Dynamic shared data object shielding

Abstract

The invention relates to dynamic shared data object shielding. A shared database platform implements dynamic masking on data shared between users, where particular data is masked, translated, or otherwise modified based on pre-configured functions associated with user roles. The shared database platform may dynamically implement masking at runtime in response to a user request accessing a database object associated with one or more masking policies.

Description

[0001] This application is a divisional application of an application with a filing date of July 31, 2020, application number 202080007499.2, and invention name “Dynamic Shared Data Object Shielding”. CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. patent application serial number 16 / 698,142 filed on November 27, 2019, the contents of which are incorporated herein in their entirety. Background Art

[0004] Data can be uploaded to a database, and access to the database data can be managed by a database administrator. Recently, cloud database services have become increasingly popular due to the ease with which new database instances can be created to store data. While new cloud database services allow for easy creation of databases, cloud database services introduce new issues with regard to data privacy. For example, as the volume of data increases, it becomes difficult to create access for specific individuals to specific data in a given database in a way that is both secure and scalable. Summary of the invention

[0005] This application provides the following: 1) A method comprising: identifying, on a website, a database object generated by a first client device of a first end user of the website; receiving, from the first client device, a shared masking policy for modifying data in the database object, the shared masking policy specifying a user role type for initiating one or more preconfigured masking operations on the database object; generating a network link for accessing the database object by a second end user of the network site; receiving a request from a second client device of the second end user to access database data using the network link; In response to the request from the second client device, determining that an end-user role of the second end-user matches a user role type of the shared shielding policy; In response to the end-user role matching a user role type of the shared masking policy, applying one or more preconfigured masking operations to the database object to generate a masked database object; and A second client device of the second end user is caused to present result data from the masked database object.

[0006] 2) The method according to 1), wherein the request from the second client device is a query.

[0007] 3) The method of 2), wherein the query comprises a select statement, and wherein the select statement is applied to the masked database objects to generate result data displayed in the presentation.

[0008] 4) The method according to 1), wherein the database object is stored in a first database instance managed by the first end user, and wherein the shielded database object is hosted on a second database instance managed by the second end user without copying the database object from the first database instance to the second database instance.

[0009] 5) The method according to 1), wherein the database object comprises one or more external tables.

[0010] 6) The method according to 1), wherein the shared shielding policy is received in a structured query language (SQL) format and stored in a shared shielding database.

[0011] 7) The method according to 1), wherein the shared masking policy is mapped to the database object, the shared masking policy contains a plurality of user role types including the user role type, wherein each of the plurality of user role types is mapped to a function for masking the database object.

[0012] 8) The method of 7), wherein the function is a database function executable on the database object to cause one or more transformations on one or more columns of the database object.

[0013] 9) The method according to 1), wherein: The shared masking policy is a first shared masking policy; and The database object is a database view mapped to the shared masking policy, the database view containing data from a database table mapped to a second shared masking policy.

[0014] 10) The method according to 9), wherein the second shared masking policy is implemented on the database table to generate masked table data contained in the database view, and the database view including the masked table data is also masked according to the shared masking policy to generate the masked database object.

[0015] 11) A system comprising: one or more processors of the machine; and a memory storing instructions that, when executed by the one or more processors, cause the machine to perform operations comprising: identifying, on a website, a database object generated by a first client device of a first end user of the website; receiving, from the first client device, a shared masking policy for modifying data in the database object, the shared masking policy specifying a user role type for initiating one or more preconfigured masking operations on the database object; generating a network link for accessing the database object by a second end user of the network site; receiving a request from a second client device of the second end user to access database data using the network link; In response to the request from the second client device, determining that an end-user role of the second end-user matches a user role type of the shared shielding policy; In response to the end-user role matching a user role type of the shared masking policy, applying one or more preconfigured masking operations to the database object to generate a masked database object; and A second client device of the second end user is caused to present result data from the masked database object.

[0016] 12) The system according to 11), wherein the request from the second client device is a query.

[0017] 13) The system of 12), wherein the query comprises a select statement, and wherein the select statement is applied to the masked database objects to generate result data displayed in the presentation.

[0018] 14) The system according to 11), wherein the database object is stored in a first database instance managed by the first end user, and wherein the shielded database object is hosted on a second database instance managed by the second end user without copying the database object from the first database instance to the second database instance.

[0019] 15) The system according to 11), wherein the database object comprises one or more external tables.

[0020] 16) The system according to 11), wherein the shared shielding policy is received in a structured query language (SQL) format and stored in a shared shielding database.

[0021] 17) The system according to 11), wherein the shared masking policy is mapped to the database object, the shared masking policy contains a plurality of user role types including the user role type, wherein each of the plurality of user role types is mapped to a function of masking the database object.

[0022] 18) The system of 17), wherein the function is a database function executable against the database object to cause one or more transformations on one or more columns of the database object.

[0023] 19) The system according to 11), wherein the database object is a database view mapped to the shared masking policy, the database view containing data from a database table mapped to a different shared masking policy.

[0024] 20) A machine-readable storage device containing instructions, which, when executed by a machine, cause the machine to perform operations, the operations comprising: identifying, on a website, a database object generated by a first client device of a first end user of the website; receiving, from the first client device, a shared masking policy for modifying data in the database object, the shared masking policy specifying a user role type for initiating one or more preconfigured masking operations on the database object; generating a network link for accessing the database object by a second end user of the network site; receiving a request from a second client device of the second end user to access database data using the network link; In response to the request from the second client device, determining that an end-user role of the second end-user matches a user role type of the shared shielding policy; In response to the end-user role matching a user role type of the shared masking policy, applying one or more preconfigured masking operations to the database object to generate a masked database object; and A second client device of the second end user is caused to present result data from the masked database object.

[0025] 21) The machine-readable storage device according to 20), wherein the request from the second client device is a query.

[0026] 22) The machine-readable storage device of 21), wherein the query comprises a select statement, and wherein the select statement is applied to the masked database objects to generate result data displayed in the presentation.

[0027] 23) A machine-readable storage device according to 20), wherein the database object is stored in a first database instance managed by the first end user, and wherein the shielded database object is hosted on a second database instance managed by the second end user without copying the database object from the first database instance to the second database instance.

[0028] 24) The machine-readable storage device according to 20), wherein the database object comprises one or more external tables.

[0029] 25) The machine-readable storage device according to 20), wherein the shared shielding policy is received in a structured query language (SQL) format and stored in a shared shielding database.

[0030] 26) The machine-readable storage device according to 20), wherein the shared masking policy is mapped to the database object, the shared masking policy contains a plurality of user role types including the user role type, wherein each of the plurality of user role types is mapped to a function for masking the database object.

[0031] 27) The machine-readable storage device according to 26), wherein the function is a database function executable on the database object to cause one or more transformations on one or more columns of the database object.

[0032] 28) The machine-readable storage device according to 20), wherein: the shared masking policy is a first shared masking policy; and the database object is a database view mapped to the shared masking policy, the database view containing data from a database table mapped to a second shared masking policy.

[0033] 29) A machine-readable storage device according to 28), wherein the second shared masking policy is implemented on the database table to generate masked table data contained in the database view, and the database view including the masked table data is also masked according to the shared masking policy to generate the masked database object. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The various drawings depict only exemplary embodiments of the present disclosure and should not be considered to limit its scope.

[0035] Figure 1 An example computing environment is shown in which a network-based data warehouse system may implement dynamic sharing shielding of database objects, according to some example embodiments.

[0036] Figure 2is a block diagram illustrating components of a computing service manager according to some example embodiments.

[0037] Figure 3 is a block diagram illustrating components of an execution platform according to some example embodiments.

[0038] Figures 4A-4C An example data architecture using system shared database objects is shown according to some example embodiments.

[0039] Figure 5 An example database architecture for sharing data between entities using the system is shown, according to some example embodiments.

[0040] Figure 6 Example database objects are shown according to some example embodiments.

[0041] Figures 7A-7E An example user interface for dynamic shielding of shared data is shown in accordance with some example embodiments.

[0042] Figure 8 An example data architecture for dynamic masking of shared data objects is shown in accordance with some example embodiments.

[0043] Fig. 9 An example policy data architecture is shown in accordance with some example embodiments.

[0044] Fig.10 is a flowchart of a method for configuring a shared fencing policy using a resource item according to some example embodiments.

[0045] Fig.11 is a flowchart of a method for interacting with dynamic screening data, according to some example embodiments.

[0046] Fig.12 is a flow diagram of a method for dynamically shielding a shared database object, according to some example embodiments.

[0047] Fig.13 A schematic diagram showing a machine in the form of a computer system within which a set of instructions for causing the machine to perform any one or more of the methodologies discussed herein may be executed according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0048] The following description includes systems, methods, techniques, instruction sequences, and computer program products that embody illustrative embodiments of the present disclosure. In the following description, for the purpose of explanation, many specific details are set forth to provide an understanding of the various embodiments of the subject matter of the present invention. However, it is apparent to those skilled in the art that the embodiments of the subject matter of the present invention can be implemented without these specific details. In general, well-known instruction instances, protocols, structures, and techniques are not necessarily shown in detail.

[0049] As discussed, it can be difficult to create access and share data in a secure manner that can scale as the amount of data increases. To this end, a shared database platform can implement dynamic masking of data shared between users, where specific data is masked, transformed, or otherwise modified based on preconfigured functions associated with user roles. The shared database platform can dynamically implement masking at runtime in response to a user requesting access to a database object associated with one or more masking policies.

[0050] Figure 1 An example shared data processing platform 100 is shown according to some embodiments of the present disclosure, wherein a network-based data warehouse system 102 implements dynamic shielding of shared data objects. In order to avoid obscuring the subject matter of the present invention with unnecessary detail, various functional components that are not closely related to conveying an understanding of the subject matter of the present invention are omitted from the accompanying drawings. However, those skilled in the art will readily recognize that various additional functional components may be included as part of the shared data processing platform 100 to facilitate additional functions not specifically described herein.

[0051] As shown, the shared data processing platform 100 includes a network-based data warehouse system 102, a cloud computing storage platform 104 (e.g., a storage platform, AWS® service such as S3, Microsoft Azure®, or Google Cloud Services®), and a remote computing device 106. The network-based data warehouse system 102 is a network-based system for storing and accessing data in an integrated manner (e.g., storing data internally, accessing external remote data), and reporting and analyzing integrated data from one or more different sources (e.g., cloud computing storage platform 104). The cloud computing storage platform 104 includes multiple computing machines and provides computer system resources, such as data storage and computing power, to the network-based data warehouse system 102 on demand.

[0052] The remote computing device 106 (e.g., a user device such as a laptop computer) includes one or more computing machines (e.g., a user device such as a laptop computer) that executes a remote software component 108 (e.g., a cloud service accessed by a browser) to provide additional functionality to users of the network-based data warehouse system 102. The remote software component 108 includes a set of machine-readable instructions (e.g., code) that, when executed by the remote computing device 106, causes the remote computing device 106 to provide certain functionality. The remote software component 108 can operate on input data and generate result data based on processing, analyzing, or otherwise transforming the input data. As an example, the remote software component 108 can be a data provider or data consumer that processes dynamically masked shared data objects, as discussed in further detail below.

[0053] The network-based data warehouse system 102 includes an access management system 110, a computing service manager 112, an execution platform 114, and a database 116. The access management system 110 enables administrative users to manage access to resources and services provided by the network-based data warehouse system 102. Administrative users can create and manage users, roles, and groups, and use permissions to allow or deny access to resources and services. The access management system 110 can store shared data that securely manages shared access to storage resources of the cloud computing storage platform 104 between different users of the network-based data warehouse system 102, as discussed in further detail below.

[0054] The computing service manager 112 coordinates and manages the operation of the network-based data warehouse system 102. The computing service manager 112 also performs query optimization and compilation, and manages computing service clusters (e.g., virtual warehouses, virtual machines, EC2 clusters) that provide computing resources. The computing service manager 112 can support any number of client accounts, such as end users who provide data storage and retrieval requests, system administrators who manage the systems and methods described herein, and other components / devices that interact with the computing service manager 112.

[0055] The computing service manager 112 is also coupled to a database 116, which is associated with all data stored in the shared data processing platform 100. The database 116 stores data related to various functions and aspects associated with the network-based data warehouse system 102 and its users. For example, according to some example embodiments, the data to be dynamically masked can be stored and accessed on the cloud computing storage platform 104 (e.g., in S3), or stored and accessed on the database 116 local to the network-based data warehouse system 102.

[0056] In some embodiments, database 116 includes a summary of data stored in remote data storage systems and data available from one or more local caches. In addition, database 116 may include information about how data is organized in remote data storage systems and local caches. Database 116 allows systems and services to determine whether a data segment needs to be accessed without having to load or access the actual data from a storage device. Computing service manager 112 is also coupled to execution platform 114, which provides multiple computing resources (e.g., virtual warehouses) that perform various data storage and data retrieval tasks, as discussed in more detail below.

[0057] The execution platform 114 is coupled to a plurality of data storage devices 124-1 to 124-n that are part of the cloud computing storage platform 104. In some embodiments, the data storage devices 124-1 to 124-n are cloud-based storage devices located in one or more geographic locations. For example, the data storage devices 124-1 to 124-n may be part of a public cloud architecture or a private cloud architecture. The data storage devices 124-1 to 124-n may be hard disk drives (HDDs), solid-state drives (SSDs), storage clusters, Amazon S3 storage systems, or any other data storage technology. In addition, the cloud computing storage platform 104 may include a distributed file system (e.g., Hadoop Distributed File System (HDFS)), an object storage system, and the like.

[0058] The execution platform 114 includes a plurality of computing nodes (e.g., virtual warehouses). A set of processes on the computing nodes executes a query plan compiled by the computing service manager 112. The set of processes may include: a first process that executes the query plan; a second process that uses a least recently used (LRU) strategy to monitor and delete micro-partition files and implement an out of memory (OOM) error mitigation process; a third process that extracts health information from process logs and status information to send back to the computing service manager 112; a fourth process that establishes communication with the computing service manager 112 after the system boots; and a fifth process that handles all communications with the computing cluster for a given job provided by the computing service manager 112 and transmits information back to the computing service manager 112 and other computing nodes of the execution platform 114.

[0059] The cloud computing storage platform 104 also includes an access management system 118 and an API gateway 120. Like the access management system 110, the access management system 118 allows users to create and manage users, roles, and groups, and use permissions to allow or deny access to cloud services and resources. The access management system 110 of the network-based data warehouse system 102 and the access management system 118 of the cloud computing storage platform 104 can communicate and share information to enable access and management of resources and services shared by users of the network-based data warehouse system 102 and the cloud computing storage platform 104. The API gateway 120 handles tasks involving accepting and processing concurrent API calls, including traffic management, authorization and access control, monitoring, and API version management. The API gateway 120 provides HTTP proxy services for creating, publishing, maintaining, protecting, and monitoring APIs (e.g., REST APIs).

[0060] In some embodiments, the communication links between the elements of the shared data processing platform 100 are implemented through one or more data communication networks. These data communication networks can utilize any communication protocol and any type of communication medium. In some embodiments, the data communication network is a combination of two or more data communication networks (or subnetworks) coupled to each other. In alternative embodiments, these communication links are implemented using any type of communication medium and any communication protocol.

[0061] like Figure 1As shown, data storage devices 124-1 to 124-N are decoupled from the computing resources associated with the execution platform 114. That is, new virtual warehouses can be created and terminated in the execution platform 114, and additional data storage devices can be created and terminated on 104 in an independent manner. The architecture supports dynamic changes to the network-based data warehouse system 102 based on changing data storage / retrieval needs and changing needs of users and systems accessing the shared data processing platform 100. Support for dynamic changes allows the network-based data warehouse system 102 to quickly change scale in response to changing needs for systems and components within the network-based data warehouse system 102. The separation of computing resources from data storage devices supports the storage of large amounts of data without requiring a corresponding large amount of computing resources. Similarly, this separation of resources supports a significant increase in computing resources used at a particular time without a corresponding increase in available data storage resources. In addition, the decoupling of resources enables different accounts to handle the creation of additional computing resources to process data shared by other users without affecting the systems of other users. For example, a data provider may have three computing resources and share data with a data consumer, and the data consumer may generate a new computing resource to perform queries on the shared data, where the new computing resource is managed by the data consumer and does not affect or interact with the computing resources of the data provider.

[0062] The computing service manager 112, the database 116, the execution platform 114, the cloud computing storage platform 104 and the remote computing device 106 are Figure 1 104 are shown as separate components. However, each of the computing service manager 112, database 116, execution platform 114, cloud computing storage platform 104, and remote computing environment can be implemented as a distributed system (e.g., distributed across multiple systems / platforms in multiple geographic locations) that is connected by an API and accesses information (e.g., tokens, login data). In addition, each of the computing service manager 112, database 116, execution platform 114, and cloud computing storage platform 104 can be expanded or reduced (independently of each other) based on changes in requests received and changes in the needs of the shared data processing platform 100. Therefore, in the described embodiment, the network-based data warehouse system 102 is dynamic and supports frequent changes to meet current data processing needs.

[0063] During typical operation, the network-based data warehouse system 102 processes multiple jobs (e.g., queries) determined by the computing service manager 112. These jobs are scheduled and managed by the computing service manager 112 to determine when and how to execute the job. For example, the computing service manager 112 can divide the job into multiple discrete tasks and can determine what data is needed to execute each of the multiple discrete tasks. The computing service manager 112 can assign each of the multiple discrete tasks to one or more nodes of the execution platform 114 to process the task. The computing service manager 112 can determine what data is needed to process the task and further determine which nodes within the execution platform 114 are best suited to process the task. Some nodes may have cached the data required to process the task (because the node has recently downloaded data for previous jobs from the cloud computing storage platform 104) and are therefore good candidates for processing the task. The metadata stored in the database 116 helps the computing service manager 112 determine which nodes in the execution platform 114 have cached at least a portion of the data required to process the task. One or more nodes in the execution platform 114 use the data cached by the node and the data retrieved from the cloud computing storage platform 104 when necessary to process the task. It is desirable to retrieve as much data as possible from the cache within the execution platform 114 because the retrieval speed is typically much faster than retrieving data from the cloud computing storage platform 104 .

[0064] like Figure 1 As shown, the shared data processing platform 100 separates the execution platform 114 from the cloud computing storage platform 104. In this arrangement, the processing resources and cache resources in the execution platform 114 operate independently of the data storage resources 124-1 to 124-n in the cloud computing storage platform 104. Therefore, the computing resources and cache resources are not limited to specific data storage devices 124-1 to 124-n. Instead, all computing resources and all cache resources can retrieve data from and store data in any data storage resource in the cloud computing storage platform 104.

[0065] Figure 2 is a block diagram illustrating components of the computing service manager 112 according to some embodiments of the present disclosure. Figure 2As shown, the request processing service 202 manages received data storage requests and data retrieval requests (e.g., jobs to be performed on database data). For example, the request processing service 202 can determine the data required to process a received query (e.g., a data storage request or a data retrieval request). The data can be stored in a cache within the execution platform 114, or in a data storage device in the cloud computing storage platform 104. The management console service 204 supports administrators and other system administrators to access various systems and processes. In addition, the management console service 204 can receive requests to execute jobs and monitor the workload on the system.

[0066] The shared masking engine 225 manages the dynamic masking data managed by the shared data processing platform 100 for different users based on roles and functions, as discussed in further detail below.

[0067] The computing service manager 112 also includes a job compiler 206, a job optimizer 208, and a job executor 210. The job compiler 206 parses the job into multiple discrete tasks and generates execution code for each of the multiple discrete tasks. The job optimizer 208 determines the best method to execute the multiple discrete tasks based on the data that needs to be processed. The job optimizer 208 also handles various data pruning operations and other data optimization techniques to improve the speed and efficiency of executing the job. The job executor 210 executes the execution code of the job received from the queue or determined by the computing service manager 112.

[0068] The job scheduler and coordinator 212 sends the received jobs to the appropriate service or system for compilation, optimization and dispatch to the execution platform 114. For example, the jobs can be prioritized and processed in this priority order. In an embodiment, the job scheduler and coordinator 212 determines the priority of internal jobs scheduled by the computing service manager 112 and other "external" jobs (such as user queries that can be scheduled by other systems in the database but can utilize the same processing resources in the execution platform 114). In some embodiments, the job scheduler and coordinator 212 identifies or assigns specific nodes in the execution platform 114 to handle specific tasks. The virtual warehouse manager 214 manages the operation of multiple virtual warehouses implemented in the execution platform 114. As described below, each virtual warehouse includes multiple execution nodes, each execution node including a cache and a processor (e.g., a virtual machine, an operating system-level container execution environment).

[0069] In addition, the computing service manager 112 includes a configuration and metadata manager 216 that manages information about data stored in remote data storage devices and local caches (i.e., caches in the execution platform 114). The configuration and metadata manager 216 uses metadata to determine which data micro-partitions need to be accessed to retrieve data for processing a particular task or job. The monitor and workload analyzer 218 supervises the processes executed by the computing service manager 112 and manages the allocation of tasks (e.g., workloads) between execution nodes and virtual warehouses in the execution platform 114. The monitor and workload analyzer 218 also reallocates tasks as needed based on the changing workload throughout the network-based data warehouse system 102, and can also reallocate tasks based on user (e.g., "external") query workloads that can also be processed by the execution platform 114. The configuration and metadata manager 216 and the monitor and workload analyzer 218 are coupled to the data storage device 220. Figure 2 The data storage device 220 in the network-based data warehouse system 102 represents any data storage device in the network-based data warehouse system 102. For example, the data storage device 220 can represent a cache in the execution platform 114, a storage device in the cloud computing storage platform 104, or any other storage device.

[0070] Figure 3 is a block diagram illustrating components of the execution platform 114 according to some embodiments of the present disclosure. Figure 3 As shown, the execution platform 114 includes multiple virtual warehouses, which are elastic clusters of computing instances (e.g., virtual machines). In the example shown, the virtual warehouses include virtual warehouse 1, virtual warehouse 2, and virtual warehouse n. Each virtual warehouse (e.g., EC2 cluster) includes multiple execution nodes (e.g., virtual machines), each of which includes a data cache and a processor. The virtual warehouse can execute multiple tasks in parallel using multiple execution nodes. As discussed herein, the execution platform 114 can add new virtual warehouses and discard existing virtual warehouses in real time based on the current processing needs of the system and users. This flexibility allows the execution platform 114 to quickly deploy a large number of computing resources when needed, without having to continue to pay for those computing resources when they are no longer needed. All virtual warehouses can access data in any data storage device (e.g., any storage device in the cloud computing storage platform 104).

[0071] although Figure 3 Each virtual warehouse shown in includes three execution nodes, but a particular virtual warehouse may include any number of execution nodes. In addition, the number of execution nodes in a virtual warehouse is dynamic, so that new execution nodes are created when there is additional demand, and existing execution nodes are deleted when they are no longer needed (e.g., when a query or job is completed).

[0072] Each virtual warehouse can access Figure 1 Thus, the virtual warehouse does not have to be assigned to a specific data storage device 124-1 to 124-n, but can access data from any of the data storage devices 124-1 to 124-n within the cloud computing storage platform 104. Similarly, Figure 3 Each execution node shown can access data from any one of the data storage devices 124-1 to 124-n. For example, the storage device 124-1 of a first user (e.g., a provider account user) can be shared with a worker node in a virtual warehouse of another user (e.g., a consumer account user), so that the other user can create a database (e.g., a read-only database) and directly use the data in the storage device 124-1 without copying the data (e.g., copying it to a new disk managed by the consumer account user). In some embodiments, a specific virtual warehouse or a specific execution node can be temporarily assigned to a specific data storage device, but the virtual warehouse or execution node can later access data from any other data storage device.

[0073] exist Figure 3 In the example of , virtual warehouse 1 includes three execution nodes 302-1, 302-2 and 302-n. Execution node 302-1 includes cache 304-1 and processor 306-1. Execution node 302-2 includes cache 304-2 and processor 306-2. Execution node 302-n includes cache 304-n and processor 306-n. Each execution node 302-1, 302-2 and 302-n is associated with processing one or more data storage and / or data retrieval tasks. For example, a virtual warehouse can handle data storage and data retrieval tasks associated with internal services (such as clustering services, instantiated view refresh services, file compression services, stored procedure services, or file upgrade services). In other embodiments, a specific virtual warehouse can handle data storage and data retrieval tasks associated with a specific data storage system or a specific category of data.

[0074] Similar to the virtual warehouse 1 discussed above, virtual warehouse 2 includes three execution nodes 312-1, 312-2 and 312-n. Execution node 312-a includes a cache 314-1 and a processor 316-1. Execution node 312-n includes a cache 314-n and a processor 316-n. Execution node 312-n includes a cache 314-n and a processor 316-n. In addition, virtual warehouse 3 includes three execution nodes 322-1, 322-2 and 322-n. Execution node 322-1 includes a cache 324-1 and a processor 326-1. Execution node 322-2 includes a cache 324-2 and a processor 326-2. Execution node 322-n includes a cache 324-n and a processor 326-n.

[0075] In some embodiments, Figure 3 The execution nodes shown are stateless with respect to data cached by the execution nodes. For example, these execution nodes do not store or otherwise maintain state information about the execution nodes or data cached by a particular execution node. Therefore, in the event of an execution node failure, the failed node can be transparently replaced with another node. Since there is no state information associated with the failed execution node, a new (replacement) execution node can easily replace the failed node without having to worry about recreating specific state.

[0076] although Figure 3 The execution nodes shown each include a data cache and a processor, but alternative embodiments may include execution nodes that include any number of processors and any number of caches. In addition, the size of the cache may vary between different execution nodes. Figure 3 The illustrated cache stores data (e.g., S3 objects most recently accessed by a given node) retrieved from one or more data storage devices in the cloud computing storage platform 104 in a local execution node (e.g., a local disk). In some example embodiments, the cache stores file headers and individual columns of a file when a query downloads only the columns required by the query.

[0077] To improve cache hits and avoid overlapping redundant data stored in node caches, job optimizer 208 distributes input file sets to nodes using a consistent hashing scheme to hash the table file names of the accessed data (e.g., data in database 116 or database 122). According to some example embodiments, subsequent or concurrent queries that access the same table file will therefore be executed on the same node.

[0078] As discussed, nodes and virtual warehouses can be changed dynamically in response to environmental conditions (e.g., disaster scenarios, hardware / software problems (e.g., failures)) or management changes (e.g., changing from a large cluster to a small cluster to reduce costs). In some example embodiments, when the set of nodes changes, the data is not immediately reshuffled. Instead, a least recently used replacement strategy is implemented to eventually replace cache content lost in multiple jobs. Therefore, the cache reduces or eliminates the bottleneck problem that occurs in platforms that continuously retrieve data from remote storage systems. Instead of repeatedly accessing data from remote storage devices, the systems and methods described herein access data from a cache in an execution node, which is significantly faster and avoids the bottleneck problem discussed above. In some embodiments, the cache is implemented using a high-speed memory device that provides fast access to cached data. Each cache can store data from any storage device in the cloud computing storage platform 104.

[0079] In addition, cache resources and computing resources can vary between different execution nodes. For example, an execution node may include a large amount of computing resources and a minimum of cache resources, so that the execution node can be used for tasks that require a large amount of computing resources. Another execution node may include a large amount of cache resources and a minimum of computing resources, so that the execution node can be used for tasks that require a large amount of data to be cached. Another execution node may include cache resources that provide faster input-output operations, which is useful for tasks that require rapid scanning of large amounts of data. In some embodiments, the execution platform 114 implements skew processing to allocate work between cache resources and computing resources associated with a specific execution, wherein the allocation can be further based on the expected tasks performed by the execution node. For example, if the tasks performed by the execution node become more processor-intensive, more processing resources can be allocated to the execution node. Similarly, if the tasks performed by the execution node require a larger cache capacity, more cache resources can be allocated to the execution node. In addition, due to various problems (e.g., virtualization problems, network overhead), the execution speed of some nodes may be much slower than that of other nodes. In some example embodiments, the file stealing scheme is used to solve the imbalance at the scanning level. In particular, each time a node process completes scanning its input file set, it requests additional files from other nodes. If one of the other nodes receives such a request, the node analyzes its own set (e.g., how many files were left in the input file set when the request was received) and then transfers ownership of one or more remaining files for the duration of the current job (e.g., query). The requesting node (e.g., file stealing node) then receives the data (e.g., header data) and downloads the file from the cloud computing storage platform 104 (e.g., from the data storage device 124-1) without downloading the file from the transfer node. In this way, a lagging node can transfer files through file stealing without increasing the load on the lagging node.

[0080] Although virtual warehouses 1, 2, and n are associated with the same execution platform 114, multiple computing systems at multiple geographic locations may be used to implement the virtual warehouses. For example, virtual warehouse 1 may be implemented by a computing system at a first geographic location, while virtual warehouses 2 and n are implemented by another computing system at a second geographic location. In some embodiments, these different computing systems are cloud-based computing systems maintained by one or more different entities.

[0081] In addition, each virtual warehouse Figure 3302-1 and 302-2 are shown as having multiple execution nodes. Multiple computing systems located at multiple geographic locations can be used to implement multiple execution nodes associated with each virtual warehouse. For example, an instance of virtual warehouse 1 implements execution nodes 302-1 and 302-2 on a computing platform at one geographic location, and implements execution node 302-n on a different computing platform at another geographic location. The selection of a particular computing system to implement an execution node can depend on various factors, such as the resource level required for a particular execution node (e.g., processing resource requirements and cache requirements), the resources available at a particular computing system, the communication capabilities of a network within or between geographic locations, and which computing systems have implemented other execution nodes in the virtual warehouse.

[0082] The execution platform 114 is also fault tolerant. For example, if a virtual warehouse fails, the virtual warehouse will be quickly replaced by a different virtual warehouse located in a different geographical location.

[0083] A particular execution platform 114 may include any number of virtual warehouses. In addition, the number of virtual warehouses in a particular execution platform is dynamic, so that new virtual warehouses are created when additional processing and / or cache resources are needed. Similarly, existing virtual warehouses may be deleted when the resources associated with the virtual warehouses are no longer needed.

[0084] In some embodiments, virtual warehouses can operate on the same data in the cloud computing storage platform 104, but each virtual warehouse has its own execution node with independent processing and cache resources. This configuration allows requests on different virtual warehouses to be processed independently without interfering with each other. This independent processing, combined with the ability to dynamically add and remove virtual warehouses, supports adding new processing capabilities for new users without affecting the performance observed by existing users.

[0085] Figures 4A-4CAn example data architecture for sharing database objects using a network-based data warehouse system 102 according to some example embodiments is shown. As discussed, the access management system 110 can manage shared data for sharing data between storage devices (e.g., different storage devices for a single account or sharing data in a storage device assigned to a first sharer account to a second consumer account). In some example embodiments, the access management system 110 implements role-based access control to manage access to objects in customer accounts. Role-based access control includes two mechanisms: roles and authorizations. In one embodiment, a role is a special object in an end-user account (e.g., a provider account, a consumer account) assigned to a user. Authorizations between roles and database objects define the privileges of the role on these objects. For example, when executing the command "show database", a role with use authorization on a database can "view" the database; a role with select authorization on a table can read from the table but cannot write to the table. The role will need to have modify authorization on the table in order to write to it.

[0086] Figure 4A is a schematic block diagram illustrating role-based access to objects in a customer account of a multi-tenant shared database platform (e.g., platform 120 accessed by system 102) according to some example embodiments. In the following example, user account "A1" corresponds to managing a data provider virtual warehouse (e.g., Figure 3 A different user account A2 corresponds to a data provider account for starting a data consumer virtual warehouse (e.g., Figure 3 The data consumer account of the virtual warehouse 2).

[0087] As shown in the figure, the A1 account contains the role R1, which has authorizations for all objects in the object hierarchy. Assuming that these authorizations are use authorizations between R1 and database objects D1 and D2, shares S1 and S2, and select authorizations between R1 and table object T1, view object V1, function object F2, sequence object Q2, and table object T2, a user with the activated role R1 can view all objects and read data from all tables, views, and sequences, and can execute function F2 within account A1.

[0088] Account A2 contains role R3, which has authorizations for all objects in the object hierarchy. Assuming that these authorizations are use authorizations between R3 and D3, S3 and select authorizations between R3 and T3, a user with activated role R3 can view all objects and read data from all tables, views, and sequences within account A2.

[0089] Figure 4BThe usage authorization between roles is described. With role-based access control, usage rights can also be granted from one role to another. A role with usage authorization for another role "inherits" all the access privileges of the other role. For example, role R2 has usage authorization for role R1. A user with activated role R2 (e.g., with corresponding authorization details) can view all objects and read from all objects, because role R2 inherits all authorizations of role R1.

[0090] According to one embodiment, authorization for use is granted across different accounts. An account that shares data may be referred to as a "sharer account" here, and an account that shares data with it may be referred to as a "target account" here. Some embodiments disclosed herein allow instant, zero-copy, easy-to-control cross-account data sharing. In some embodiments, in order to share data with another account, a sharer account may generate a shared object. In a shared object, a role may be created, and a user of the sharer account may indicate the role and / or the access rights or authorizations available to an external account (or target account) that will be granted permissions under the role. The target account may then be able to identify shared objects or roles in other accounts to which the target account has been granted permissions or access rights. In one embodiment, shared objects in a sharer account may be imported into a target account using alias objects and cross-account role authorizations.

[0091] The sharer account creates a new type of object, the shared object. A shared object has a name that is uniquely identified within the sharer account. For example, a name may need to be unique within an account, but not necessarily across accounts. Shared objects can be created, modified, and deleted by referencing their names in the sharer account.

[0092] In some embodiments, each shared object contains a single role. The authorizations between this role and the object define what objects are shared and with what privileges those objects are shared. In an implementation of role-based access control, the roles and authorizations can be similar to any other role and authorization system. By modifying the set of authorizations attached to the roles in the shared object, more objects can be shared (by adding authorizations to the role), fewer objects can be shared (by revoking authorizations from the role), or objects can be shared with different privileges (by changing the authorization type, such as allowing write access to a previously read-only shared table object).

[0093] In one embodiment, the shared object also contains a reference list to other client accounts. Only specific accounts in the shared object are allowed to search, access and / or import from the shared object. By modifying the reference list of other client accounts, the shared object can be accessed by more accounts or restricted to fewer accounts.

[0094] Figure 4C is a schematic block diagram showing logical authorizations and links between different accounts. A database alias object D5 is created in account A2. Database alias D5 references database D2 via link L1. Role R3 has use authorization G1 on database D5. Role R3 has a second use authorization G2 to role R4 in customer account A1. Authorization G2 is a cross-account authorization between accounts A1 and A2. Role-based access control allows users with activated role R3 in account A2 to access data in account A1. For example, if a user in account A2 wants to read data in table T2, role-based access control will allow this because role R3 has use authorization for role R4, which in turn has select authorization for table T2. For example, a user with activated role R3 can access T2 by running a query or select pointing to "D5.S2.T2" (in this case, T2 is accessed through S2 and D5).

[0095] Using object aliases and cross-account authorization from roles in the target account to roles in the sharer account, users in the target account are allowed to access information in the sharer account. In this way, the database system can share data between different customer accounts in an instantaneous, zero-copy, and easy-to-control manner. Sharing can be instantaneous because alias objects and cross-account authorization can be created in milliseconds. Sharing can be zero-copy because no data must be copied in the process. For example, all queries or selections can be made directly on shared objects in the sharer account without creating a copy in the target account. Sharing is also easy to control because it utilizes easy-to-use technology for role-based access control. In addition, in an embodiment with separate storage and computing, when queries are executed on shared data, there is no contention between computing resources. Therefore, different virtual warehouses in different customer accounts can process shared data separately. For example, the first virtual warehouse of the first account can use the data shared by the sharer account to process database queries or statements, while the second account or the second virtual warehouse of the sharer account can use the shared data of the sharer account to process database queries or statements.

[0096] Figure 5An example database architecture 500 for sharing data between entities (e.g., users) using a shared data processing platform 100 is shown according to some example embodiments. In the example shown, a data provider account 505 corresponds to a user device (e.g., a laptop) of a user logged in as an administrator of data 510 (e.g., an account of a first user of a first company, department, etc., who creates and stores data). For example, provider account 505 generates data and stores it in shared data processing platform 100. Data 510 may include data uploaded to network-based data warehouse system 102 (e.g., for storage in a node cache in database 116 or 114, or data located on cloud computing storage platform 104). Consumer account 515 corresponds to a user device of another user (e.g., another user of another company, a different department within the same company, etc., who logs in using a laptop and creates an active session of consumer account 515) with whom provider account 505 seeks to share data 510 through shared data processing platform 100. For example, data provider account 505 and data consumer account 515 can both be run from different remote computing devices, such as remote computing device 106, which can use network-based data warehouse system 102 (e.g., based on permissions, roles, session information managed by access management system 110 and / or access management system 118) to access, modify, or otherwise process data 510. In the example shown, data 510 includes databases (e.g., database 1, database 2, database 3). Each database is composed of one or more schemas, which are groups of database objects, such as tables (e.g., table 2, table 3), views (e.g., view 4, view 54). Figure 1 ,See Figure 3 ) and shared (e.g., Share 1).

[0097] In a table, data is relational database data structured as a collection of columns and rows, where a table may include references to other tables (e.g., keys, indexes, shared columns such as customer names). Figure 6 , a first table 600 includes three columns (patient name, age, and symptoms), with a row for each patient, and a second table 605 includes two columns (patient name, zip code), where the patient name is the same column used to reference a given patient / user. For example, a join operation or view can be created from the first table 600 and the second table to display zip codes that have experienced different symptoms (e.g., by creating a view or new table using the patient name, symptoms, zip code columns). Although a relational database structure is discussed here as an example, it should be understood that in some example embodiments, the data managed by the shared data processing platform 100 can be a data structure in a non-relational database format (e.g., non-SQL, Hadoop, Spark framework, etc.).

[0098] Back to Figure 5 As used herein, a view is a database object that displays data from one or more tables (e.g., showing certain columns, with a customized view mode). A view allows access to the results of a query as if the view itself were a table. While views can be used to exclude or hide columns to "mask" data, using a view to hide data creates another object that must be managed, and if there are many projects that require masking in a given network environment, a large number of views must be managed, which will create a lot of overhead and management complexity. In addition, masking using views to hide data is independent of which role's access rights see the view (e.g., the view that a user engineer sees is the same as the view that an analyst user sees). In addition, views only create a view of the data object and do not perform data transformation-style operations (e.g., replacing the first three characters of a name with #). In addition, shared views can include network security because the recipient of the view may be able to gain access to the underlying data used to create the view (e.g., access to the full table from which columns were extracted to create a given view).

[0099] A share is an object customized by the shared data processing platform 100, which can be used to share data between users of the network-based data warehouse system 102 in an efficient and secure manner. A share object includes all the information for sharing a given database. Each share includes privileges that grant access rights to the database and schema containing the objects to be shared, privileges that grant access rights to specific objects (e.g., tables, secure views), and consumer accounts for sharing databases and their objects. After a given database is created (e.g., by a data provider account 505), the shared object can be accessed and / or manipulated by other users (e.g., consumer accounts 515) via the cloud computing storage platform 104. For example, a provider account 505 can create one or more database instances, then load data 510 into the database instance, create views and / or shared objects, and further create a consumer account (e.g., a reader account), which can access database objects via the network-based data warehouse 102, and does not require data to be transferred between accounts; instead, shared data is directly accessed on the original storage device. For example, the consumer account 515 can log in using a browser to access a page, generate a read-only database (e.g., "consumer database"), and populate the database with shared data (e.g., "view database"). Figure 3 ”) for analysis without having to copy the data from the storage device where the shared data is stored.

[0100] Figures 7A-7E An example user interface for managing data using a shared data processing platform 100 is shown according to some example embodiments. In the illustrative example, Fig. 7A and 7Bcorresponds to an Internet browser user interface displayed on a device (e.g., a laptop) of a data provider account 505, and Figure 7C 7E is an example Internet browser user interface displayed on another device of another user logged in as consumer account 515. Although an Internet browser user interface is discussed in the illustrated example, it should be understood that the user interface can be similarly integrated into other applications, such as native applications of the client device operating system (e.g., mobile applications on a smartphone, Linux applications on a Linux laptop, Windows applications on a Windows-enabled laptop, etc.).

[0101] exist Fig. 7A , user interface 700 displays a window 705 for creating a reader account. Window 705 includes a field for creating an account name (e.g., the name of consumer account 515, such as "Bert", a data analyst at a third-party company), and login fields, such as a user name field and a password field. When the "Create Account" button is selected in window 705, consumer account 515 is created and linked to provider account 505 on shared data processing platform 100 (e.g., through access management system 110 and access management system 118).

[0102] exist Figure 7B In the example, user interface 710 displays a window 715 for creating a shared object and adding database objects (e.g., tables, views) to the shared object and specifying access rights to the shared object (e.g., consumer accounts shared with the shared object). For example, the "share name" field allows the shared object to be named, and the "database" field allows the shared object to contain database objects, such as views. Figure 3 (view3). Window 715 also includes a "Consumer Account" field that gives one or more consumer accounts (e.g., Bert) access to a shared object, and a Shared Object link that is a URL to the consumer account 515 (e.g., a URL to a web service instance of the consumer account 515).

[0103] Based on the user selecting the create button in window 715, the shared object is created and access to the shared object is assigned to the consumer account 515 (e.g., Bert's account). The shared object link can be copied by the provider account and sent to other users (e.g., Bert) along with login information (e.g., username and password) to access and activate the consumer account 515 (e.g., as a consumer account session for a network service).

[0104] Figure 7C 7 shows a user interface 720 displaying a login window 730 for accessing a shared object, according to some example embodiments. In the illustrative example, user "Bert" receives a shared object URL, username, and password information (e.g., via email) and displays user interface 720 with the shared object URL in an address bar 725 of an Internet browser. After entering the correct information into the username and password fields (e.g., Fig. 7A After logging in with the user name and password data discussed in the previous section) and selecting the login button, a consumer account session is activated for the consumer account 515 on the network-based data warehouse system 102. In the consumer account session, the user can create additional databases, query data, modify data, and access data objects shared with the consumer account (e.g., shared objects created and shared by the provider account 505).

[0105] Fig.7D A user interface 735 is shown that displays a window 740 that can be used to create a database instance according to some example embodiments. The user interface 735 can be displayed in response to the login button being selected, where the correct information fills the login and password fields. The consumer account 515 can use the window 740 to create a database instance in which computing resources (e.g., virtual warehouses) and shared objects (e.g., a read-only database showing patient data (Patient Data)) are shared. For example, using the Create Compute element, a drop-down menu is displayed that allows consumers (e.g., data consumers, consumer accounts 515) to create virtual warehouses of different sizes (e.g., EC2 clusters of different sizes, such as small clusters, medium clusters, and large clusters), and generate databases on the virtual warehouses, where the data populated in the databases comes from the storage devices of the provider account. As discussed, computing resources and storage resources are decoupled, and the consumer account 515 can manage (e.g., establish payment, create, change, terminate) virtual warehouses to access shared object data or other data (e.g., new data generated by another user of the consumer account that is unrelated to the shared object data).

[0106] Window 740 also includes an identifier ("Shared Data") indicating what shared data will be loaded into the database instance ("Patient Data") created on the virtual warehouse of the consumer account, and a Database Name field that allows the consumer account 515 to name the newly created database populated with the shared object data. In response to receiving a selection of the Create Database button in window 740, a new virtual warehouse (e.g., a new EC2 cluster of a small scale (e.g., four virtual machines) is generated for the consumer account 515, a new database instance is generated on the new virtual warehouse, and the data from the shared object is used to populate the database. In this way, the consumer account handles computing resources without affecting the data provider's system (e.g., without affecting the database provider's projection server that generates and stores data 510).

[0107] Fig. 7E 745 for interacting with shared object data is shown in accordance with some example embodiments. Continuing with this example, a user of consumer account 515 can use user interface 745 to interact with the shared object data on the newly created repository. For example, side panel 750 lists the data managed by the newly created repository, execution area 755 can receive code to execute against the shared object data, and the results of the executed code are displayed in results area 760. For example, a user of consumer account 515 can enter an SQL query into execution area 755 and then execute a query against the shared object data on the repository created by the consumer account 515. Fig.7D The query is performed on the shared object data in the newly created database running on the new warehouse created by the consumer account in . In this way, users of the consumer account can access and interact with the real-time production data of the provider account in a secure manner, where updates to the shared object data (e.g., updates to the production server from which the shared object data is derived) occur in real time, and the consumer's calculations do not affect the provider account system because the calculations are performed on the virtual warehouse created and managed by the consumer account 515.

[0108] Figure 8 An example data architecture 800 for dynamic masking of shared data objects is shown in accordance with some example embodiments. Figure 8 In the example of , data provider network 805 is a network (e.g., a private company network of a hospital) with provider users such as provider user 807, who manage provider data such as table 809. Data provider network 805 seeks to share access to table 809 with data consumer network 810 (e.g., an infectious disease think tank) in a controlled manner. In one example, provider user 807 is a physician user of data provider network 805, and table 809 may include data such as Figure 6600 and 605 in the data warehouse system 102, and the provider user 807 seeks to share the table 809 with users in other companies (e.g., a data consumer network) for analysis, where the table 809 undergoes dynamic data masking via a shared masking engine on the network-based data warehouse system 102. Typically, to share data, the data provider uploads the data to a network location (e.g., FTP to cloud storage 615) and then downloads the data to the data consumer network 810. This traditional approach is problematic, at least because uploading and downloading data can be a very slow process when the amount of data is large (e.g., in a global enterprise network), resulting in significant network overhead, if not completely impractical. In addition, these approaches have minimal privacy protection because the data is shared in an all-or-nothing manner, where the data consumer 810 can access all of the shared data or none of the shared data (e.g., sharing only a few columns would require creating a new data object and then sharing the new data object, which can be equally cumbersome and impractical as the size of the shared data increases). In addition, in conventional approaches, once data is sent to a data consumer, the data sent becomes outdated immediately at the moment any changes are made to the original data (e.g., updates to table 809). Although data consumer network 810 may prefer direct access to table 809 (e.g., access to production server data), many data providers do not provide such direct access for privacy or network security considerations (e.g., to comply with legal data privacy laws, to avoid potential malicious network abuse, such as hacker attacks).

[0109] To address the aforementioned problems, according to some example embodiments, the network-based data warehouse system 102 uses a shared masking engine 225 to enable a data provider network 805 (e.g., users in the data provider network, such as provider user 808) to share access to real-time data with a data consumer network 810 (e.g., users in the data consumer network 810, such as consumer 1 and consumer 2) in a secure maskable manner. For example, as shown, a provider user 807 can upload a table 809 to a cloud storage 815, and then grant access to the network-based data warehouse system 102 to access the cloud storage 815 to retrieve or reference data (e.g., external tables) for masking and querying. As an alternative or supplement to cloud storage data, the provider user 807 can upload some or all of the data to a database in the network-based data warehouse system 102, such as database 116. The provider user 807 specifies one or more policies as policy data 817, and the policy data 817 dynamically masks the uploaded data according to the policy roles and functions specified by the masking rules of a given policy. The policy data 817 can be mapped to data stored locally (e.g., data in the database 116) and / or mapped to data in the cloud storage 815 (e.g., an external read-only table) to provide dynamic masking based on the policy data 817 when consumers (e.g., consumer_1 811 and consumer_2 812) request data via the network-based data warehouse system 102.

[0110] The policy data 817 may specify roles and how users with different roles interact with the corresponding data referenced by the policy. For example, consumer_1 may be assigned a data engineer role on the network-based data warehouse system 102 (e.g., via user account information of consumer_1), while consumer_2 may be assigned a doctor on the network-based data warehouse system 102 (via user account information of consumer_2). In this example, when a consumer requests access to table 809 through the network-based data warehouse system 102 (e.g., a consumer account session), the shared masking engine 225 accesses the policy data 817 and modifies the data according to the roles and functions in the policy data 817. For example, the policy data may specify that the data engineer role should not see a given column in the policyized object 827 (e.g., the patient's full name), while a user with a doctor role (e.g., consumer_2) can see a given column in the policyized object 837, where seeing can be visibility, unconverted format, or performing operations on the data (e.g., a join operation to connect data from multiple tables).

[0111] In this way, users of the data provider network 805 can share part of their data with the data consumer network 810 in a dynamically shielded manner, where the underlying shared data can come from different sources. Figure 6Table 600 in is stored in database 116 and is readable and modifiable by network-based data warehouse system 102, and it is further assumed that table 605 is an external table on cloud storage 815, which is a read-only table that can only be referenced by network-based data warehouse system 102. Given these constraints, provider user 807 can create a shared view, where the view extracts data from a first local table (e.g., symptom data for a given customer) and also extracts data from a second external table (e.g., zip code data for a given customer), while optionally including a patient column or transforming a patient name column (e.g., displaying only the first initial), or anonymizing other data (e.g., changing zip code information to regional information, such as city, county, or state data), while keeping the shared data accessed (e.g., 827 and 837) real-time and up-to-date because the data is dynamically masked (e.g., when queried in a session of a consumer account).

[0112] Fig. 9 An example policy data architecture 900 is shown according to some example embodiments. A resource 905 is a data store (e.g., a database, table, view, share) mapped to a masking policy 910 that includes one or more rules. In some example embodiments, in response to a given resource 905 being requested (e.g., a database requested to populate consumer accounts 515), the shared masking engine 225 identifies the masking policy 910 to implement shared masking. The masking policy 910 includes one or more rules 920, each of which may include one or more roles 925 and one or more functions 930 to be implemented when the role is fulfilled. That is, the rule 920 is the logic (e.g., if / then), the role 925 is the condition, and the function 930 is the operation (e.g., user defined function (UDF)) implemented on the resource 905 when the logic and condition are met.

[0113] Function 930 can be created as a user-defined function that operates using a query language, such as a SQL UDF that evaluates an SQL expression and returns the result of the expression. The expression that defines the UDF can reference the input parameters of the function and can also reference database objects such as tables, views, and sequences. According to some example embodiments, the UDF owner (e.g., the user who defines the UDF) must have appropriate privileges on any database objects accessed by the UDF. The definition expression of a SQL UDF can reference other user-defined functions, although a UDF does not typically reference itself recursively, either directly or by calling it through another function. As a simple example, the following SQL statement can be entered into execution area 755 to create a function to calculate the area of ​​a circle:

[0114] ::::::::Code 1 - Getting Started:::::::: CREATE FUNCTION area_of_circle(radius FLOAT) RETURNS FLOAT AS

[0115] pi() * radius * radius ; ::::::: Code 1 - End:::::::: The function can be triggered using a query expression, such as a SELECT expression, as follows: ::::::::Code 2 - Getting Started:::::::: SELECT area_of_circle(1.0); ::::::::Code 2 - End::::::::: It returns the following output (for example, Fig. 7E Results in area 760): ::::::::Code 3 - Getting Started::::::::

[0117] ::::::::Code 3 - End::::::::: Examples of functions for masking include: hiding a column, masking the first three characters of each entry of a given column (e.g., hiding an area code), masking the first five characters of each row, converting or obfuscating a zip code (e.g., replacing zip code information with city or state information to obfuscate where a given patient is located), joining data from two tables (e.g., a local table and external read-only data) and returning a view, and other types of additional custom user-defined operations. It should be understood that the example functions discussed are merely examples, and any database function may be included as a function 930. In some example embodiments, the masking policy 910 for a given resource 905 is mapped to a default function 915, which is implemented if no rule data (e.g., rules 920, roles 925, functions 930) is created. For example, the default function 915 may include: complete masking of social security data, or giving only three roles access to a given resource 905 by default (e.g., the CEO, CFO, and GC of a company receive full access to a given resource 905).

[0118] The sample policy code is included here as an example. The sample code can be implemented by the data provider account 505 to create, change or terminate policy data by entering the sample code into the execution area 755 (e.g., a browser window of an active session). In some example embodiments, the policy code is SQL, which is stored in one or more policy tables in the policy data 817, and then the shared masking engine 225 can reference the policy code to dynamically mask data.

[0119] According to some example embodiments, the following represents an example syntax for creating a masking policy. In the following examples, each CASE statement represents the entire policy body, where each WHEN...THEN... clause specifies a rule. Policies can be created with multiple rules and default functions, where a rule can be applied based on the execution context, such as roles, sharing. The policy body is a SQL expression that can be specified using a CASE...END statement, where each WHEN...THEN clause acts as a rule. According to some example embodiments, the policy will be evaluated as a SQL expression, so if specified as a WHEN...THEN clause in the body, the rules are evaluated in order. According to some example embodiments, functions can be executed based on role matching and any additional conditions contained in the WHEN...THEN.

[0120] ::::::::Code 4 - Getting Started:::::::: CREATE [OR REPLACE] MASKING POLICY <name>as (val string) returns string -> CASE WHEN current_role() IN ('analyst ', 'dataeng') THEN DB1.UNMASK(val) / / analyst and dataeng are roles, DB1.UNMASK is the path passed to the UDF val parameter WHEN share() IN ('crm_table) then DB1.PARTIAL_MASK(val, '#') / / Additional conditions for share() ELSE DB1.SCHM1.FULL_MASK(val) END; ::::::::Code 4 - End::::::::: According to some example embodiments, the following syntax is a discard policy.

[0121] ::::::::Code 5 - Getting Started:::::::: DROP MASKING POLICY if EXISTS zip_mask; ::::::::Code 5 - End::::::::: The following syntax will change the masking policy, replacing the existing rules with new rules. In addition, according to some example embodiments, alter can be used to set a new comment for the masking policy.

[0122] ::::::::Code 6 - Getting Started:::::::: ALTER MASKING POLICY if EXISTS zip_mask CASE WHEN EXECUTING_ROLE() IN (analyst, data_engineer) thendb1.first3digits(number) WHEN EXECUTING_ROLE() IN (engineer, sales, sales_eng) thendb1.first5digits(number) ELSE db1.fullmask(number) END; ALTER MASKING POLICY if EXISTS zip_mask AS db1.fullmask(number); / / Change the existing mask zip_mask to set the new annotation ALTER MASKING POLICY if EXISTS zip_mask SET COMMENT = 'locationmasking policy for user data' ::::::::Code 6 - End::::::::: It should also be understood that although SQL is implemented in the above examples, the masking policy may be stored and implemented in other ways, such as storing the policy as JSON data and using a scripting language (eg, JavaScript) to perform the masking.

[0123] Furthermore, according to some example embodiments, when resource objects are combined, the masking policies of the objects can be combined. For example, a first masking policy can be mapped to a database table, where one or more columns of the database table are contained in a database view, where the view has its own masking policy mapped to it. In this example embodiment, the first masking policy can be dynamically applied to the database table, followed by applying the view masking policy to generate the resulting masked data. In this way, each database object can have a fine-tuned policy mask that can be combined in different configurations to create a tightly controlled data sharing architecture.

[0124] Fig.10 A flow chart of a method 1000 for configuring a shared masking policy using a resource project according to some example embodiments is shown. The method 1000 may be embodied as computer-readable instructions executed by one or more hardware components (e.g., one or more processors) such that the operations of the method 100 may be performed by components of a network-based data warehouse system 102. Accordingly, the method 1000 is described below with reference to examples thereof. However, it should be understood that the method 1000 may be deployed on a variety of other hardware configurations and is not intended to be limited to deployment within a network-based data warehouse system 102.

[0125] At operation 1005, the shared masking engine 225 identifies storage resources from which data can be dynamically masked. For example, at operation 1005, a table containing patient data is selected as a storage resource (e.g., by a user logged into a data provider account) to create a dynamically masked view or share.

[0126] At operation 1010, the shared masking engine 225 stores one or more functions to be included in the policy data. For example, at operation 1010, a user-defined function is created (e.g., by a data provider or data engineer / developer) to perform an operation on the data, such as completely masking a given column, or transforming the data in a given column (e.g., transforming zip code data into city, county, or region data). In some example embodiments, operation 1010 is optional; for example, functions that may be included in the policy have already been created and / or available functions are stored in a function library.

[0127] At operation 1015, the shared shielding engine 225 generates a shared shielding policy. For example, at operation 1015, the shared shielding engine 225 stores the policy mapped to the storage resource of operation 1005 and stores further mapping data, the mapping data including role data and a function to be implemented if the role data matches a user role of a current session (e.g., a session of a logged-in user requesting access).

[0128] At operation 1020, the shared masking engine 225 receives data to be dynamically masked from a user of the provider account. The generated database object may be the same as the storage resource object, or may be derived from the stored resource object. For example, the storage resource object of operation 1005 may be a table as described above, and the database object generated at operation 1020 may be a view incorporating one or more columns from the table. Because the database object (e.g., view) generated at operation 1020 includes columns from the dynamically masked storage resource object (e.g., a zip code column in the table identified at operation 1005), whenever data of the database object (view) is requested, the corresponding storage resource data is incorporated, and the stored shared masking policy is initiated for the view.

[0129] At operation 1025, the shared shielding engine 225 receives an instruction to send the database object from the provider account 505. For example, at operation 1025, the user of the provider account 505 sends a link to the view to one or more other users of the network-based data warehouse system 102 (e.g., another user of the consumer account 515) via email.

[0130] Fig.11 A flow chart of a method 1100 for interacting with dynamic shielding data is shown according to some example embodiments. The method 1100 may be embodied as computer-readable instructions executed by one or more hardware components (e.g., one or more processors) such that the operations of the method 1100 may be performed by components of the network-based data warehouse system 102. Accordingly, the method 1100 is described below with reference to examples thereof. However, it should be understood that the method 1100 may be deployed on a variety of other hardware configurations and is not intended to be limited to deployment within the network-based data warehouse system 102.

[0131] At operation 1105, the shared screening engine 225 initiates a session for the consumer account of the network-based data warehouse system 102. For example, at operation 1105, the consumer account 515 loads a login screen ( ) by entering a link to a view (received from the provider account 505) into the address bar of a browser. Figure 7C ), log in and present a consumer account user interface, such as user interface 735 ( Fig.7D ), where the link is to the database object transmitted at 1025 (e.g., the data provider user sends a link to the object to the data consumer user via email, where the link is an entry to the database object that will be dynamically masked according to method 1000).

[0132] At operation 1110, the shared shielding engine 225 generates computing resources (e.g., virtual warehouses) for use by a consumer account (e.g., consumer account 515), wherein the computing resources can be used to instantiate one or more databases to store shared data (e.g., shielded database objects). For example, as described above with reference to Fig.7D As described above, the consumer account 515 creates one or more virtual warehouses and creates a database instance.

[0133] At operation 1115, the shared shielding engine loads the shared and shielded data 515 for the consumer account. For example, at operation 1115, the shared data is automatically loaded into the database instance. At operation 1120, the consumer account 515 queries the shared shielding object by entering one or more SQL statements or expressions (e.g., SELECT) into the execution area 755 and displays it in the result area 760 ( Fig. 7E ) to interact with shared data.

[0134] Fig.12 A flow chart of a method 1200 for dynamically shielding a shared database object according to some example embodiments is shown. The method 1200 may be implemented as a subroutine initiated by an account requesting access to shared data (e.g., mapping shared data to a policy, or creating a data mapping of shared data to a policy). For example, in response to data loaded at operation 1115 (e.g., requested by a consumer account), the shared shielding engine 225 may initiate the method 1100.

[0135] At operation 1205, the shared shielding engine 225 identifies the resource ID (e.g., source database table) of the requested data (e.g., a view that combines columns from the source database table) and the role ID of the user of the consumer account 515 logged into the active session. At operation 1210, the shared shielding engine 225 retrieves the policy data mapped to the resource ID. At operation 1215, the shared shielding engine 225 identifies one or more rules in the policy that meet the condition. For example, at operation 1215, the shared shielding engine 225 determines that the rule matches the specified role (e.g., the user role of the active session), or matches any other specified rule in the policy (e.g., the share() rule). If at operation 1215, the shared shielding engine 225 determines that there is no rule that matches the condition (e.g., the role ID of the consumer account 515 is the "doctor" role, and there is no rule in the policy that specifies the doctor role), the method 1200 proceeds to operation 1220, in which the default function of the policy is executed and the data is returned as a subroutine result.

[0136] Returning to operation 1215, assuming that one or more rules exist for the identified role ID of the consumer account of the active session, method 1200 proceeds to operation 1225, in which the user-defined function of the rule is executed and the dynamically masked data is returned for display (e.g., on the user device of the consumer account user). In addition, as shown, if there are additional rules defined for the role ID of the consumer account 515, the shared masking engine 225 loops back to 1215 (e.g., a first function can transform data in a given column and a second function can use the transformed data as input data for further transformation or masking operations; for example, a given role has two activated functions, each of which runs independently of the other or simultaneously). Assuming there are additional rules, method 1200 evaluates these rules and returns rule results for further rules that match the role ID at operation 1225. After the method 1200 terminates, the shared shielding engine 225 returns the dynamically shielded data to the consumer account system (e.g., the remote computing device 106 operated by the consumer account 515) for analysis and further interaction (e.g., query) by the consumer account 515, such as Fig.11 as discussed in (e.g., in operation 1120).

[0137] According to an example embodiment, Fig.13 A schematic diagram of a machine 1300 is shown in the form of a computer system within which a set of instructions for causing the machine 1300 to perform any one or more of the methodologies discussed herein may be executed. Specifically, Fig.13 A schematic diagram of a machine 1300 is shown in the example form of a computer system within which instructions 1316 (e.g., software, programs, applications, applet, small application (app) or other executable code) for causing the machine 1300 to perform any one or more of the methods discussed herein are executed. For example, the instructions 1316 may cause the machine 1300 to perform any one or more operations of any one or more of the methods 1000, 1100 and 1200. As another example, the instructions 1316 may cause the machine 1300 to implement Figure 1-9 In this manner, the instructions 1316 convert a general-purpose, unprogrammed machine into a specific machine 1300 (e.g., remote computing device 106, access management system 110, computing service manager 112, execution platform 113, access management system 118, API gateway 120, remote computing device 106) that is specifically configured to perform any of the functions described and illustrated in the manner described herein.

[0138] In alternative embodiments, the machine 1300 operates as a standalone device or can be coupled (e.g., networked) to other machines. In a networked deployment, the machine 1300 can operate as a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine 1300 may include, but is not limited to, a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a smart phone, a mobile device, a network router, a network switch, a network bridge, or any machine capable of sequentially or otherwise executing instructions 1316, which specify actions taken by the machine 1300. In addition, although only a single machine 1300 is shown, the term "machine" should also be understood to include a collection of machines 1300 that execute instructions 1316 individually or jointly to implement any one or more of the methods discussed herein.

[0139] The machine 1300 includes a processor 1310, a memory 1330, and an input / output (I / O) component 1350, which are configured to communicate with each other, for example, via a bus 1302. In an example embodiment, the processor 1310 (e.g., a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, a processor 1312 and a processor 1314 that may execute instructions 1316. The term "processor" is intended to include a multi-core processor 1310, which may include two or more independent processors (sometimes referred to as "cores") that may execute instructions 1316 simultaneously. Although Fig.13 Multiple processors 1310 are shown, but the machine 1300 may include a single processor with a single core, a single processor with multiple cores (eg, a multi-core processor), multiple processors with a single core, multiple processors with multiple cores, or any combination thereof.

[0140] The memory 1330 may include a main memory 1332, a static memory 1334, and a storage unit 1336, all of which may be accessed by the processor 1310, for example, via the bus 1302. The main memory 1332, the static memory 1334, and the storage unit 1336 store instructions 1316, which may embody any one or more of the methods or functions described herein. During execution by the machine 1300, the instructions 1316 may also reside, in whole or in part, within the main memory 1332, within the static memory 1334, within the storage unit 1336, within at least one processor 1310 (e.g., within a processor's cache), or any suitable combination thereof.

[0141] I / O components 1350 include components for receiving input, providing output, generating output, transmitting information, exchanging information, capturing measurements, etc. The specific I / O components 1350 included in a particular machine 1300 will depend on the type of machine. For example, a portable machine such as a mobile phone will likely include a touch input device or other such input mechanism, while a headless server machine may not include such a touch input device. It will be appreciated that I / O components 1350 may include Fig.13 1350 is grouped according to function only to simplify the following discussion, and the grouping is by no means limiting. In various example embodiments, the I / O component 1350 may include an output component 1352 and an input component 1354. The output component 1352 may include a visual component (e.g., a display such as a plasma display panel (PDP), a light emitting diode (LED) display, a liquid crystal display (LCD), a projector, or a cathode ray tube (CRT)), an acoustic component (e.g., a speaker), other signal generators, etc. The input component 1354 may include an alphanumeric input component (e.g., a keyboard, a touch screen configured to receive alphanumeric input, an optical keyboard, or other alphanumeric input component), a point-based input component (e.g., a mouse, a touch pad, a trackball, a joystick, a motion sensor, or another pointing instrument), a tactile input component (e.g., a physical button, a touch screen or other tactile input component that provides the location and / or force of a touch or touch gesture), an audio input component (e.g., a microphone), etc.

[0142] Communication can be implemented using a variety of technologies. The I / O component 1350 may include a communication component 1364, which is operable to couple the machine 1300 to a network 1380 or a device 1370 via coupling 1382 and coupling 1372, respectively. For example, the communication component 1364 may include a network interface component or another suitable device that interfaces with the network 1380. In a further example, the communication component 1364 may include a wired communication component, a wireless communication component, a cellular communication component, and other communication components that provide communication via other modalities. The device 1370 may be another machine or any of a variety of peripheral devices (e.g., a peripheral device coupled via a universal serial bus (USB)). For example, as described above, the machine 1300 may correspond to any of the remote computing devices 106, the access management system 110, the computing service manager 112, the execution platform 113, the access management system 118, the API gateway 120, and the computing devices 203, 207, 307, and 401, and the device 1370 may include any of these systems and devices.

[0143] Various memories (e.g., memories of 1330, 1332, 1334 and / or processor 1310 and / or storage unit 1336) may store one or more sets of instructions 1316 and data structures (e.g., software) that embody or are utilized by any one or more of the methods or functions described herein. When executed by processor 1310, these instructions 1316 cause various operations to implement the disclosed embodiments.

[0144] As used herein, the terms "machine storage medium", "device storage medium" and "computer storage medium" mean the same and may be used interchangeably in this disclosure. These terms refer to a single or multiple storage devices and / or media (e.g., centralized or distributed databases and / or associated caches and servers) that store executable instructions and / or data. Accordingly, these terms should be considered to include, but are not limited to, solid-state memory including memory internal or external to the processor, and optical and magnetic media. Specific examples of machine storage media, computer storage media and / or device storage media include non-volatile memory, including, for example, semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), field programmable gate arrays (FPGAs), and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM optical disks. The terms "machine storage medium", "computer storage medium" and "device storage medium" specifically exclude carrier waves, modulated data signals, and other such media (at least some of which are included in the term "signal media" discussed below).

[0145] In various example embodiments, one or more portions of network 980 may be an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), the Internet, a portion of the Internet, a portion of a public switched telephone network (PSTN), a plain old telephone service (POTS) network, a cellular telephone network, a wireless network, a Wi-Fi® network, another type of network, or a combination of two or more such networks. For example, network 1380 or a portion of network 1380 may include a wireless or cellular network, and coupling 1382 may be a code division multiple access (CDMA) connection, a global system for mobile communications (GSM) connection, or another type of cellular or wireless coupling. In this example, coupling 1382 can implement any of a variety of types of data transmission technologies, such as single carrier radio transmission technology (1xRTT), evolution data optimized (EVDO) technology, general packet radio service (GPRS) technology, enhanced data rates for GSM evolution (EDGE) technology, including 3G, fourth generation wireless (4G) networks, universal mobile telecommunications system (UMTS), high speed packet access (HSPA), worldwide interoperability for microwave access (WiMAX), the third generation partnership project (3GPP) of the long term evolution (LTE) standard, other technologies defined by various standard setting organizations, other long range protocols, or other data transmission technologies.

[0146] The instructions 1316 may be transmitted or received over the network 1380 using a transmission medium via a network interface device (e.g., a network interface component included in the communication component 1364) and utilizing any of a number of well-known transmission protocols (e.g., the Hypertext Transfer Protocol (HTTP)). Similarly, the instructions 1316 may be transmitted or received to the device 1370 using a transmission medium via a coupling 1372 (e.g., a peer-to-peer coupling). The terms "transmission medium" and "signal medium" have the same meaning and may be used interchangeably in this disclosure. The terms "transmission medium" and "signal medium" should be understood to include any intangible medium that is capable of storing, encoding, or carrying the instructions 1316 executed by the machine 1300, and include digital or analog communication signals or other intangible media that facilitate the communication of such software. Thus, the terms "transmission medium" and "signal medium" should be understood to include any form of modulated data signal, carrier wave, etc. The term "modulated data signal" means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.

[0147] The terms "machine-readable medium", "computer-readable medium" and "device-readable medium" mean the same and may be used interchangeably in this disclosure. These terms are defined to include both machine storage media and transmission media. Thus, these terms include both storage devices / medium and carrier / modulated data signals.

[0148] The various operations of the example methods described herein may be performed at least in part by (e.g., by software) one or more processors that are temporarily configured or permanently configured to perform related operations. Similarly, the methods described herein may be implemented by a processor at least in part. For example, at least some operations of methods 1000, 1100, and 1200 may be performed by one or more processors. The execution of certain operations may be distributed in one or more processors, not only residing in a single machine, but also deployed on multiple machines. In some example embodiments, one or more processors may be located in a single location (e.g., in a home environment, an office environment, or a server farm), while in other embodiments, the processors may be distributed in multiple locations.

[0149] Although embodiments of the present disclosure have been described with reference to specific example embodiments, it is apparent that various modifications and variations may be made to these embodiments without departing from the broader scope of the subject matter of the present invention. Accordingly, the specification and the accompanying drawings are considered to be illustrative rather than restrictive. The accompanying drawings, which form a part thereof, show specific embodiments in which the subject matter may be implemented by way of illustration and not by way of limitation. The illustrated embodiments are described in sufficient detail to enable those skilled in the art to implement the teachings disclosed herein. Other embodiments and embodiments derived therefrom may be used so that structural or logical substitutions and changes may be made without departing from the scope of the present disclosure. This detailed description is therefore not to be understood in a restrictive sense, and the scope of the various embodiments is limited only by the appended claims together with the equivalents of the full scope of such claims authorized.

[0150] Such embodiments of the subject matter of the invention may be referred to herein, individually and / or collectively, by the term "invention," which term is used merely for convenience and is not intended to voluntarily limit the scope of the present application to any single invention or inventive concept, if more than one is actually disclosed. Thus, while specific embodiments have been illustrated and described herein, it should be understood that the specific embodiments shown may be replaced with any arrangement calculated to achieve the same purpose. The present disclosure is intended to cover any and all modifications or variations of the various embodiments. Combinations of the above embodiments, as well as other embodiments not specifically described herein, will be apparent to those skilled in the art upon reading the above description.

[0151] In this document, the terms "a" or "an," as is common in patent documents, are used to include one or more than one, independent of any other instances or uses of "at least one" or "one or more." In this document, the term "or" is used to refer to a non-exclusive or, thus "A or B" includes "A but not B," "B but not A," and "A and B," unless otherwise noted. In the appended claims, the terms "including" and "in which" are used as the plain-English equivalents of the respective terms "comprising" and "wherein." Furthermore, in the appended claims, the terms "comprising" and "including" are open-ended; that is, systems, apparatus, articles, or processes that include elements in addition to those listed after such terms in a claim are still considered to fall within the scope of that claim.

[0152] The following numbered examples are embodiments: 1. A method, comprising: identifying, on a website, a database object generated by a first client device of a first end user of the website; receiving from the first client device a shared masking policy for modifying data in the database object, the shared masking policy specifying a user role type that initiates one or more preconfigured masking operations on the database object; generating a network link for accessing the database object by a second end user of the website; receiving from a second client device of the second end user a request to access the database data using the network link; in response to the request from the second client device, determining that an end user role of the second end user matches a user role type of the shared masking policy; in response to the end user role matching the user role type of the shared masking policy, applying one or more preconfigured masking operations to the database object to generate a masked database object; and causing the second client device of the second end user to present resultant data from the masked database object.

[0153] 2. The method of example 1, wherein the request from the second client device is a query.

[0154] 3. The method of example 1 or 2, wherein the query includes a select statement, and wherein the select statement is applied to the masked database objects to generate result data displayed in the presentation.

[0155] 4. The method of any of Examples 1-3, wherein the database object is stored in a first database instance managed by a first end user, and wherein the shielded database object is hosted on a second database instance managed by a second end user without copying the database object from the first database instance to the second database instance.

[0156] 5. The method of any of Examples 1-4, wherein the database object includes one or more external tables.

[0157] 6. The method of any of Examples 1-5, wherein the shared shielding policy is received in a structured query language (SQL) format and stored in a shared shielding database.

[0158] 7. The method of any of Examples 1-6, wherein a shared masking policy is mapped to a database object, the shared masking policy comprising a plurality of user role types including a user role type, wherein each of the plurality of user role types is mapped to a function that masks the database object.

[0159] 8. The method of any one of Examples 1-7, wherein the function is a database function executable on a database object to perform one or more transformations on one or more columns of the database object.

[0160] 9. The method of any of Examples 1-8, wherein: the shared masking policy is a first shared masking policy; and the database object is a database view mapped to the shared masking policy, the database view containing data from a database table mapped to a second shared masking policy.

[0161] 10. The method of any of Examples 1-9, wherein a second shared masking policy is implemented on the database table to generate masked table data contained in the database view, wherein the database view including the masked table data is further masked according to the shared masking policy to generate the masked database object.

[0162] 11. A system comprising: one or more processors of a machine; and a memory storing instructions, which, when executed by the one or more processors, cause the machine to perform operations implementing any one of the example methods 1 to 10.

[0163] 12. A machine-readable storage device containing instructions, which, when executed by a machine, causes the machine to perform operations to implement one of methods 1 to 10.< / name>

Claims

1. A method comprising: receiving a shared masking policy from a first client device of a first end user of a network site, the shared masking policy being used to modify data in a database object of the network site, the shared masking policy comprising a user defined function (UDF) for initiating a masking operation on the database object in response to a request from the network site to access the database object through the network site by an end user role type; receiving a request to access the database object from a second client device of a second end user of the network site; Determining that the terminal user role of the second terminal user matches the terminal user role type in the shared shielding policy; applying the user defined function to the database object to generate masked data; as well as The masked data is presented on the second client device.

2. The method according to claim 1, further comprising: A database statement is received from the first client device of the first end user, the database statement mapping the end-user role type to an end-user role of the second end user such that data from a database view object is masked when requested by the second end user using the website. The method of claim 1 , wherein the request from the second client device comprises a query. The method of claim 3 , wherein the query comprises a select statement, and wherein the select statement is applied to the masked data.

5. The method of claim 1 , wherein a database view object is stored in a first database instance managed by the first end user, and wherein the masked data is hosted on a second database instance managed by the second end user without copying the database view object from the first database instance to the second database instance.

6. The method of claim 1, wherein the shared shielding policy is received in a structured query language (SQL) format and stored in a shared shielding database.

7. The method of claim 1, wherein the shared masking policy is mapped to a database view object.

8. The method of claim 1, wherein the user defined function is one of a plurality of database UDFs, the database UDF is a SQL UDF, wherein the end-user role type is one of a plurality of end-user role types, and wherein the method further comprises: receiving a plurality of end-user role types in SQL format from the first client device; receiving the SQL UDF from the first client device to apply the SQL UDF to a database view object upon receiving a request for the database view object from at least one of the plurality of end-user role types; and The plurality of end-user role types and corresponding SQL UDFs are stored as the shared masking strategy for modifying data of the database view object.

9. The method according to claim 1, wherein: The shared masking policy is a first shared masking policy; and The database view object is a database view object mapped to the shared masking policy, and the database view object contains data from a database table mapped to a second shared masking policy.

10. The method of claim 9, wherein the second shared masking policy is implemented on the database table to generate masked table data contained in the database view object, wherein the database view object including the masked table data is further masked according to the shared masking policy to generate the masked data displayed on the second client device.

11. A system comprising: means for receiving a shared masking policy from a first client device of a first end user of a network site, the shared masking policy for modifying data in a database object of the network site, the shared masking policy comprising a user defined function for initiating a masking operation on the database object in response to a request from the network site for an end user role type of an end user accessing the database object through the network site; means for receiving a request to access the database object from a second client device of a second end user of the network site; means for determining that an end-user role of the second end-user matches an end-user role type in the shared shielding policy; means for applying said user defined function to said database object to generate masked data; as well as Means for causing presentation of the masking data on the second client device.

12. A method comprising: receiving a shared masking policy from a first client device, the shared masking policy being used to mask data in a database view object, the database view object comprising data from one or more external tables, the shared masking policy comprising a condition associated with an end-user role type to initiate a masking operation on the database view object in response to a second client device associated with the end-user role type requesting access to the database view object, the one or more external tables comprising one or more read-only external tables; as well as Generating masking data for transmission to the second client device based on a condition associated with an end-user role type of the second client device includes converting a first readable portion of information stored in a column of the database view object into a second readable portion of information.

13. A system comprising: one or more processors of the machine; as well as A memory storing instructions that, when executed by the one or more processors, cause the machine to perform operations including: receiving a shared masking policy from a first client device, the shared masking policy being used to mask data in a database view object, the database view object comprising data from one or more external tables, the shared masking policy comprising a condition associated with an end-user role type to initiate a masking operation on the database view object in response to a second client device associated with the end-user role type requesting access to the database view object, the one or more external tables comprising one or more read-only external tables; and Generating masking data for transmission to the second client device based on a condition associated with an end-user role type of the second client device includes converting a first readable portion of information stored in a column of the database view object into a second readable portion of information.

14. A method comprising: receiving, by one or more processors, a shared screening policy from a first client device; and Masking data is generated based on the shared masking policy, the generating the masking data comprising converting a first readable portion of information stored in a column of a database view object into a second readable portion of information.

15. A system comprising: one or more processors; as well as A memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including: receiving a shared screening policy from a first client device; as well as Masking data is generated based on the shared masking policy, the generation of the masking data comprising converting a first readable portion of information stored in a column of a database view object into a second readable portion of information.

Images