Stored procedures in the database

Abstract

Disclosed are systems, methods, and non-transitory computer-readable media for providing stored procedures in a network-based database system. The database system executes the stored procedures in a sandbox process. The sandbox process separates the stored procedures from other services and processes of the database system, and may also limit the resources (e.g., storage, memory, etc.) and functions available to the stored procedures. Stored procedures are typically designed to execute database queries that are processed by other components of the database system. To provide secure communication between the stored procedures and other components of the database system, the sandbox process is loaded with a Java Database Connectivity (JDBC) library (e.g., a JDBC instance) that is modified to limit the communication capabilities of the stored procedures.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of priority to U.S. Provisional Application No. 63 / 197,760, filed on June 7, 2021, which is incorporated herein by reference in its entirety. Technical Field

[0003] Embodiments of the present disclosure relate generally to network-based database systems, and more particularly, to providing stored procedures in network-based database systems.

[0004] background

[0005] A stored procedure is a subroutine stored in a database that is used to call a specified function. For example, a stored procedure is called using a specified command, which will cause the stored procedure to be executed in the database. Stored procedures allow users to define customized functions that can be easily reused as needed.

[0006] Traditional database systems managed on premises are being replaced by cloud-based multi-tenant database services. Cloud-based multi-tenant database services provide cloud-accessible database services to multiple accounts. Providing stored procedures in this type of environment presents several technical challenges because stored procedures present potential security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The present disclosure will be more fully understood from the detailed description given below and the accompanying drawings of various embodiments of the present disclosure.

[0009] Figure 1 An example computing environment including a network-based database system in communication with a cloud storage platform is shown according to some embodiments of the present disclosure.

[0010] Figure 2 is a block diagram illustrating components of a computing service manager according to some embodiments of the present disclosure.

[0011] Figure 3 is a block diagram illustrating components of an execution platform according to some embodiments of the present disclosure.

[0012] Figure 4 is a computing environment according to some embodiments of the present disclosure, which conceptually illustrates an example software architecture for executing a user defined function (UDF) by a process running on a given execution node of an execution platform.

[0013] Figure 5is a computing environment that conceptually illustrates an example software architecture for executing stored procedures according to some embodiments of the present disclosure.

[0014] Figure 6 is a flow chart illustrating an example method of providing a stored procedure in a network-based database system according to some example embodiments.

[0015] Figure 7 A diagrammatic representation of a machine in the form of a computer system within which a set of instructions may be executed, for causing the machine to perform any one or more of the methodologies discussed herein, is shown according to some embodiments of the present disclosure.

[0016] Detailed Description

[0017] Reference will now be made in detail to specific example embodiments for implementing the subject matter of the present invention. Examples of these specific embodiments are shown in the accompanying drawings, and specific details are set forth in the following description to provide a thorough understanding of the subject matter. It should be understood that these examples are not intended to limit the scope of the claims to the embodiments shown. On the contrary, they are intended to cover substitutions, modifications, and equivalents that may be included within the scope of this disclosure.

[0018] As discussed previously, there are several technical challenges in implementing stored procedures in a cloud-based multi-tenant database system. For example, stored procedures present potential security risks because they are applications that are executed in the database system. A malicious user could design a stored procedure to access confidential data from other accounts in the database system and transfer confidential data to an external network location.

[0019] To alleviate these problems, the database system executes stored procedures in a sandbox process. The sandbox process separates the stored procedures from other services and processes of the database system, and may also limit the resources (e.g., storage, memory, etc.) and functions available to the stored procedures. Stored procedures are typically designed to execute database queries that are processed by other components of the database system. To provide secure communication between the stored procedures and other components of the database system, the sandbox process is loaded with a Java Database Connectivity (JDBC) library (e.g., a JDBC instance) that is modified to limit the communication capabilities of the stored procedures.

[0020] The JDBC instance provides an application programming interface (API) that enables stored procedures to communicate with other components and utilize the services of the database system. In order to limit the communication capabilities of the stored procedure, the driver of the JDBC instance loaded into the sandbox process is modified to limit communication with the external network and / or to implement communication with the defined connection object. For example, the JDBC instance can be modified to limit communication to a single execution node process, which facilitates communication between the stored procedure and other services and components of the database system.

[0021] To execute a database query, a stored procedure executed in a sandbox process calls a JDBC method that causes a JDBC instance in the sandbox process to communicate with an execution node. For example, the JDBC instance converts the database query into a remote procedure call (e.g., Google Remote Procedure Call (gRPC)) for communicating with the execution node process. The execution node process then submits the database query to the computing service manager on behalf of the stored procedure. For example, the execution node process can issue a database query to a specific endpoint of the computing service manager that is designated to handle database queries from stored procedures.

[0022] The response to the database query is returned to the stored procedure in a similar manner. For example, the execution node process receives the response from the computing service manager and converts the response into a remote procedure call, which is returned to the sandbox process. The JDBC instance executed in the sandbox process converts the remote procedure call into a format compatible with the stored procedure to provide the stored procedure with the response to the database query.

[0023] Figure 1 An example computing environment 100 according to some embodiments of the present disclosure is shown, which includes a database system in the example form of a network-based database system 102. In order to avoid obscuring the subject matter of the present invention with unnecessary detail, Figure 1 Various functional components that are not closely related to conveying an understanding of the subject matter of the present invention are omitted. However, those skilled in the art will readily recognize that various additional functional components can be included as part of the computing environment 100 to facilitate additional functions not specifically described herein. In other embodiments, the computing environment can include another type of network-based database system or cloud data platform.

[0024] As shown, computing environment 100 includes a cloud storage platform 104 (e.g., Microsoft AzureBlob A network-based database system 102 that communicates with a cloud credential storage provider 106 (e.g., Google Cloud Storage or Google Cloud Storage). The network-based database system 102 is a network-based system for reporting and analyzing integrated data from one or more different sources including one or more storage locations within a cloud storage platform 104. The cloud storage platform 104 includes multiple computing machines and provides computer system resources, such as data storage and computing power, to the network-based database system 102 on demand.

[0025] The network-based database system 102 includes a computing service manager 108, an execution platform 110, and one or more metadata databases 112. The network-based database system 102 hosts and provides data reporting and analysis services to multiple client accounts.

[0026] The computing service manager 108 coordinates and manages the operation of the network-based database system 102. The computing service manager 108 also performs query optimization and compilation, and manages clusters of computing services (also referred to as "virtual warehouses") that provide computing resources. The computing service manager 108 can support any number of client accounts, such as end users providing data storage and retrieval requests, system administrators managing the systems and methods described herein, and other components / devices that interact with the computing service manager 108.

[0027] The computing service manager 108 also communicates with a client device 114. The client device 114 corresponds to a user of one of a plurality of client accounts supported by the network-based database system 102. The user may utilize the client device 114 to submit data storage, retrieval, and analysis requests to the computing service manager 108.

[0028] The computing service manager 108 is also coupled to one or more metadata databases 112 that store metadata related to various functions and aspects associated with the network-based database system 102 and its users. For example, the metadata database 112 may include a summary of data stored in a remote data storage system and data available from a local cache. In addition, the metadata database 112 may include information about how data is organized in a remote data storage system (e.g., a cloud storage platform 104) and a local cache. The information stored by the metadata database 112 allows systems and services to determine whether a piece of data needs to be accessed without loading or accessing the actual data from a storage device.

[0029] As another example, the metadata database 112 may store one or more credential objects 115. Typically, the credential object 115 indicates one or more security credentials to be retrieved from a remote credential store. For example, the cloud credential store provider 106 maintains multiple remote credential stores 118-1 to 118-N. Each of the remote credential stores 118-1 to 118-N may be associated with a user account and may be used to store security credentials associated with the user account. The credential object 115 may indicate one or more security credentials to be retrieved by the computing service manager 108 from one of the remote credential stores 118-1 to 118-N (e.g., for accessing data stored by the storage platform 104).

[0030] The computing service manager 108 is also coupled to an execution platform 110, which provides multiple computing resources for performing various data storage and data retrieval tasks. The execution platform 110 is coupled to a storage platform 104 of a cloud storage platform 104. The storage platform 104 includes multiple data storage devices 120-1 to 120-N. In some embodiments, the data storage devices 120-1 to 120-N are cloud-based storage devices located in one or more geographic locations. For example, the data storage devices 120-1 to 120-N can be part of a public cloud infrastructure or a private cloud infrastructure. The data storage devices 120-1 to 120-N can be hard disk drives (HDDs), solid-state drives (SSDs), storage clusters, Amazon (Amazon) S3TM storage systems, or any other data storage technology. In addition, the cloud storage platform 104 can include a distributed file system (such as, Hadoop distributed file system (HDFS)), an object storage system, etc.

[0031] The execution platform 110 includes a plurality of computing nodes. A set of processes on the computing nodes executes a query plan compiled by the computing service manager 108. The set of processes may include: a first process that executes the query plan; a second process that uses a least recently used (LRU) strategy to monitor and delete cache files and implement an out of memory (OOM) error mitigation process; a third process that extracts health information from process logs and states to send back to the computing service manager 108; a fourth process that establishes communication with the computing service manager 108 after the system boots; and a fifth process that handles all communications with the computing cluster for a given job provided by the computing service manager 108 and transmits information back to the computing service manager 108 and other computing nodes of the execution platform 110.

[0032] In some embodiments, the communication links between the elements of computing environment 100 are implemented via one or more data communication networks. These data communication networks can utilize any communication protocol and any type of communication medium. In some embodiments, the data communication network is a combination of two or more data communication networks (or subnetworks) coupled to each other. In alternative embodiments, these communication links are implemented using any type of communication medium and any communication protocol.

[0033] The computing service manager 108, the metadata database 112, the execution platform 110 and the storage platform 104 are Figure 1 104. However, each of the computing service manager 108, the metadata database 112, the execution platform 110, and the storage platform 104 can be implemented as a distributed system (e.g., distributed on multiple systems / platforms at multiple geographical locations). In addition, each of the computing service manager 108, the metadata database 112, the execution platform 110, and the storage platform 104 can be scaled up or down (independently of each other) according to changes in received requests and changing needs of the network-based database system 102. Therefore, in the described embodiment, the network-based database system 102 is dynamic and supports regular changes to meet current data processing needs.

[0034] During typical operation, the network-based database system 102 processes a plurality of jobs determined by the computing service manager 108. These jobs are scheduled and managed by the computing service manager 108 to determine when and how to execute the job. For example, the computing service manager 108 may divide the job into a plurality of discrete tasks, and may determine what data is needed to execute each of the plurality of discrete tasks. The computing service manager 108 may assign each of the plurality of discrete tasks to one or more nodes of the execution platform 110 to process the task. The computing service manager 108 may determine what data is needed to process the task, and further determine which nodes within the execution platform 110 are best suited to process the task. Some nodes may have cached the data required to process the task, and are therefore good candidates for processing the task. The metadata stored in the metadata database 112 helps the computing service manager 108 determine which nodes in the execution platform 110 have cached at least a portion of the data required to process the task. One or more nodes in the execution platform 110 use the data cached by the node and the data retrieved from the cloud storage platform 104 when necessary to process the task. It is desirable to retrieve as much data as possible from the cache within the execution platform 110 because the retrieval speed is typically much faster than retrieving data from the cloud storage platform 104 .

[0035] like Figure 1As shown, the computing environment 100 separates the execution platform 110 from the storage platform 104. In this arrangement, the processing resources and cache resources in the execution platform 110 operate independently of the data storage devices 120-1 to 120-N in the cloud storage platform 104. Therefore, the computing resources and cache resources are not limited to specific data storage devices 120-1 to 120-N. Instead, all computing resources and all cache resources can retrieve data from any data storage resource in the cloud storage platform 104, and store data therein.

[0036] Figure 2 is a block diagram illustrating components of the computing service manager 108 according to some embodiments of the present disclosure. Figure 2 As shown, the computing service manager 108 includes an access manager 202 and a credential management system 204 coupled to an access metadata database 206, which is an example of a metadata database 112. The access manager 202 handles authentication and authorization tasks for the system described herein. The credential management system 204 facilitates the use of remotely stored credentials (e.g., credentials stored in one of the remote credential storages 118-1 to 118-N) to access external resources, such as data resources in a remote storage device. As used herein, a remote storage device may also be referred to as a "persistent storage device" or a "shared storage device." For example, the credential management system 204 may create and maintain remote credential storage definitions and credential objects (e.g., in the access metadata database 206). The remote credential storage definition identifies a remote credential storage (e.g., one or more of the remote credential storages 118-1 to 118-N) and includes access information for accessing security credentials from the remote credential storage. The credential object uses non-sensitive information (e.g., a text string) to identify one or more security credentials, which will be retrieved from the remote credential storage for accessing external resources. When a request to call an external resource is received at runtime, credential management system 204 and access manager 202 use information stored in access metadata database 206 (eg, credential objects and credential store definitions) to retrieve security credentials for accessing the external resource from a remote credential store.

[0037] The request processing service 208 manages received data storage requests and data retrieval requests (e.g., jobs to be performed on database data). For example, the request processing service 208 can determine the data to process a received query (e.g., a data storage request or a data retrieval request). The data can be stored in a cache within the execution platform 110, or in a data storage device in the storage platform 104.

[0038] Management console service 210 supports access to various systems and processes by administrators and other system administrators.In addition, management console service 210 can receive requests to execute jobs and monitor workloads on the system.

[0039] The computing service manager 108 also includes a job compiler 212, a job optimizer 214, and a job executor 216. The job compiler 212 parses the job into multiple discrete tasks and generates execution code for each of the multiple discrete tasks. The job optimizer 214 determines the best method to execute the multiple discrete tasks based on the data that needs to be processed. The job optimizer 214 also handles various data pruning operations and other data optimization techniques to improve the speed and efficiency of executing the job. The job executor 216 executes the execution code of the job received from the queue or determined by the computing service manager 108.

[0040] The job scheduler and coordinator 218 sends the received jobs to the appropriate service or system for compilation, optimization and dispatch to the execution platform 110. For example, the jobs can be prioritized and then processed in priority order. In an embodiment, the job scheduler and coordinator 218 determines the priority of internal jobs scheduled by the computing service manager 108 with other "external" jobs (such as user queries that can be scheduled by other systems in the database but can utilize the same processing resources in the execution platform 110). In some embodiments, the job scheduler and coordinator 218 identifies or assigns specific nodes in the execution platform 110 to process specific tasks. The virtual warehouse manager 220 manages the operation of multiple virtual warehouses implemented in the execution platform 110. For example, the virtual warehouse manager 220 can generate a query plan for executing the received query. The function file access system 230 is configured to manage file access to files in a staging area (e.g., an internal staging area or an external staging area) using UDFs and user-defined function signatures pointing to a staging area, as discussed in further detail below.

[0041] In addition, the computing service manager 108 includes a configuration and metadata manager 222 that manages information related to data stored in remote data storage devices and local buffers (e.g., buffers in the execution platform 110). The configuration and metadata manager 222 uses metadata to determine which data files need to be accessed to retrieve data for processing a particular task or job. The monitor and workload analyzer 224 supervises the processes executed by the computing service manager 108 and manages the allocation of tasks (e.g., workloads) between execution nodes and virtual warehouses in the execution platform 110. The monitor and workload analyzer 224 also reallocates tasks as needed based on the changing workload throughout the network-based database system 102, and can also reallocate tasks based on user (e.g., "external") query workloads that can also be processed by the execution platform 110. The configuration and metadata manager 222 and the monitor and workload analyzer 224 are coupled to the data storage device 226. Figure 2 The data storage device 226 in represents any data storage device within the network-based database system 102. For example, the data storage device 226 may represent a buffer in the execution platform 110, a storage device in the storage platform 104, or any other storage device.

[0042] As described in the embodiments of this document, the computing service manager 108 verifies all communications from the execution platform (e.g., the execution platform 110) to verify that the content and context of the communication are consistent with the tasks known to be assigned to the execution platform. For example, an instance of an execution platform that executes query A should not be allowed to request access to a data source D (e.g., data storage device 226) that is not related to query A. Similarly, a given execution node (e.g., execution node 302-1) may need to communicate with another execution node (e.g., execution node 302-2) and should be prohibited from communicating with a third execution node (e.g., execution node 312-1), and any such illegal communications may be recorded (e.g., in a log or other location). In addition, the information stored on a given execution node is limited to data related to the current query, and any other data is not available, which is achieved by destruction or encryption when the key is not available.

[0043] Figure 3 is a block diagram illustrating components of the execution platform 110 according to some embodiments of the present disclosure. Figure 3As shown, the execution platform 110 includes multiple virtual warehouses, including virtual warehouse 1, virtual warehouse 2 and virtual warehouse n. Each virtual warehouse includes multiple execution nodes, and each execution node includes a data cache and a processor. The virtual warehouse can execute multiple tasks in parallel by using multiple execution nodes. As discussed herein, the execution platform 110 can add new virtual warehouses and delete existing virtual warehouses in real time based on the current processing needs of the system and users. This flexibility allows the execution platform 110 to quickly deploy a large amount of computing resources when needed, without having to continue to pay for those computing resources when they are no longer needed. All virtual warehouses can access data in any data storage device (e.g., any storage device in the cloud storage platform 104).

[0044] although Figure 3 Each virtual warehouse shown in includes three execution nodes, but a particular virtual warehouse may include any number of execution nodes. In addition, the number of execution nodes in a virtual warehouse is dynamic, so that new execution nodes are created when there is additional demand, and existing execution nodes are deleted when they are no longer needed.

[0045] Each virtual warehouse can access Figure 1 Thus, the virtual warehouse does not have to be assigned to a specific data storage device 120-1 to 120-N, but can access data from any of the data storage devices 120-1 to 120-N within the cloud storage platform 104. Similarly, Figure 3 Each execution node shown in can access data from any one of the data storage devices 120-1 to 120-N. In some embodiments, a specific virtual warehouse or a specific execution node can be temporarily assigned to a specific data storage device, but the virtual warehouse or execution node can subsequently access data from any other data storage device.

[0046] exist Figure 3In the example of , virtual warehouse 1 includes three execution nodes 302-1, 302-2 and 302-N. Execution node 302-1 includes cache 304-1 and processor 306-1. Execution node 302-2 includes cache 304-2 and processor 306-2. Execution node 302-N includes cache 304-N and processor 306-N. Each execution node 302-1, 302-2 and 302-N is associated with processing one or more data storage and / or data retrieval tasks. For example, a virtual warehouse can handle data storage and data retrieval tasks associated with internal services (such as clustering services, instantiated view refresh services, file compression services, stored program services, or file upgrade services). In other embodiments, a specific virtual warehouse can handle data storage and data retrieval tasks associated with a specific data storage system or a specific category of data.

[0047] Similar to the virtual warehouse 1 discussed above, virtual warehouse 2 includes three execution nodes 312-1, 312-2 and 312-N. Execution node 312-1 includes a cache 314-1 and a processor 316-1. Execution node 312-2 includes a cache 314-2 and a processor 316-2. Execution node 312-N includes a cache 314-N and a processor 316-N. In addition, virtual warehouse n includes three execution nodes 322-1, 322-2 and 322-N. Execution node 322-1 includes a cache 324-1 and a processor 326-1. Execution node 322-2 includes a cache 324-2 and a processor 326-2. Execution node 322-N includes a cache 324-N and a processor 326-N.

[0048] In some embodiments, Figure 3 The execution nodes shown are stateless with respect to data cached by the execution nodes. For example, these execution nodes do not store or otherwise maintain state information about the execution nodes or data cached by a particular execution node. Therefore, in the event of an execution node failure, the failed node can be transparently replaced with another node. Since there is no state information associated with the failed execution node, a new (replacement) execution node can easily replace the failed node without having to worry about recreating specific state.

[0049] although Figure 3 The execution nodes shown in include one data cache and one processor, but alternative embodiments may include execution nodes including any number of processors and any number of caches. In addition, the size of the cache may vary between different execution nodes. Figure 3The cache shown in stores data retrieved from one or more data storage devices in the cloud storage platform 104 in a local execution node. Therefore, the cache reduces or eliminates the bottleneck problem that occurs in a platform that continuously retrieves data from a remote storage system. Instead of repeatedly accessing data from a remote storage device, the system and method described herein accesses data from a cache in an execution node, which is significantly faster and avoids the bottleneck problem discussed above. In some embodiments, the cache is implemented using a high-speed memory device that provides fast access to cached data. Each cache can store data from any storage device in the cloud storage platform 104.

[0050] In addition, cache resources and computing resources can vary between different execution nodes. For example, an execution node may include a large amount of computing resources and a minimum of cache resources, so that the execution node can be used for tasks that require a large amount of computing resources. Another execution node may include a large amount of cache resources and a minimum of computing resources, so that the execution node can be used for tasks that require a large amount of data to be cached. Yet another execution node may include cache resources that provide faster input-output operations, which is useful for tasks that require rapid scanning of large amounts of data. In some embodiments, based on the expected tasks that the execution node will perform, the cache resources and computing resources associated with a specific execution node are determined when the execution node is created.

[0051] In addition, the cache resources and computing resources associated with a particular execution node may change over time based on the changing tasks performed by the execution node. For example, if the tasks performed by the execution node become more processor intensive, more processing resources may be allocated to the execution node. Similarly, if the tasks performed by the execution node require a larger cache capacity, more cache resources may be allocated to the execution node.

[0052] Although virtual warehouses 1, 2, and n are associated with the same execution platform 110, multiple computing systems at multiple geographic locations may be used to implement the virtual warehouses. For example, virtual warehouse 1 may be implemented by a computing system at a first geographic location, while virtual warehouses 2 and n are implemented by another computing system at a second geographic location. In some embodiments, these different computing systems are cloud-based computing systems maintained by one or more different entities.

[0053] In addition, each virtual warehouse Figure 3302-1 and 302-2 are shown as having multiple execution nodes. Multiple computing systems located at multiple geographic locations can be used to implement multiple execution nodes associated with each virtual warehouse. For example, an instance of virtual warehouse 1 implements execution nodes 302-1 and 302-2 on a computing platform at one geographic location, while implementing execution node 302-N at a different computing platform at another geographic location. The selection of a particular computing system to implement an execution node can depend on various factors, such as the resource level required for a particular execution node (e.g., processing resource requirements and cache requirements), the resources available at a particular computing system, the communication capabilities of a network within or between geographic locations, and which computing systems have implemented other execution nodes in the virtual warehouse.

[0054] The execution platform 110 is also fault tolerant. For example, if a virtual warehouse fails, the virtual warehouse will be quickly replaced by a different virtual warehouse located in a different geographical location.

[0055] A particular execution platform 110 may include any number of virtual warehouses. In addition, the number of virtual warehouses in a particular execution platform is dynamic, so that new virtual warehouses are created when additional processing and / or cache resources are needed. Similarly, existing virtual warehouses may be deleted when the resources associated with the virtual warehouses are no longer needed.

[0056] In some embodiments, virtual warehouses can operate on the same data in the cloud storage platform 104, but each virtual warehouse has its own execution node with independent processing and cache resources. This configuration allows requests on different virtual warehouses to be processed independently without interfering with each other. This independent processing, combined with the ability to dynamically add and remove virtual warehouses, supports adding new processing capabilities for new users without affecting the performance observed by existing users.

[0057] Figure 4 4 is a computing environment 400 that conceptually illustrates an example software architecture for executing a user defined function (UDF) by a process running on a given execution node of an execution platform 110 according to some embodiments of the present disclosure.

[0058] As shown, execution node 302-1 from execution platform 110 includes execution node process 410, which, in one embodiment, runs on processor 306-1 and may also utilize memory from cache 304-1 (or another memory device or storage). As used herein, a "process" or "computing process" may refer to an instance of a computer program executed by one or more threads of an execution node or execution platform.

[0059] As previously described, the computing service manager 108 verifies all communications from the execution platform 110 to verify that the content and context of the communication are consistent with the tasks known to be assigned to the execution platform 110. For example, the execution platform 110 executing query A is not allowed to request access to a specific data source that is not related to query A (e.g., the data storage device 226 or any one of the storage devices in the cloud storage platform 104). In one example, the execution node 302-1 may need to communicate with a second execution node (e.g., execution node 302-2), but the security mechanism described herein may not allow communication with a third execution node (e.g., execution node 312-1). In addition, any such illegal communications may be recorded (e.g., in log 444 or elsewhere). In addition, the information stored on a given execution node is limited to data related to the current query, and in the event that the key is not available, any other data is unusable by destruction or encryption.

[0060] exist Figure 4 In the example of , the execution node process 410 is executing the UDF client 412. In one embodiment, the UDF client 412 is implemented to support UDFs written in a specific programming language such as JAVA. In one embodiment, the UDF client 412 is implemented in a different programming language (e.g., C or C++) than the user code 430, which can further improve the security of the computing environment 400 by using a different code base (e.g., a code base without the same or fewer potential security vulnerabilities).

[0061] User code 430 can be provided as a package, for example in the form of a JAR (JAVA archive) file, which includes the code of one or more UDFs. In one embodiment, server implementation code 432 is a JAR file that starts a server responsible for receiving requests from execution node process 410, allocating worker threads to execute user code, returning results, and other types of server tasks.

[0062] In one implementation, operations from a UDF (e.g., a JAVA-based UDF) can be performed by a user code runtime 424 executed within a sandbox process 420 (e.g., a UDF server). In one embodiment, the user code runtime 424 is implemented as a virtual machine, such as a JAVA virtual machine (JVM). Since the user code runtime 424 is advantageously executed in a separate process relative to the execution node process 410, the risk of manipulating the execution node process 410 is low. In addition to other types of information or messages, the results of the execution operation can be stored in a log 444 for viewing and retrieval. In one embodiment, the log 444 can be stored locally in a memory at the execution node 302-1, or stored in a separate location such as a storage platform 104. In addition, such results may be returned from the user code runtime 424 to the UDF client 412 using a high performance protocol that further provides authentication and encryption of data transfer (e.g., no serialization or deserialization of data, no memory copies; operating on batches of records without having to access individual columns, records, or cells; utilizing efficient remote procedure call techniques and network protocols for data transfer) for data transfer (e.g., distributed data sets). In one embodiment, the UDF client 412 uses a data transfer mechanism that supports network transfer of columnar data between the user code runtimes 424 (and vice versa), with the above advantages.

[0063] In one example, the security manager 422 can prevent the completion of an operation from a given UDF by throwing an exception (e.g., if the operation is not allowed), or return (e.g., do nothing) if the operation is allowed. In one implementation, the security manager 422 is implemented as a JAVA security manager object that allows an application to implement a security policy such as the security manager policy 442, and enables the application to determine what the operation is and whether the operation is being attempted in a security context that allows the operation to be performed before performing a potentially unsafe or sensitive operation. The security manager policy 442 can be implemented as a file with permissions granted to the user code runtime 424. Thus, an application (e.g., a UDF executed by the user code runtime 424) can allow or disallow the operation based at least in part on the security policy.

[0064] In one embodiment, the sandbox process 420 is a child process (or a separate process) of the execution node process 410. In one embodiment, a sub-process refers to a child process of a given parent process (e.g., in this example, the execution node process 410). In one example, the sandbox process 420 is a program that reduces the risk of security vulnerabilities by limiting the operating environment of untrusted applications using security mechanisms such as namespaces and secure computing modes (e.g., using system call filters for the executing process and all its descendants, thereby reducing the attack surface of the kernel of a given operating system). In addition, in one example, compared to the execution node process 410, the sandbox process 420 is a lightweight process and is optimized (e.g., tightly coupled to the security mechanisms of the kernel of a given operating system) to process database queries in a secure manner in a sandbox environment.

[0065] In one embodiment, the sandbox process 420 can utilize a virtual network connection to communicate with other components within the subject system. A specific set of rules can be configured for the virtual network connection for other components of the subject system. For example, such rules for the virtual network connection can be configured for a specific UDF to limit the locations accessible to operations performed by the UDF (e.g., specific sites on the Internet or components that the UDF can communicate with). Thus, in this example, the UDF can be denied access to a specific network location or site on the Internet.

[0066] The sandbox process 420 may be understood as providing a constrained computing environment to a process (or processes) within the sandbox, wherein these constrained processes may be controlled and restricted to limit access to certain computing resources.

[0067] Examples of security mechanisms may include: implementation of a namespace, where each corresponding process group executed in a sandbox environment can access corresponding computing resources (e.g., process ID, host name, user ID, file name, name associated with network access, and inter-process communication), which are not accessible to another process group (can access a different resource group that is not accessible to the previous process group); other container implementations, etc. By executing the sandbox process 420 as a child process of the execution node process 410, in some embodiments, the waiting time for processing a given database query can be significantly reduced (e.g., in some cases, the waiting time is reduced to one tenth) compared to other technologies that can utilize virtual machine solutions alone.

[0068] As further shown, the sandbox process 420 can utilize a sandbox policy 440 to implement a given security policy. The sandbox policy 440 can be a file with information related to the configuration of the sandbox process 420 and details about restrictions (if any) and permissions for accessing and utilizing system resources. Example restrictions can include restrictions on network access or file system access (e.g., remapping the file system to place files in different locations that may not be accessible, other files can be installed in different locations, etc.). The sandbox process 420 limits the use of memory and processors (e.g., CPU) by the user code runtime 424, ensuring that other operations on the same execution node can execute without exhausting resources.

[0069] As described above, the sandbox process 420 is a child process (or independent process) of the execution node process 410, which actually means that the sandbox process 420 resides in an independent memory space different from the execution node process 410. When a security vulnerability related to the sandbox process 420 (e.g., an error or malicious code from a given UDF) occurs, if any memory is accessed by a malicious actor, the data or information stored by the execution node process is protected.

[0070] although Figure 4 The above discussion describes components implemented using JAVA (e.g., an object-oriented programming language), but it should be understood that computing environment 400 supports other programming languages ​​(e.g., interpreted programming languages). In one embodiment, Python is supported to implement and execute UDFs in computing environment 400. In this example, user code runtime 424 can be replaced with a Python interpreter for executing operations from UDFs (e.g., written in Python) within sandbox process 420.

[0071] Figure 4 The computing environment 400 for executing UDFs shown in FIG. 4 can be similarly used to execute stored procedures. Unlike UDFs, stored procedures are executable applications that can perform database queries as part of the functionality they provide. Therefore, stored procedures present potential security risks because they may be designed to access confidential data from other accounts of the database system and transmit confidential data to external network locations. To mitigate these issues, stored procedures are executed within a sandbox process 420, just like UDFs, but additional measures are implemented to provide secure communication between stored procedures and other components of the database system, as well as to provide advanced functionality to stored procedures.

[0072] Figure 5500 is a computing environment that conceptually illustrates an example software architecture for executing a stored procedure 504 according to some embodiments of the present disclosure. As shown, an execution node process 508 and a sandbox process 502 are executed within an execution node 510. The stored procedure 504 is executed within the sandbox process 502. The sandbox process 502 separates the stored procedure 504 from other services and processes of the database system 102, and may also limit the resources (e.g., storage devices, memory, etc.) and functions available to the stored procedure 504. The stored procedure 504 is typically designed to execute database queries that are processed by other components of the database system 102. In order to provide secure communication between the stored procedure 504 and other components of the database system 102, the sandbox process 502 is loaded with a JDBC instance 506 that is modified to limit the communication capabilities of the stored procedure 504.

[0073] The JDBC instance 506 provides an application programming interface (API) that enables the stored procedure 504 to communicate with other components and utilize the services of the database system 102. In order to limit the communication capabilities of the stored procedure 504, the driver of the JDBC instance 506 loaded into the sandbox process 502 is modified to limit communication with the external network and / or to enable communication with the defined connection object. For example, the JDBC instance 506 can be modified to limit communication to a single execution node process 508, which facilitates communication between the stored procedure 504 and other services and components of the database system 102.

[0074] To execute a database query, a stored procedure 504 executed in a sandbox process 502 calls a JDBC method that causes a JDBC instance 506 in the sandbox process 502 to communicate with an execution node process 508. For example, the JDBC instance 506 converts the database query into a remote procedure call (e.g., gRPC) for communicating with the execution node process 508. The execution node process 508 then submits the database query to the computing service manager 512 on behalf of the stored procedure 504. For example, the execution node process 508 can issue a database query to a specific endpoint of the computing service manager 512 that is designated to handle database queries from the stored procedure 504.

[0075] The computing service manager 512 may then execute the received database query, as described above with respect to Figure 1 and Figure 2 Executing the database query may generate specified data and / or output, which will be returned to the stored procedure 504 as a response to the database query.

[0076] The response to the database query is returned to the stored procedure 504 in a manner similar to the way the database query is provided from the stored procedure 504 to the computing service manager 512. For example, the computing service manager 512 provides the response to the execution node process 508. After receiving the response from the computing service manager 512, the execution node process 508 converts the response into a remote procedure call, which is returned to the sandbox process 502. The JDBC instance 506 executed in the sandbox process 502 converts the remote procedure call into a format compatible with the stored procedure 504 to provide the stored procedure with the response to the database query.

[0077] Figure 6 6 is a flow chart illustrating an example method 600 for providing a stored procedure in a network-based database system according to some example embodiments. The method 600 may be contained in computer-readable instructions for execution by one or more processors, such that the operations of the method 600 may be performed in part or in whole by an execution node 510; therefore, the method 600 is described below by way of example with reference to the execution node 510. However, it should be understood that at least some operations of the method 600 may be deployed on various other hardware configurations, and the method 600 is not intended to be limited to the execution node 510.

[0078] At operation 602, an execution node process 508 receives a remote procedure call from a stored procedure 504 executing in a sandbox process 502. The sandbox process 502 separates the stored procedure 504 from other services and processes of the database system 102, and may also limit the resources (e.g., storage, memory, etc.) and functionality available to the stored procedure 504. The stored procedure 504 is typically designed to execute database queries that are processed by other components of the database system 102. To provide secure communication between the stored procedure 504 and other components of the database system, the sandbox process 502 is loaded with a JDBC instance 506 that is modified to limit the communication capabilities of the stored procedure 504.

[0079] The JDBC instance 506 provides an application programming interface (API) that enables the stored procedure 504 to communicate with other components and utilize the services of the database system. In order to limit the communication capabilities of the stored procedure 504, the driver of the JDBC instance 506 loaded into the sandbox process 502 is modified to limit communication with the external network and / or to enable communication with the defined connection object. For example, the JDBC instance 506 can be modified to limit communication to a single execution node process 508, which facilitates communication between the stored procedure 504 and other services and components of the database system 102.

[0080] To perform a database query, a stored procedure 504 executed in a sandbox process 502 calls a JDBC method that causes a JDBC instance 506 in the sandbox process 502 to communicate with an execution node process 508. For example, the JDBC instance 506 converts the database query into a remote procedure call (e.g., gRPC) for communicating with the execution node process 508.

[0081] At operation 604, the execution node process 508 converts the remote procedure call into a database query, and at operation 606, the execution node process 508 issues the database query to an endpoint of the computing service manager 512 on behalf of the stored procedure 504. For example, the execution node process 508 may issue the database query to a specific endpoint of the computing service manager 512 that is designated to handle database queries from the stored procedure 504. The computing service manager 512 may then execute the received database query, as described above with respect to Figure 1 and Figure 2 Executing the database query may generate specified data and / or output, which will be returned to the stored procedure 504 as a response to the database query.

[0082] The response to the database query is returned to the stored process 504 in a manner similar to the way the database query is provided from the stored process 504 to the computing service manager 512. For example, the computing service manager 512 provides the response to the execution node process 508. Thus, at operation 608, the execution node process 508 receives the response to the database query from the computing service manager 512.

[0083] At operation 610, the execution node process 508 converts the response into a remote procedure call, and at operation 612, the execution node process 508 transmits the remote procedure call to the sandbox process 502. The JDBC instance 506 executed in the sandbox process 502 converts the remote procedure call into a format compatible with the stored procedure 504 to provide the stored procedure with a response to the database query.

[0084] Figure 7 A diagrammatic representation of a machine 700 in the form of a computer system is shown within which a set of instructions may be executed to cause the machine 700 to perform any one or more of the methods discussed herein, according to an example embodiment. In particular, Figure 7A diagrammatic representation of a machine 700 is shown in the form of an example computer system within which instructions 716 (e.g., software, programs, applications, applet, app, or other executable code) for causing the machine 700 to perform any one or more of the methods discussed herein may be executed. For example, the instructions 716 may cause the machine 700 to perform any one or more of the operations of the method 600. As another example, the instructions 716 may cause the machine 700 to implement at least Figure 4 In this manner, instructions 716 transform a general-purpose, unprogrammed machine into a specific machine 700 (e.g., a node in computing service manager 108 or execution platform 110) that is specifically configured to perform any of the functions described and illustrated in the manner described herein.

[0085] In alternative embodiments, the machine 700 operates as a standalone device or can be coupled (e.g., networked) to other machines. In a networked deployment, the machine 700 can operate as a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine 700 may include, but is not limited to, a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a smart phone, a mobile device, a network router, a network switch, a network bridge, or any machine capable of executing instructions 716 sequentially or otherwise, the instructions 716 specifying actions to be taken by the machine 700. In addition, although only a single machine 700 is shown, the term "machine" should also be understood to include a collection of machines 700 that individually or jointly execute instructions 716 to perform any one or more of the methods discussed herein.

[0086] The machine 700 includes a processor 710, a memory 730, and an input / output (I / O) component 750, which are configured to communicate with each other, for example, via a bus 702. In an example embodiment, the processor 710 (e.g., a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, a processor 712 and a processor 714 that may execute instructions 716. The term "processor" is intended to include a multi-core processor 710, which may include two or more independent processors (sometimes referred to as "cores") that may execute instructions 716 simultaneously. Although Figure 7Multiple processors 710 are shown, but machine 700 may include a single processor with a single core, a single processor with multiple cores (eg, a multi-core processor), multiple processors with a single core, multiple processors with multiple cores, or any combination thereof.

[0087] The memory 730 may include a main memory 732, a static memory 734, and a storage unit 736, all of which may be accessed by the processor 710, for example, via the bus 702. The main memory 732, the static memory 734, and the storage unit 736 store instructions 716, which embody any one or more of the methodologies or functions described herein. During execution by the machine 700, the instructions 716 may also reside, in whole or in part, within the main memory 732, within the static memory 734, within the machine storage medium 738 of the storage unit 736, within at least one processor 710 (e.g., within a processor's cache), or any suitable combination thereof.

[0088] The I / O components 750 include components for receiving input, providing output, generating output, transmitting information, exchanging information, capturing measurements, etc. The specific I / O components 750 included in a particular machine 700 will depend on the type of machine. For example, a portable machine such as a mobile phone will likely include a touch input device or other such input mechanism, while a headless server machine will be less likely to include such a touch input device. It will be appreciated that the I / O components 750 may include Figure 7 750 is grouped according to function only to simplify the following discussion, and the grouping is by no means limiting. In various example embodiments, the I / O component 750 may include an output component 752 and an input component 754. The output component 752 may include a visual component (e.g., a display such as a plasma display panel (PDP), a light emitting diode (LED) display, a liquid crystal display (LCD), a projector, or a cathode ray tube (CRT)), an acoustic component (e.g., a speaker), other signal generators, etc. The input component 754 may include an alphanumeric input component (e.g., a keyboard, a touch screen configured to receive alphanumeric input, an optical keyboard, or other alphanumeric input component), a pointing-based input component (e.g., a mouse, a touch pad, a trackball, a joystick, a motion sensor, or another pointing instrument), a tactile input component (e.g., a physical button, a touch screen or other tactile input component that provides the location and / or force of a touch or touch gesture), an audio input component (e.g., a microphone), etc.

[0089] A variety of technologies may be used to achieve communication. The I / O component 750 may include a communication component 764, which is operable to couple the machine 700 to a network 780 or a device 770 via coupling 782 and coupling 772, respectively. For example, the communication component 764 may include a network interface component or another suitable device that interfaces with the network 780. In a further example, the communication component 764 may include a wired communication component, a wireless communication component, a cellular communication component, and other communication components that provide communication via other modalities. The device 770 may be another machine or any of a variety of peripheral devices (e.g., a peripheral device coupled via a universal serial bus (USB)). For example, as described above, the machine 700 may correspond to any one of the computing service manager 108 or the execution platform 110, and the device 770 may include a client device 114 or any other computing device described herein as communicating with a network-based database system 102 or a cloud storage platform 104.

[0090] Executable instructions and machine storage media

[0091] Various memories (e.g., 730, 732, 734 and / or memory and / or storage unit 736 of processor 710) can store one or more sets of instructions 716 and data structures (e.g., software) that embody or are utilized by any one or more of the methods or functions described herein. When executed by processor 710, these instructions 716 cause various operations to implement the disclosed embodiments.

[0092] As used herein, the terms "machine storage medium," "device storage medium," and "computer storage medium" mean the same and may be used interchangeably in this disclosure. These terms refer to a single or multiple storage devices and / or media (e.g., centralized or distributed databases and / or associated caches and servers) that store executable instructions and / or data. Accordingly, these terms should be considered to include, but are not limited to, solid-state memory and optical and magnetic media, including memory internal or external to the processor. Specific examples of machine storage medium, computer storage medium, and / or device storage medium include non-volatile memory, including, for example: semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), field programmable gate arrays (FPGA), and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM optical disks. The terms "machine storage medium," "computer storage medium," and "device storage medium" specifically exclude carrier waves, modulated data signals, and other such media (at least some of which are included in the term "signal media" discussed below).

[0093] Transmission medium

[0094] In various example embodiments, one or more portions of network 780 may be an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), the Internet, a portion of the Internet, a portion of a public switched telephone network (PSTN), a plain old telephone service (POTS) network, a cellular telephone network, a wireless network, 780 may include a wireless or cellular network, another type of network, or a combination of two or more such networks. For example, the network 780 or a portion of the network 780 may include a wireless or cellular network, and the coupling 782 may be a code division multiple access (CDMA) connection, a global system for mobile communications (GSM) connection, or another type of cellular or wireless coupling. In this example, the coupling 782 may implement any of a variety of types of data transmission technologies, such as single carrier radio transmission technology (1xRTT), evolution-data optimized (EVDO) technology, general packet radio service (GPRS) technology, enhanced data rate GSM evolution (EDGE) technology, including 3G, fourth generation wireless (4G) network, universal mobile telecommunications system (UMTS), high speed packet access (HSPA), world microwave access interoperability (WiMAX), long term evolution (LTE) standard of the third generation partnership project (3GPP), other technologies defined by various standard setting organizations, other long-range protocols, or other data transmission technologies.

[0095] The instructions 716 may be transmitted or received over the network 780 using a transmission medium via a network interface device (e.g., a network interface component included in the communication component 764) and using any of a number of well-known transmission protocols (e.g., Hypertext Transfer Protocol (HTTP)). Similarly, the instructions 716 may be transmitted or received to the device 770 via a coupling 772 (e.g., a peer-to-peer coupling) using a transmission medium. The terms "transmission medium" and "signal medium" have the same meaning and may be used interchangeably in this disclosure. The terms "transmission medium" and "signal medium" should be understood to include any intangible medium capable of storing, encoding, or carrying instructions 716 for execution by the machine 700, and include digital or analog communication signals or other intangible media that facilitate the communication of such software. Therefore, the terms "transmission medium" and "signal medium" should be understood to include any form of modulated data signals, carrier waves, etc. The term "modulated data signal" means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.

[0096] Computer readable medium

[0097] The terms "machine-readable medium," "computer-readable medium," and "device-readable medium" mean the same and may be used interchangeably in this disclosure. These terms are defined to include both machine storage media and transmission media. Thus, these terms include both storage devices / medium and carrier / modulated data signals.

[0098] The various operations of the example methods described herein may be performed at least in part by one or more processors that are temporarily configured (e.g., by software) or permanently configured to perform related operations. Similarly, the method described herein may be implemented by a processor at least in part. For example, at least some operations of method 600 may be performed by one or more processors. The execution of certain operations may be distributed between one or more processors, which not only reside in a single machine, but also are deployed across multiple machines. In some example embodiments, one or more processors may be located in a single location (e.g., in a home environment, an office environment, or a server farm), and in other embodiments, the processor may be distributed in multiple locations.

[0099] Although embodiments of the present disclosure have been described with reference to specific example embodiments, it is apparent that various modifications and changes may be made to these embodiments without departing from the broader scope of the subject matter of the present invention. Therefore, the specification and the drawings are considered to be illustrative rather than restrictive. The drawings forming a part of the present application illustrate specific embodiments in which the subject matter may be implemented by way of illustration and not limitation. The illustrated embodiments are described in sufficient detail to enable those skilled in the art to implement the teachings disclosed herein. Other embodiments and embodiments derived therefrom may be used so that structural and logical replacements and changes may be made without departing from the scope of the present disclosure. Therefore, this detailed description should not be understood in a limiting sense, and the scope of the various embodiments is limited only by the appended claims together with the equivalents to the full scope enjoyed by these claims.

[0100] Such embodiments of the subject matter of the present invention may be referred to herein individually and / or collectively by the term "invention", which is merely for convenience and is not intended to voluntarily limit the scope of the present application to any single invention or inventive concept (if more than one invention or inventive concept is actually disclosed). Therefore, although specific embodiments have been illustrated and described herein, it should be understood that the specific embodiments shown can be replaced with any arrangement calculated to achieve the same purpose. The present disclosure is intended to cover any and all modifications or variations of the various embodiments. After reading the above description, those skilled in the art will understand the combination of the above embodiments and other embodiments not specifically described herein.

[0101] In this document, the terms "a" or "an", as is common in patent documents, are used to include one or more than one, independent of any other instances or uses of "at least one" or "one or more." In this document, the term "or" is used to refer to a non-exclusive or, so that "A or B" includes "A but not B," "B but not A," and "A and B," unless otherwise stated. In the appended claims, the terms "including" and "in which" are used as the plain-English equivalents of the respective terms "comprising" and "wherein." Furthermore, in the appended claims, the terms "including" and "comprising" are open-ended; that is, systems, devices, articles, or processes that include elements other than those listed after such terms in a claim are still considered to fall within the scope of that claim.

Claims

1. A method for providing a stored procedure, comprising: receiving, at an execution node, a remote procedure call from a stored procedure executing within a sandbox process, the remote procedure call having been transmitted from an instance executing within the sandbox process; converting the remote procedure call into a database query; and issuing the database query on behalf of the stored procedure to an endpoint of a computing service manager, the endpoint being designated to process database queries from the stored procedure, the computing service manager processing the database query, Wherein the instance includes a modified driver that restricts the instance from communicating with one or more external networks.

2. The method according to claim 1, wherein: Converting the remote procedure call further comprises: receiving a response to the database query; and The response to the database query is converted into a second remote procedure call.

3. The method according to claim 2, wherein: Translating the remote procedure call also includes transmitting the second remote procedure call to the sandbox process.

4. The method according to claim 3, wherein: The second remote procedure call is received by the instance, and the instance converts the second remote procedure call into a format compatible with the stored procedure.

5. The method of claim 1, further comprising generating a remote procedure call from the instance that is invoked by a stored procedure using an application programming interface (API) for communicating with the instance.

6. The method according to claim 1, wherein: The remote procedure call is Google Remote Procedure Call (gRPC).

7. A system for providing a stored procedure, comprising: one or more computer processors; and One or more computer-readable media storing instructions that, when executed by the one or more computer processors, cause the system to perform operations including: receiving, at an execution node, a remote procedure call from a stored procedure executing within a sandbox process, the remote procedure call having been transmitted from an instance executing within the sandbox process; converting the remote procedure call into a database query; and issuing the database query on behalf of the stored procedure to an endpoint of a computing service manager, the endpoint being designated to process database queries from the stored procedure, the computing service manager processing the database query, Wherein the instance includes a modified driver that restricts the instance from communicating with one or more external networks.

8. The system of claim 7, wherein the operations further comprise: receiving a response to the database query; and The response to the database query is converted into a second remote procedure call.

9. The system according to claim 8, wherein: Translating the remote procedure call also includes transmitting the second remote procedure call to the sandbox process.

10. The system according to claim 8, wherein: The second remote procedure call is received by the instance, and the instance converts the second remote procedure call into a format compatible with the stored procedure.

11. The system of claim 7, wherein the operations further comprise: A remote procedure call is generated from the instance that is invoked by a stored procedure using an application programming interface (API) for communicating with the instance.

12. The system according to claim 7, wherein: The remote procedure call is Google Remote Procedure Call (gRPC).

13. A non-transitory computer-readable medium storing instructions that, when executed by one or more computing devices, cause the one or more computing devices to perform operations comprising: receiving, at an execution node, a remote procedure call from a stored procedure executing within a sandbox process, the remote procedure call having been transmitted from an instance executing within the sandbox process; converting the remote procedure call into a database query; and issuing the database query on behalf of the stored procedure to an endpoint of a computing service manager, the endpoint being designated to process database queries from the stored procedure, the computing service manager processing the database query, Wherein the instance includes a modified driver that restricts the instance from communicating with one or more external networks.

14. The non-transitory computer readable medium of claim 13, the operations further comprising: receiving a response to the database query; and The response to the database query is converted into a second remote procedure call.

15. The non-transitory computer readable medium of claim 14, wherein: Translating the remote procedure call also includes transmitting the second remote procedure call to the sandbox process.

16. The non-transitory computer readable medium of claim 14, wherein: The second remote procedure call is received by the instance, and the instance converts the second remote procedure call into a format compatible with the stored procedure.

17. The non-transitory computer readable medium of claim 13, the operations further comprising: A remote procedure call is generated from the instance that is invoked by a stored procedure using an application programming interface (API) for communicating with the instance.

18. The non-transitory computer readable medium of claim 13, wherein: The remote procedure call is Google Remote Procedure Call (gRPC).

Images