US 12,001,581 B2
Query processing in a secure data clean room
Justin Langseth, Kailua, HI (US); and Michael Earle Rainey, Kennewick, WA (US)
Assigned to Snowflake Inc., Bozeman, MT (US)
Filed by Snowflake Inc., Bozeman, MT (US)
Filed on Jan. 31, 2023, as Appl. No. 18/162,705.
Application 18/162,705 is a continuation of application No. 17/390,935, filed on Jul. 31, 2021, granted, now 11,934,553.
Claims priority of provisional application 63/216,966, filed on Jun. 30, 2021.
Prior Publication US 2023/0177203 A1, Jun. 8, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/62 (2013.01); G06F 16/245 (2019.01); G06F 16/25 (2019.01); G06F 16/27 (2019.01); G06F 21/60 (2013.01)
CPC G06F 21/6227 (2013.01) [G06F 16/245 (2019.01); G06F 16/258 (2019.01); G06F 16/27 (2019.01); G06F 21/602 (2013.01)] 30 Claims
OG exemplary drawing
 
1. A method performed by executing instructions on at least one hardware processor, the method comprising:
sharing, by a first database account with a second database account, a secure function configured to accept as input and to process an encrypted dataset and a decryption parameter, the first database account including a first dataset, the second database account including a second dataset;
selecting, by the second database account, one or more rows and one or more columns of the second dataset as a searchable dataset;
generating, by the second database account, an encrypted searchable dataset by encrypting the searchable dataset with a key;
calling, by the second database account, the secure function by inputting the encrypted searchable dataset and the key into the secure function; and
based on the inputted encrypted searchable dataset and the key, generating, by the secure function, query results of a query by performing operations comprising:
generating a decrypted searchable dataset by decrypting the encrypted searchable dataset with the key in a secure environment;
anonymizing the decrypted searchable dataset by generating a cross reference table that cross references the anonymized searchable dataset and the decrypted searchable dataset;
obtaining the query results by executing the query against a combination of the first dataset and the anonymized searchable dataset in the secure environment to generated query-results data, the first dataset separate from the second database account; and
outputting the query results to the second database account.