Data exchange

• US 10,642,856 B1
• Filed: 11/14/2019
• Issued: 05/05/2020
• Est. Priority Date: 05/31/2019
• Status: Active Grant

• Current Assignee: Snowflake, Inc.
• Original Assignee: Snowflake, Inc.
• Inventors: Chu, Pui Kei Johnston, Dageville, Benoit, Glickman, Matthew J., Kleinerman, Christian, Krishnan, Prasanna, Langseth, Justin
• Primary Examiner(s): Lee, Wilson
• Application Number:
  US16/684,355
• Time in Patent Office: 173 Days
• Field of Search: None
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 16/2456 Join operations
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/254 Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

A data warehouse storing databases for a plurality of users, including service providers hosting data for other users of the data warehouse may implement a data exchange. The data warehouse to verify identity of users and execute instructions with respect to databases of the data warehouse.

Claims

1. A method comprising:

providing a data warehouse executing on a cloud computing platform, the data warehouse managing a plurality of databases, each database of the plurality of databases having an owner, the data warehouse implementing access controls for the owner of each database of the plurality of databases;

executing, by one or more processors of the data warehouse, a first instruction from a first user that is the owner of a first database of the plurality of databases to create a listing in an exchange, the listing referencing the first database and specifying private identity-based sharing of the first database;

receiving, by the data warehouse, a second instruction from a second user, the second instruction referencing the listing and instructing the data warehouse to add the listing to a set of consumed data shares accessible by the second user;

in response to the second instruction, (i) verifying, by the data warehouse, an identity of the second user, (ii) verifying, by the data warehouse, that the identity of the second user is permitted according to the private identity-based sharing of the first database, and (iii) adding a reference to the listing to a set of consumed data shares accessible by the second user without creating a second copy of the first database;

receiving, by the data warehouse, a third instruction from the second user to execute a database operation with respect to the first database; and

in response to the third instruction, executing, by the data warehouse, the third instruction with respect to the first database.

2. The method of claim 1, wherein (ii) comprises:

receiving, by the data warehouse, verification from a service module corresponding to the first user that the identity of the second user has been verified with respect to the service module.

3. The method of claim 1, wherein (iii) comprises:

creating a view including a join of the first database with an entitlement table mapped to an identifier of the second user, the entitlement table indicating portions of the first database accessible by the second user;

adding a reference to the view to the set of consumed shares of the second user.

4. The method of claim 1, wherein (ii) comprises:

presenting, by the data warehouse, an interface to the second user to provide authentication information;

receiving, by the data warehouse, the authentication information from the second user through the interface;

forwarding, by the data warehouse, the authentication information to a service module corresponding to the first database, the service module being external to the data warehouse module;

receiving, by the data warehouse, verification from the service module that the identity of the second user has been verified with respect to the service module.

5. The method of claim 4, wherein the service module is a software as a service (SaaS) module.

6. The method of claim 1, wherein (iii) comprises:

filtering the first database to obtain a portion of the first database corresponding to the second user; and

adding a reference to the portion of the first database to the set of consumed data shares accessible by the second user.

7. The method of claim 1, wherein the first instruction further defines a view filter for the listing, the method comprising:

receiving, by the data warehouse, a request to browse the exchange from the second user;

(a) verifying by the data warehouse, that the second user is permitted to view the listing according to the view filter; and

in response to (a), presenting a representation of the listing to the second user.

8. The method of claim 7, further comprising:

receiving, by the data warehouse, metadata for the listing, the metadata describing the first database;

wherein presenting a representation of the listing comprises displaying at least a portion of the metadata.

9. The method of claim 8, further comprising:

verifying, by the data warehouse, that the metadata is accurate with respect to the first database prior to adding the reference to the listing to the exchange.

10. The method of claim 8, further comprising:

verifying, by the data warehouse, that the first database does not contain private identification information or private health information prior to adding the reference to the listing to the exchange.

11. The method of claim 1, wherein the data warehouse and the plurality of databases are located within a cloud computing platform.

12. The method of claim 1, further comprising:

providing, by the data warehouse, a report of usage of the first database by the second user to the first user.

13. A system, comprising:

one or more processors to;

execute, by a data warehouse, a first instruction from a first user that is an owner of a first database of the plurality of databases to create a listing in an exchange, the listing referencing the first database and specifying private identity-based sharing of the first database, wherein the data warehouse manages a plurality of databases, each database of the plurality of databases having a respective owner, the data warehouse implementing access controls for each owner of each database of the plurality of databases;

receive, by the data warehouse, a second instruction from a second user, the second instruction referencing the listing and instructing the data warehouse to add the listing to a set of consumed data shares accessible by the second user;

in response to the second instruction, (i) verify, by the data warehouse, an identity of the second user, (ii) verify, by the data warehouse, that the identity of the second user is permitted according to the private identity-based sharing of the first database, and (iii) add a reference to the listing to a set of consumed data shares accessible by the second user without creating a second copy of the first database;

receive, by the data warehouse, a third instruction from the second user to execute a database operation with respect to the first database; and

in response to the third instruction, execute, by the data warehouse, the third instruction with respect to the first database.

14. The system of claim 13, wherein to verify that the identity of the second user is permitted, the one or more processors to receive verification from a service module corresponding to the first user that the identity of the second user has been verified with respect to the service module.

15. The system of claim 13, wherein to add the reference, the one or more processors to:

create a view including a join of the first database with an entitlement table mapped to an identifier of the second user, the entitlement table indicating portions of the first database accessible by the second user; and

add the reference to the view to the set of consumed shares of the second user.

16. The system of claim 13, wherein to verify that the identity of the second user is permitted, the one or more processors to:

present an interface to the second user to provide authentication information;

receive the authentication information from the second user through the interface;

forward the authentication information to a service module corresponding to the first database, the service module being external to the data warehouse module; and

receive verification from the service module that the identity of the second user has been verified with respect to the service module.

17. The system of claim 16, wherein the service module is a software as a service (SaaS) module.

18. The system of claim 13, wherein to add the reference, the one or more processors to:

filter the first database to obtain a portion of the first database corresponding to the second user; and

add the reference to the portion of the first database to the set of consumed data shares accessible by the second user.

19. The system of claim 13, wherein the first instruction further defines a view filter for the listing, and wherein the one or more processors further to:

receive a request to browse the exchange from the second user;

verify that the second user is permitted to view the listing according to the view filter; and

present a representation of the listing to the second user in response to verifying that the second user is permitted to view the listing according to the view filter.

20. The system of claim 13, wherein the one or more processors further to receive metadata for the listing, the metadata describing the first database, wherein to present a representation of the listing, the one or more processors to cause display of at least a portion of the metadata.

21. The system of claim 20, wherein the one or more processors further to verify that the metadata is accurate with respect to the first database prior to adding the reference to the listing to the exchange.

22. The system of claim 20, wherein the one or more processors further to verify that the first database does not contain private identification information or private health information prior to adding the reference to the listing to the exchange.

23. The system of claim 13, wherein the data warehouse and the plurality of databases are located within a cloud computing platform.

24. The system of claim 13, wherein the one or more processors further to provide a report of usage of the first database by the second user to the first user.

26. The non-transitory computer-readable media of claim 24, wherein to verify that the identity of the second user is permitted, the one or more processors to receive verification from a service module corresponding to the first user that the identity of the second user has been verified with respect to the service module.

27. The non-transitory computer-readable media of claim 24, wherein to add the reference, the one or more processors to:

create a view including a join of the first database with an entitlement table mapped to an identifier of the second user, the entitlement table indicating portions of the first database accessible by the second user; and

add the reference to the view to the set of consumed shares of the second user.

28. The non-transitory computer-readable media of claim 24, wherein to verify that the identity of the second user is permitted, the one or more processors to:

present an interface to the second user to provide authentication information;

receive the authentication information from the second user through the interface;

forward the authentication information to a service module corresponding to the first database, the service module being external to the data warehouse module; and

receive verification from the service module that the identity of the second user has been verified with respect to the service module.

29. The non-transitory computer-readable media of claim 28, wherein the service module is a software as a service (SaaS) module.

30. The non-transitory computer-readable media of claim 24, wherein to add the reference, the one or more processors to:

filter the first database to obtain a portion of the first database corresponding to the second user; and

add the reference to the portion of the first database to the set of consumed data shares accessible by the second user.

25. A non-transitory computer-readable media that, when executed by one or more processors of a data warehouse, cause the one or more processors to:

execute, by the one or more processors, a first instruction from a first user that is an owner of a first database of the plurality of databases to create a listing in an exchange, the listing referencing the first database and specifying private identity-based sharing of the first database, wherein the data warehouse manages a plurality of databases, each database of the plurality of databases having a respective owner, the data warehouse implementing access controls for each owner of each database of the plurality of databases;

receive, by the one or more processors, a second instruction from a second user, the second instruction referencing the listing and instructing the data warehouse to add the listing to a set of consumed data shares accessible by the second user;

in response to the second instruction, (i) verify, by the one or more processors, an identity of the second user, (ii) verify, by the one or more processors, that the identity of the second user is permitted according to the private identity-based sharing of the first database, and (iii) add a reference to the listing to a set of consumed data shares accessible by the second user without creating a second copy of the first database;

receive, by the one or more processors, a third instruction from the second user to execute a database operation with respect to the first database; and

in response to the third instruction, execute, by the one or more processors, the third instruction with respect to the first database.