflake Inc., Bozeman, MT (US)
Filed on Sep. 29, 2022, as Appl. No. 17/936,681.
Application 17/936,681 is a continuation of application No. 17/661,089, filed on Apr. 28, 2022, granted, now 11,494,513.
Application 17/661,089 is a continuation of application No. 17/083,732, filed on Oct. 29, 2020, granted, now 11,397,826.
Prior Publication US 2023/0022027 A1, Jan. 26, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/62 (2013.01); G06F 21/60 (2013.01); G06F 16/22 (2019.01)
CPC G06F 21/6227 (2013.01) [G06F 16/2282 (2019.01); G06F 21/604 (2013.01); G06F 21/62 (2013.01); G06F 21/6218 (2013.01); G06F 2221/2141 (2013.01)] 21 Claims
OG exemplary drawing
 
1. A method comprising:
receiving, from a user associated with a consumer account, a query relating to a table stored by a provider account in at least one data storage element in a multi-tenant database system and shared by the provider account with an attached provider row level security policy, the provider row level security policy being independent of the table, including a Boolean-valued expression, and restricting at least one row from being accessible by the consumer account, wherein a consumer row level security is also attached to the table;
creating, by a compute service manager, a plan to execute the query, the plan including a set of operators;
determining a role of the user in the consumer account;
modifying, by the compute service manager, the plan based on the provider row level security policy and consumer row level security policy corresponding to the determined role, the modified plan includes arranging a first operator over a second operator to not reveal information restricted by the provider row level security policy;
assigning, by the compute service manager, a plurality of tasks to one or more execution nodes to execute the modified plan; and
generating a result for the query based on execution of the assigned plurality of tasks.