US 12,135,815 B2
Row-level security
Artin Avanes, Palo Alto, CA (US); Khalid Zaman Bijon, Santa Cruz, CA (US); Zheng Mi, Palo Alto, CA (US); Subramanian Muralidhar, Mercer Island, WA (US); David Schultz, Piedmont, CA (US); and Jian Xu, San Jose, CA (US)
Assigned to Snowflake Inc., Bozeman, MT (US)
Filed by Snowflake Inc., Bozeman, MT (US)
Filed on Nov. 28, 2023, as Appl. No. 18/521,589.
Application 18/521,589 is a continuation of application No. 18/341,935, filed on Jun. 27, 2023, granted, now 11,868,502.
Application 18/341,935 is a continuation of application No. 17/936,681, filed on Sep. 29, 2022, granted, now 11,727,139.
Application 17/936,681 is a continuation of application No. 17/661,089, filed on Apr. 28, 2022, granted, now 11,494,513.
Application 17/661,089 is a continuation of application No. 17/083,732, filed on Oct. 29, 2020, granted, now 11,397,826.
Prior Publication US 2024/0095393 A1, Mar. 21, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/62 (2013.01); G06F 16/22 (2019.01); G06F 21/60 (2013.01)
CPC G06F 21/6227 (2013.01) [G06F 16/2282 (2019.01); G06F 21/604 (2013.01); G06F 21/62 (2013.01); G06F 21/6218 (2013.01); G06F 2221/2141 (2013.01)] 21 Claims
OG exemplary drawing
 
1. A method comprising:
storing a table in a first account of a multi-tenant network-based data system, the table having a first row level security policy attached, the table and the first row level security policy being stored independently;
sharing, by the first account, the table with the attached first row level security policy with a second account in the multi-tenant network-based data system, the first row level security policy limiting at least one row from being accessible to the second account;
attaching a second row level security policy to the shared table by the second account, the second row level security policy being stored independently of the table;
receiving a query relating to the table;
generating, by at least one server of the network-based data system, a plan to execute the query, the plan including a set of operators and arranging a first operator over a second operator of the set of operators to not reveal information restricted by the first row level security policy or the second row level security policy; and
executing, by one or more execution nodes assigned by the at least one server, the plan to generate a result for the query.