US 11,736,438 B2
Secure message exchange between deployments
Robert Bengt Benedikt Gernhardt, Seattle, WA (US); Mikhail Kazhamiaka, Bellevue, WA (US); Nithin Mahesh, Redmond, WA (US); and Eric Robinson, Sammamish, WA (US)
Assigned to Snowflake Inc., Bozeman, MT (US)
Filed by Snowflake Inc., Bozeman, MT (US)
Filed on Jan. 22, 2021, as Appl. No. 17/156,072.
Application 17/156,072 is a continuation of application No. 16/809,209, filed on Mar. 4, 2020, granted, now 10,938,780.
Prior Publication US 2021/0281544 A1, Sep. 9, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01)
CPC H04L 63/0218 (2013.01) [H04L 63/0236 (2013.01); H04L 63/0245 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A method, comprising:
receiving, by one or more processors of a first deployment, a message from a first computing device in the first deployment to be transmitted to a recipient in a second deployment, the first and second deployments being different types of deployments, wherein the first deployment is a private data-system deployment where processing and storage resources are dedicated to a single tenant and the second deployment is public data-system deployment where processing and storage resources are shared by multiple tenants;
detecting a message type of the message using a filter based on an outbound rule set defined for the second deployment, the message type defining a data operation to be performed on stored data associated with the first deployments;
based on the detected message type belonging to a first set of message types, blocking transmission of the message to the second deployment;
based on the detected message type belonging to a second set of message types, proceeding in transmitting the message from the first deployment to the second deployment, the second deployment being configured to execute the data operation on the stored data associated with the first deployment in response to receiving the message;
detecting that the second deployment has been compromised; and
based on detecting that the second deployment has been compromised, blocking transmission of the message to the second deployment.