Token-based secure database query result sharing

Abstract

The invention relates to token-based secure database query result sharing. Techniques for sharing query results in a multi-tenant database system are described. Query results may be shared among users of the same account or organization in a multi-tenant network-based database system using security tokens. The first user performs the query, and the results are stored in a web-based database system. The first user may invoke a function to create a security token to provide other users in the same account with access to the stored query results. The first user may share the security token with other users, which may directly access the results stored in the network-based database system without having to download a local copy of the query results.

Description

Technical Field

[0001] The present disclosure relates generally to databases and, more particularly, to sharing query results in a database system using security tokens.

[0002] background

[0003] As the world becomes more data-driven, database systems and other data systems are storing more and more data. Databases are widely used for data storage and access in computing applications. Using queries is a technique for analyzing data stored in database systems. Users often want to share data from query results with other users.

[0004] One method of sharing data is to require users to rerun queries. Thus, users can share query syntax, but the query is rerun for each shared user. However, executing queries can be expensive and time consuming, so this method involving rerunning queries is not efficient. Another method involves downloading a local copy of the query results and sending the downloaded local copy to other users. This method is unsafe and cumbersome because the local copy of the file can be very large. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The various drawings depict only example embodiments of the present disclosure and should not be considered to limit the scope of the present disclosure.

[0007] Figure 1 An example computing environment is shown in accordance with some example embodiments.

[0008] Figure 2 is a block diagram illustrating components of a computing service manager according to some example embodiments.

[0009] Figure 3 is a block diagram illustrating components of an execution platform according to some example embodiments.

[0010] Figure 4 A diagram illustrating a method for sharing query results within a network-based database system according to some example embodiments.

[0011] Figure 5 A security token data persistence object is shown according to some example embodiments.

[0012] Figure 6 A flow chart of a method for receiving access to stored query results using a security token is shown in accordance with some example embodiments.

[0013] Figure 7A diagrammatic representation of a machine in the form of a computer system within which a set of instructions for causing the machine to perform any one or more of the methodologies discussed herein may be executed is shown according to some embodiments of the present disclosure.

[0014] Detailed Description

[0015] The following description includes systems, methods, techniques, instruction sequences and computing machine program products that embody the illustrative embodiments of the present disclosure. In the following description, for the purpose of explanation, many specific details are set forth to provide an understanding of the various embodiments of the subject matter of the present invention. However, it is apparent to those skilled in the art that the embodiments of the subject matter of the present invention can be implemented without these specific details. Typically, well-known instruction instances, protocols, structures and techniques are not necessarily shown in detail.

[0016] This article describes a technology for sharing query results in a multi-tenant network-based database system. Query results can be shared between users of the same account or organization in a multi-tenant network-based database system using security tokens. A first user performs a query, and the results are stored in a network-based database system. The first user can call a function to create a security token to provide access to the stored query results to other users in the same account. The first user can share the security token with other users, and the other users can directly access the results stored in the network-based database system without having to download a local copy of the query results. Therefore, the life cycle of the shared query results can be managed within the network-based database system.

[0017] The security token technology described herein provides technical advantages, such as improved security, flexibility, and efficiency. The owner / creator of a security token can manage the lifecycle of the security token, and therefore manage access to query results within a network-based database system. In the network-based database system, query results are stored and maintained separately from the security token, providing security and saving storage resources.

[0018] Figure 1 An example shared data processing platform 100 is shown. In order to avoid obscuring the subject matter of the present invention with unnecessary detail, various functional components that are not closely related to conveying an understanding of the subject matter of the present invention are omitted from the figure. However, those skilled in the art will readily recognize that various additional functional components can be included as part of the shared data processing platform 100 to facilitate additional functions not specifically described herein.

[0019] As shown in the figure, the shared data processing platform 100 includes a network-based database system 102, a cloud computing storage platform 104 (e.g., a storage platform, Services, Microsoft or Google Cloud ) and remote computing device 106. The network-based database system 102 is a cloud database system that is used to store and access data in an integrated manner (e.g., store data internally and access data located externally remotely), and report and analyze integrated data from one or more different sources (e.g., cloud computing storage platform 104). Cloud computing storage platform 104 includes a plurality of computing machines and provides computer system resources, such as data storage and computing power, to the network-based database system 102 on demand. Although in Figure 1 In the illustrated embodiment, a data warehouse is depicted, but other embodiments may include other types of databases or other data processing systems.

[0020] The remote computing device 106 (e.g., a user device such as a laptop computer) includes one or more computing machines (e.g., a user device such as a laptop computer) that execute remote software components 108 (e.g., a cloud service accessed by a browser) to provide additional functionality to users of the network-based database system 102. The remote software components 108 include a set of machine-readable instructions (e.g., code) that, when executed by the remote computing device 106, cause the remote computing device 106 to provide certain functionality. The remote software components 108 can operate on input data and generate result data based on processing, analyzing, or otherwise transforming the input data. As an example, the remote software components 108 can be a data provider or a data consumer that implements a database tracking process.

[0021] The network-based database system 102 includes an access management system 110, a computing service manager 112, an execution platform 114, and a database 116. The access management system 110 enables administrative users to manage access to resources and services provided by the network-based database system 102. Administrative users can create and manage users, roles, and groups, and use permissions to allow or deny access to resources and services. As discussed in further detail below, the access management system 110 can store shared data that securely manages shared access to storage resources of the cloud computing storage platform 104 between different users of the network-based database system 102.

[0022] The computing service manager 112 coordinates and manages the operation of the network-based database system 102. The computing service manager 112 also performs query optimization and compilation, and manages computing service clusters (e.g., virtual warehouses, virtual machines, EC2 clusters) that provide computing resources. The computing service manager 112 can support any number of client accounts, such as end users who provide data storage and retrieval requests, system administrators who manage the systems and methods described herein, and other components / devices that interact with the computing service manager 112.

[0023] Computing service manager 112 is also coupled to database 116, which is associated with all data stored on shared data processing platform 100. Database 116 stores data related to various functions and aspects associated with network-based database system 102 and its users.

[0024] In some embodiments, database 116 includes a summary of data stored in a remote data storage system and data available from one or more local caches. In addition, database 116 may include information about how data is organized in the remote data storage system and the local cache. Database 116 allows systems and services to determine whether a data segment needs to be accessed without having to load or access the actual data from a storage device. Computing service manager 112 is also coupled to execution platform 114, which provides multiple computing resources (e.g., virtual warehouses) that perform various data storage and data retrieval tasks, as discussed in more detail below. For example, as discussed in more detail below, computing service manager 112 can generate and maintain security tokens to share query results with other users.

[0025] The execution platform 114 is coupled to a plurality of data storage devices 124-1 to 124-N that are part of the cloud computing storage platform 104. In some embodiments, the data storage devices 124-1 to 124-N are cloud-based storage devices located in one or more geographic locations. For example, the data storage devices 124-1 to 124-N may be part of a public cloud infrastructure or a private cloud infrastructure. The data storage devices 124-1 to 124-N may be hard disk drives (HDDs), solid-state drives (SSDs), storage clusters, Amazon S3 storage systems, or any other data storage technology. In addition, the cloud computing storage platform 104 may include a distributed file system (e.g., Hadoop distributed file system (HDFS)), an object storage system, and the like.

[0026] The execution platform 114 includes a plurality of computing nodes (e.g., virtual warehouses). A set of processes on the computing nodes executes a query plan compiled by the computing service manager 112. The set of processes may include: a first process that executes the query plan; a second process that uses a least recently used (LRU) strategy to monitor and delete micro-partition files and implement an out of memory (OOM) error mitigation process; a third process that extracts health information from process logs and status information to send back to the computing service manager 112; a fourth process that establishes communication with the computing service manager 112 after the system boots; and a fifth process that handles all communications with the computing cluster for a given job provided by the computing service manager 112 and transmits information back to the computing service manager 112 and other computing nodes of the execution platform 114.

[0027] The cloud computing storage platform 104 also includes an access management system 118 and a web agent 120. Like the access management system 110, the access management system 118 allows users to create and manage users, roles, and groups, and use permissions to allow or deny access to cloud services and resources. The access management system 110 of the network-based database system 102 and the access management system 118 of the cloud computing storage platform 104 can communicate and share information so as to access and manage resources and services shared by users of both the network-based database system 102 and the cloud computing storage platform 104. The web agent 120 handles tasks related to accepting and processing concurrent API calls, including traffic management, authorization and access control, monitoring, and API version management. The web agent 120 provides HTTP proxy services for creating, publishing, maintaining, protecting, and monitoring APIs (e.g., REST APIs).

[0028] In some embodiments, the communication links between the elements of the shared data processing platform 100 are implemented through one or more data communication networks. These data communication networks can utilize any communication protocol and any type of communication medium. In some embodiments, the data communication network is a combination of two or more data communication networks (or subnetworks) coupled to each other. In alternative embodiments, these communication links are implemented using any type of communication medium and any communication protocol.

[0029] like Figure 1As shown, data storage devices 124-1 to 124-N are decoupled from computing resources associated with execution platform 114. That is, new virtual warehouses can be created and terminated in execution platform 114, and additional data storage devices can be created and terminated on cloud computing storage platform 104 in an independent manner. The architecture supports dynamic changes of network-based database system 102, which are based on changing data storage / retrieval requirements and changing needs of users and systems to access shared data processing platform 100. Support for dynamic changes allows network-based database system 102 to scale rapidly in response to changing needs for systems and components within network-based database system 102. The decoupling of computing resources from data storage devices 124-1 to 124-N supports the storage of large amounts of data without requiring corresponding large amounts of computing resources. Similarly, this decoupling of resources supports a significant increase in computing resources used at a particular time without a corresponding increase in available data storage resources. In addition, the decoupling of resources enables different accounts to handle the creation of additional computing resources to process data shared by other users without affecting the systems of other users. For example, a data provider may have three computing resources and share data with a data consumer, and the data consumer may generate a new computing resource to perform queries on the shared data, where the new computing resource is managed by the data consumer and does not affect or interact with the computing resources of the data provider.

[0030] The computing service manager 112, the database 116, the execution platform 114, the cloud computing storage platform 104 and the remote computing device 106 are Figure 1 104 are shown as separate components. However, each of the computing service manager 112, database 116, execution platform 114, cloud computing storage platform 104, and remote computing environment can be implemented as a distributed system (e.g., distributed across multiple systems / platforms in multiple geographic locations) that is connected by an API and accesses information (e.g., tokens, login data). In addition, each of the computing service manager 112, database 116, execution platform 114, and cloud computing storage platform 104 can be expanded or reduced (independently of each other) based on changes in requests received and changes in the needs of the shared data processing platform 100. Therefore, in the described embodiment, the network-based database system 102 is dynamic and supports regular changes to meet current data processing needs.

[0031] During typical operation, the network-based database system 102 processes a plurality of jobs (e.g., queries) determined by the computing service manager 112. These jobs are scheduled and managed by the computing service manager 112 to determine when and how to execute the job. For example, the computing service manager 112 may divide the job into a plurality of discrete tasks, and may determine what data is needed to execute each of the plurality of discrete tasks. The computing service manager 112 may assign each of the plurality of discrete tasks to one or more nodes of the execution platform 114 to process the task. The computing service manager 112 may determine what data is needed to process the task, and further determine which nodes within the execution platform 114 are best suited to process the task. Some nodes may have cached the data needed to process the task (because the node has recently downloaded data for a previous job from the cloud computing storage platform 104), and are therefore good candidates for processing the task. The metadata stored in the database 116 helps the computing service manager 112 determine which nodes in the execution platform 114 have cached at least a portion of the data needed to process the task. One or more nodes in the execution platform 114 process tasks using data cached by the nodes and, when necessary, data retrieved from the cloud computing storage platform 104. It is desirable to retrieve as much data as possible from the cache within the execution platform 114, because the retrieval speed is generally much faster than retrieving data from the cloud computing storage platform 104.

[0032] like Figure 1 As shown, the shared data processing platform 100 separates the execution platform 114 from the cloud computing storage platform 104. In this arrangement, the processing resources and cache resources in the execution platform 114 operate independently of the data storage devices 124-1 to 124-N in the cloud computing storage platform 104. Therefore, the computing resources and cache resources are not limited to specific data storage devices 124-1 to 124-N. Instead, all computing resources and all cache resources can retrieve data from any data storage resource in the cloud computing storage platform 104, and store data in any data storage resource in the cloud computing storage platform 104.

[0033] Figure 2 is a block diagram illustrating components of the computing service manager 112 according to some embodiments of the present disclosure. Figure 2As shown, the request processing service 202 manages received data storage requests and data retrieval requests (e.g., jobs to be performed on database data). For example, the request processing service 202 can determine the data necessary to process a received query (e.g., a data storage request or a data retrieval request). The data can be stored in a cache within the execution platform 114, or in a data storage device in the cloud computing storage platform 104. The management console service 204 supports administrators and other system administrators access to various systems and processes. Additionally, the management console service 204 can receive requests to execute jobs and monitor the workload on the system.

[0034] The computing service manager 112 also includes a job compiler 206, a job optimizer 208, and a job executor 210. The job compiler 206 parses the job into multiple discrete tasks and generates execution code for each of the multiple discrete tasks. The job optimizer 208 determines the best method to execute the multiple discrete tasks based on the data that needs to be processed. The job optimizer 208 also handles various data pruning operations and other data optimization techniques to improve the speed and efficiency of executing the job. The job executor 210 executes the execution code of the job received from the queue or determined by the computing service manager 112.

[0035] The job scheduler and coordinator 212 sends the received jobs to the appropriate service or system for compilation, optimization and dispatch to the execution platform 114. For example, the jobs can be prioritized and processed in that priority order. In an embodiment, the job scheduler and coordinator 212 determines the priority of internal jobs scheduled by the computing service manager 112 and other "external" jobs (such as user queries that can be scheduled by other systems in the database but can utilize the same processing resources in the execution platform 114). In some embodiments, the job scheduler and coordinator 212 identifies or assigns specific nodes in the execution platform 114 to process specific tasks. The virtual warehouse manager 214 manages the operation of multiple virtual warehouses implemented in the execution platform 114. As described below, each virtual warehouse includes multiple execution nodes, each execution node including a cache and a processor (e.g., a virtual machine, an operating system-level container execution environment).

[0036] In addition, the computing service manager 112 includes a configuration and metadata manager 216 that manages information about data stored in remote data storage devices and local caches (i.e., caches in the execution platform 114). The configuration and metadata manager 216 uses metadata to determine which data micro-partitions need to be accessed to retrieve data for processing a particular task or job. The monitor and workload analyzer 218 oversees the processes executed by the computing service manager 112 and manages the distribution of tasks (e.g., workloads) across virtual warehouses and execution nodes in the execution platform 114. The monitor and workload analyzer 218 also reallocates tasks as needed based on the changing workload throughout the network-based database system 102, and can also reallocate tasks based on user (e.g., "external") query workloads that can also be processed by the execution platform 114. The configuration and metadata manager 216 and the monitor and workload analyzer 218 are coupled to the data storage device 220. Figure 2 The data storage device 220 in represents any data storage device within the network-based database system 102. For example, the data storage device 220 may represent a cache in the execution platform 114, a storage device in the cloud computing storage platform 104, or any other storage device.

[0037] Figure 3 is a block diagram illustrating components of the execution platform 114 according to some embodiments of the present disclosure. Figure 3 As shown, the execution platform 114 includes multiple virtual warehouses, which are elastic clusters of computing instances (e.g., virtual machines). In the example shown, the virtual warehouses include virtual warehouse 1, virtual warehouse 2, and virtual warehouse N. Each virtual warehouse (e.g., EC2 cluster) includes multiple execution nodes (e.g., virtual machines), and each execution node includes a data cache and a processor. The virtual warehouse can perform multiple tasks in parallel using multiple execution nodes. As discussed herein, the execution platform 114 can add new virtual warehouses and discard existing virtual warehouses in real time based on the current processing needs of the system and users. This flexibility allows the execution platform 114 to quickly deploy a large number of computing resources when needed, without having to continue to pay for them when those computing resources are no longer needed. All virtual warehouses can access data in any data storage device (e.g., any storage device in the cloud computing storage platform 104).

[0038] although Figure 3 Each virtual warehouse shown in includes three execution nodes, but a particular virtual warehouse may include any number of execution nodes. In addition, the number of execution nodes in a virtual warehouse is dynamic, so that new execution nodes are created when there is additional demand, and existing execution nodes are deleted when they are no longer needed (e.g., when a query or job is completed).

[0039] Each virtual warehouse can access Figure 1 Thus, the virtual warehouse does not have to be assigned to a specific data storage device 124-1 to 124-N, but the virtual warehouse can access data from any one of the data storage devices 124-1 to 124-N within the cloud computing storage platform 104. Similarly, Figure 3 Each execution node shown in can access data from any one of the data storage devices 124-1 to 124-N. For example, the storage device 124-1 of a first user (e.g., a provider account user) can be shared with a worker node in a virtual warehouse of another user (e.g., a consumer account user), so that the other user can create a database (e.g., a read-only database) and directly use the data in the storage device 124-1 without copying the data (e.g., copying it to a new disk managed by the consumer account user). In some embodiments, a specific virtual warehouse or a specific execution node can be temporarily assigned to a specific data storage device, but the virtual warehouse or execution node can later access data from any other data storage device.

[0040] exist Figure 3 In the example of , virtual warehouse 1 includes three execution nodes 302-1, 302-2 and 302-N. Execution node 302-1 includes cache 304-1 and processor 306-1. Execution node 302-2 includes cache 304-2 and processor 306-2. Execution node 302-N includes cache 304-N and processor 306-N. Each execution node 302-1, 302-2 and 302-N is associated with processing one or more data storage and / or data retrieval tasks. For example, a virtual warehouse can handle data storage and data retrieval tasks associated with internal services (such as clustering services, instantiated view refresh services, file compression services, stored program services, or file upgrade services). In other embodiments, a specific virtual warehouse can handle data storage and data retrieval tasks associated with a specific data storage system or a specific category of data.

[0041] Similar to the virtual warehouse 1 discussed above, virtual warehouse 2 includes three execution nodes 312-1, 312-2 and 312-N. Execution node 312-1 includes a cache 314-1 and a processor 316-1. Execution node 312-2 includes a cache 314-2 and a processor 316-2. Execution node 312-N includes a cache 314-N and a processor 316-N. In addition, virtual warehouse 3 includes three execution nodes 322-1, 322-2 and 322-N. Execution node 322-1 includes a cache 324-1 and a processor 326-1. Execution node 322-2 includes a cache 324-2 and a processor 326-2. Execution node 322-N includes a cache 324-N and a processor 326-N.

[0042] In some embodiments, Figure 3 The execution nodes shown in are stateless with respect to the data being cached by the execution nodes. For example, these execution nodes do not store or otherwise maintain state information about the execution nodes or data cached by a particular execution node. Therefore, in the event of an execution node failure, the failed node can be transparently replaced with another node. Since there is no state information associated with the failed execution node, a new (replacement) execution node can easily replace the failed node without having to worry about recreating specific state.

[0043] although Figure 3 The execution nodes shown each include a data cache and a processor, but alternative embodiments may include execution nodes that include any number of processors and any number of caches. Additionally, the size of the cache may vary between different execution nodes. Figure 3 The illustrated cache stores data (e.g., S3 objects most recently accessed by a given node) retrieved from one or more data storage devices in the cloud computing storage platform 104 in a local execution node (e.g., a local disk). In some example embodiments, the cache stores file headers and individual columns of a file when a query downloads only the columns required by the query.

[0044] To improve cache hits and avoid overlapping redundant data stored in node caches, job optimizer 208 distributes input file sets to nodes using a consistent hashing scheme to hash the table file names of the accessed data (e.g., data in database 116 or database 122). According to some example embodiments, subsequent or concurrent queries accessing the same table file will therefore be executed on the same node.

[0045] As discussed, nodes and virtual warehouses can be changed dynamically in response to environmental conditions (e.g., disaster scenarios), hardware / software problems (e.g., failures), or management changes (e.g., changing from a large cluster to a small cluster to reduce costs). In some example embodiments, when the set of nodes changes, the data is not reshuffled immediately. Instead, a least recently used replacement strategy is implemented to eventually replace cached content lost in multiple jobs. Therefore, the cache reduces or eliminates the bottleneck problem that occurs in platforms that constantly retrieve data from remote storage systems. Instead of repeatedly accessing data from remote storage devices, the systems and methods described herein access data from caches in execution nodes, which is significantly faster and avoids the bottleneck problem discussed above. In some embodiments, the cache is implemented using a high-speed memory device that provides fast access to cached data. Each cache can store data from any storage device in the cloud computing storage platform 104.

[0046] In addition, cache resources and computing resources can vary between different execution nodes. For example, an execution node can include a large amount of computing resources and a minimum of cache resources, so that the execution node can be used for tasks that require a large amount of computing resources. Another execution node can include a large amount of cache resources and a minimum of computing resources, so that the execution node can be used for tasks that require a large amount of data to be cached. Another execution node can include cache resources that provide faster input-output operations, which is useful for tasks that require rapid scanning of large amounts of data. In some embodiments, the execution platform 114 implements skew processing to allocate work between cache resources and computing resources associated with a specific execution, wherein the allocation can be further based on the expected tasks performed by the execution node. For example, if the tasks performed by the execution node become more processor-intensive, more processing resources can be allocated to the execution node. Similarly, if the tasks performed by the execution node require a larger cache capacity, more cache resources can be allocated to the execution node. In addition, due to various problems (e.g., virtualization problems, network overhead), the execution speed of some nodes may be much slower than that of other nodes. In some example embodiments, the file stealing scheme is used to solve the imbalance at the scanning level. In particular, each time a node process completes scanning its input file set, it requests additional files from other nodes. If one of the other nodes receives such a request, the node analyzes its own set (e.g., how many files were left in the input file set when the request was received) and then transfers ownership of one or more remaining files for the duration of the current job (e.g., query). The requesting node (e.g., file stealing node) then receives the data (e.g., header data) and downloads the file from the cloud computing storage platform 104 (e.g., from the data storage device 124-1) without downloading the file from the transfer node. In this way, a lagging node can transfer files by file stealing in this way without increasing the load on the lagging node.

[0047] Although virtual warehouses 1, 2, and N are associated with the same execution platform 114, the virtual warehouses may be implemented using multiple computing systems at multiple geographic locations. For example, virtual warehouse 1 may be implemented by a computing system at a first geographic location, while virtual warehouses 2 and N are implemented by another computing system at a second geographic location. In some embodiments, these different computing systems are cloud-based computing systems maintained by one or more different entities.

[0048] Additionally, each virtual warehouse Figure 3302-1 and 302-2 are shown as having multiple execution nodes. Multiple computing systems located at multiple geographic locations can be used to implement multiple execution nodes associated with each virtual warehouse. For example, an instance of virtual warehouse 1 implements execution nodes 302-1 and 302-2 on a computing platform at one geographic location, while implementing execution node 302-N at a different computing platform at another geographic location. The selection of a particular computing system to implement an execution node can depend on various factors, such as the resource level required for a particular execution node (e.g., processing resource requirements and cache requirements), the resources available at a particular computing system, the communication capabilities of a network within or between geographic locations, and which computing systems have implemented other execution nodes in the virtual warehouse.

[0049] The execution platform 114 is also fault tolerant. For example, if a virtual warehouse fails, the virtual warehouse will be quickly replaced by a different virtual warehouse located in a different geographical location.

[0050] A particular execution platform 114 may include any number of virtual warehouses. Additionally, the number of virtual warehouses in a particular execution platform is dynamic, so that new virtual warehouses are created when additional processing and / or cache resources are needed. Similarly, existing virtual warehouses may be deleted when resources associated with the virtual warehouses are no longer needed.

[0051] In some embodiments, virtual warehouses can operate on the same data in the cloud computing storage platform 104, but each virtual warehouse has its own execution node with independent processing and cache resources. This configuration allows requests on different virtual warehouses to be processed independently without interfering with each other. This independent processing, combined with the ability to dynamically add and remove virtual warehouses, supports adding new processing capabilities for new users without affecting the performance observed by existing users.

[0052] Sharing query results allows different users to access previously run query results without rerunning the query. In some conventional systems, users can share query results by downloading a copy of the query results locally (e.g., a csv file) and then sending those local copies to other users. Using this local replication technology, users cannot manage results after sharing, and may lose control of the results. The results shared by the local replication technology are not protected by the underlying database, can be easily modified or tampered with, and the owner of the results has no way to understand the further access of the third party to the result data. In addition, the management of the life cycle of the shared results will occur outside the database system (e.g., the database system 102 based on the network).

[0053] Next, a technique for sharing query results using a security token within a network-based database system will be described. A user can perform a query, and the results can be stored within a network-based database system (e.g., network-based database system 102). A user can call a function to create a security token to provide access to the stored results. A user can share a token directly with another user, and the other user can directly access the results stored in the network-based database system without downloading the entire results. Therefore, the life cycle of the shared results can be managed within the network-based database system.

[0054] Figure 4 A diagram of a method 400 for sharing query results within a network-based database system according to some example embodiments is shown. At operation 402, a query may be received from a first user associated with a first account within a network-based database system (e.g., network-based database system 102). At operation 404, the query is executed by the network-based database system. The query may be processed by a computing service manager (e.g., computing service manager 112), where the query may be compiled. A query plan may be generated to execute the query. One or more jobs associated with the query plan may be assigned to one or more execution platforms (e.g., execution platform 114). One or more execution platforms may execute one or more jobs to generate results for the query.

[0055] At operation 406, the query results are stored in one or more storage devices (e.g., storage devices 124-1 to 124-N) of a network-based database system as described herein. The query results may be stored with a job ID and a query ID associated with the query results. The query results may also be transmitted to the first user.

[0056] At operation 408, a command is received from the first user to generate a security token for querying the results. For example, the first user may invoke a command (e.g., SELECT SHARED_RESULT_CREATE_TOKEN(<query_id> )). In response, the network-based database system can generate a security token associated with the query result. The security token can include a unique string value.

[0057] In some embodiments, the syntax for generating a token may include:

[0058] SHARED_RESULT_CREATE_TOKEN(

[0059] {'<query_id> '$query_id},

[0060] [<expiration_in_days> ])

[0061] '<query_id> '|$query_id can be a string value representing the query ID. In some embodiments, it can be a scalar expression containing the query ID, including a session variable, a bind variable, or an expression such as the LAST_QUERY_ID() function, which returns the ID of the query within the current session.<expiration_in_days> Can be a numeric value representing the number of days until the token expires.

[0062] At operation 410, metadata (such as a data persistent object (DPO)) is created for the security token and stored in a metadata database. The metadata of the security token may be stored separately from the stored query results. The metadata may be used to manage the life cycle of the security token separately from the stored query results.

[0063] Figure 5 A security token DPO 500 is shown according to some example embodiments. The security token DPO 500 may include attributes 502 and slices 504.

[0064] Attribute 502 may include an ID value. Attribute 502 may include a token value, which may be a unique string value. The string value may include a random string value used by a user of a network-based database system to reference a token. Attribute 502 may include a user ID, which may be a numerical value associated with a user who created the token. Attribute 502 may include a query ID, which may be a numerical value associated with a job referenced by the token (e.g., JobId). Attribute 502 may include a created-on value, which may be a numerical value of the time the token was created. Attribute 502 may include an expires-at value, which may be a numerical value representing the time at which the token is set to expire.

[0065] Slice 504 may include a main slice, which may include a key (e.g., ID) with a value, such as TokenValue, UserId, QueryId, CreatedOn, and ExpiresAt. Slice 504 may include a ByTokenValue slice, which may include a key (such as AccountID, TokenValue) and a value (such as ID). Slice 504 may include a ByExpiration slice, which may include a key, such as ExpiresAt, AccountId, ID. Slice 504 may include a UserId slice, which may include a key, such as AccountId, UserId, ID. Slice 504 may include a ByUsage slice, which may include a key, such as AcountID, TokenValue, UserId, AcessTime, QueryId.

[0066] Slice 504 can be used to perform various lifecycle and audit operations. For example, a backend service can use the ByExpiration slice to delete tokens that have expired. As another example, the ByUserId slice can be used to retrieve all tokens created by a certain user. As another example, the ByUsage slice can be used to collect audit information that a user has used a token to access stored query results, as described in further detail below.

[0067] The security token can be shared with other users in the network-based database system, who can then access the associated query results without additional privilege checks. The network-based database system can authenticate that the user attempting to access the query results via the security token belongs to the same account or organization as the user who created the token, and can then provide access to the stored query results without performing additional privilege checks. In addition, the use of security tokens can allow query results to be shared independently of the user's specific role.

[0068] Figure 6 A flow chart of a method 600 for receiving access to stored query results using a security token according to some example embodiments is shown. At operation 602, a security token associated with a stored query result is created (see, e.g., Figure 4 A first user of the method 400) shares a security token with a second user of a network-based database system. For example, the first user can share a token value (e.g., a string value) with the second user.

[0069] At operation 604, a command or request is received from the second user to view the stored query results using the security token. For example, the second user may invoke a command (eg, SELECT * FROM TABLE (SHARED_RESULT_SCAN ('TOKEN_VALUE'))).

[0070] At operation 606, the network-based database system authenticates that the second user belongs to the same account as the first user who created the security token. As described above, the account information of the first user who created the security token is stored in the security token DPO. The account information of the second user is retrieved by the network-based database repository based on its current login session.

[0071] At operation 608, the second user is provided access to the query results stored in the network-based database system. The second user is given access to the query results stored in the storage device of the network-based database system, rather than receiving a local copy of the query results. The second user is restricted from having visibility to the first user and the source table used to generate the query results. The second user can be restricted to access only the query results.

[0072] At operation 610, access to query results is tracked based on the use of the security token. Audit information tracking who and how the query results are accessed can be stored with the security token DPO. For example, the number of accesses provided by a given token can be tracked. The tracked information can include the username that accessed the query, the access time, and the query ID. For example, the tracked information can include a set of rows, where each row can include the username of the user who invoked the security token, the invocation time, and the query ID.

[0073] As described above, the use of a security token DPO can be used to manage the lifecycle of a security token separate from the lifecycle of a stored query result associated with the security token. For example, a slice in a security token DPO can be used to retrieve a list of tokens created by a certain user (e.g., all unexpired tokens). The list can include the expiration date of the security token. The query ID and query text can also be returned to the user who created the token; the query ID and query text can be hidden from other users.

[0074] The user who created the security token can adjust the expiration date. For example, the user who created the security token can extend the expiration date or shorten the expiration. The user who created the security token can also invalidate the security token. Expiring / invalidating a security token affects the security token and does not affect the query results associated with the expired / invalidated security token. The lifecycle of the query results is maintained separately.

[0075] The use of security tokens as described herein allows for the management of workflows for sharing query results within a network-based database system. Security token technology provides technical advantages, such as security. The owner / creator of a security token can manage the lifecycle of a security token by denying access and invalidating the token to prevent further access, which can result in better security. Other users who are provided access to the security token are authenticated by a network-based database system that provides another layer of security. Query results are stored and maintained in a network-based database system, providing security for the query results.

[0076] Security token technology also provides better auditability. By managing access to query results internally in a network-based database system, a history of access to query results can be compiled and audited. Security token technology also improves the speed and cost of sharing query results compared to sharing downloaded local copies of what can be large files. Security tokens guarantee the immutability of query results and ensure that the results cannot be tampered with. Security tokens also improve the user experience by providing a simplified method of sharing query results.

[0077] Figure 7 A diagrammatic representation of a machine 700 in the form of a computer system is shown according to an example embodiment, within which a set of instructions for causing the machine 700 to perform any one or more of the methodologies discussed herein may be executed. In particular, Figure 7 A diagrammatic representation of a machine 700 is shown in the form of an example of a computer system within which instructions 716 (e.g., software, programs, applications, applet, app, or other executable code) for causing the machine 700 to perform any one or more of the methods discussed herein can be executed. For example, the instructions 716 can cause the machine 700 to perform any one or more operations of any one or more of the methods described herein. As another example, the instructions 716 can cause the machine 700 to implement portions of the data flows described herein. In this manner, the instructions 716 transform a general, unprogrammed machine into a specific machine 700 (e.g., remote computing device 106, access management system 118, computing service manager 112, execution platform 114, access management system 110, web agent 120) that is specifically configured to perform any of the functions described and illustrated in the manner described herein.

[0078] In alternative embodiments, the machine 700 operates as a standalone device or may be coupled (e.g., networked) to other machines. In a networked deployment, the machine 700 may operate as a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine 700 may include, but is not limited to, a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a smart phone, a mobile device, a network router, a network switch, a network bridge, or any machine capable of executing instructions 716 sequentially or otherwise, which specify actions to be taken by the machine 700. Furthermore, while only a single machine 700 is shown, the term “machine” shall also be construed to include a collection of machines 700 that individually or jointly execute instructions 716 to perform any one or more of the methodologies discussed herein.

[0079] The machine 700 includes a processor 710, a memory 730, and an input / output (I / O) component 750, which are configured to communicate with each other, for example, via a bus 702. In an example embodiment, the processor 710 (e.g., a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, a processor 712 and a processor 714 that may execute instructions 716. The term "processor" is intended to include a multi-core processor 710, which may include two or more independent processors (sometimes referred to as "cores") that may execute instructions 716 simultaneously. Although Figure 7 Multiple processors 710 are shown, but machine 700 may include a single processor with a single core, a single processor with multiple cores (eg, a multi-core processor), multiple processors with a single core, multiple processors with multiple cores, or any combination thereof.

[0080] The memory 730 may include a main memory 732, a static memory 734, and a storage unit 736, all of which may be accessed by the processor 710, for example, via the bus 702. The main memory 732, the static memory 734, and the storage unit 736 store instructions 716, which may embody any one or more of the methods or functions described herein. During execution by the machine 700, the instructions 716 may also reside, in whole or in part, within the main memory 732, within the static memory 734, within the storage unit 736, within at least one processor 710 (e.g., within a cache memory of a processor), or any suitable combination thereof.

[0081] I / O components 750 include components for receiving input, providing output, generating output, transmitting information, exchanging information, capturing measurements, etc. The specific I / O components 750 included in a particular machine 700 will depend on the type of machine. For example, a portable machine such as a mobile phone will likely include a touch input device or other such input mechanism, while a headless server machine may not include such a touch input device. It will be appreciated that I / O components 750 may include Figure 7 Many other components not shown in the figure. The I / O components 750 are grouped according to function only to simplify the following discussion, and the grouping is by no means limiting. In various example embodiments, the I / O components 750 may include output components 752 and input components 754. The output components 752 may include visual components (e.g., displays such as plasma display panels (PDPs), light emitting diode (LED) displays, liquid crystal displays (LCDs), projectors, or cathode ray tubes (CRTs)), acoustic components (e.g., speakers), other signal generators, etc. The input components 754 may include alphanumeric input components (e.g., keyboards, touch screens configured to receive alphanumeric inputs, optical keyboards, or other alphanumeric input components), pointing-based input components (e.g., mice, touch pads, trackballs, joysticks, motion sensors, or another pointing instrument), tactile input components (e.g., physical buttons, touch screens or other tactile input components that provide the location and / or force of touch or touch gestures), audio input components (e.g., microphones), etc.

[0082] Communication can be implemented using a variety of technologies. The I / O component 750 may include a communication component 764, which is operable to couple the machine 700 to a network 780 or a device 770 via coupling 782 and coupling 772, respectively. For example, the communication component 764 may include a network interface component or another suitable device connected to the network 780 via an interface. In another example, the communication component 764 may include a wired communication component, a wireless communication component, a cellular communication component, and other communication components that provide communication via other modalities. The device 770 may be another machine or any of a variety of peripheral devices (e.g., a peripheral device coupled via a universal serial bus (USB)). For example, as described above, the machine 700 may correspond to any of the remote computing device 106, the access management system 118, the computing service manager 112, the execution platform 114, the access management system 110, the web agent 120, and the device 770 may include any of these systems and devices.

[0083] Various memories (e.g., 730, 732, 734 and / or memories of processor 710 and / or storage unit 736) can store one or more sets of instructions 716 and data structures (e.g., software) that embody or are utilized by any one or more of the methods or functions described herein. When executed by processor 710, these instructions 716 cause various operations to implement the disclosed embodiments.

[0084] As used herein, the terms "machine storage medium", "device storage medium" and "computer storage medium" mean the same and may be used interchangeably in this disclosure. These terms refer to a single or multiple storage devices and / or media (e.g., centralized or distributed databases and / or associated caches and servers) that store executable instructions and / or data. Accordingly, these terms should be considered to include, but are not limited to, solid-state memory including memory internal or external to the processor, as well as optical and magnetic media. Specific examples of machine storage media, computer storage media and / or device storage media include non-volatile memory, including, for example, semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), field programmable gate arrays (FPGAs), and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM optical disks. The terms "machine storage medium", "computer storage medium" and "device storage medium" specifically exclude carrier waves, modulated data signals and other such media, at least some of which are included in the term "signal media" discussed below.

[0085] In various example embodiments, one or more portions of network 780 may be an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), the Internet, a portion of the Internet, a portion of a public switched telephone network (PSTN), a plain old telephone service (POTS) network, a cellular telephone network, a wireless network, 780 may include a wireless or cellular network, another type of network, or a combination of two or more such networks. For example, the network 780 or a portion of the network 780 may include a wireless or cellular network, and the coupling 782 may be a code division multiple access (CDMA) connection, a global system for mobile communications (GSM) connection, or another type of cellular or wireless coupling. In this example, the coupling 782 may implement any of a variety of types of data transmission technologies, such as single carrier radio transmission technology (1xRTT), evolution-data optimized (EVDO) technology, general packet radio service (GPRS) technology, enhanced data rate GSM evolution (EDGE) technology, including 3G, fourth generation wireless (4G) network, universal mobile telecommunications system (UMTS), high speed packet access (HSPA), world microwave access interoperability (WiMAX), long term evolution (LTE) standard of the third generation partnership project (3GPP), other technologies defined by various standard setting organizations, other long-range protocols, or other data transmission technologies.

[0086] The instructions 716 may be transmitted or received over the network 780 using a transmission medium via a network interface device (e.g., a network interface component included in the communication component 764) and using any of a number of well-known transmission protocols (e.g., Hypertext Transfer Protocol (HTTP)). Similarly, the instructions 716 may be transmitted or received to the device 770 via a coupling 772 (e.g., a peer-to-peer coupling) using a transmission medium. The terms "transmission medium" and "signal medium" have the same meaning and may be used interchangeably in this disclosure. The terms "transmission medium" and "signal medium" should be understood to include any intangible medium capable of storing, encoding, or carrying the instructions 716 executed by the machine 700, and include digital or analog communication signals or other intangible media that facilitate the communication of such software. Therefore, the terms "transmission medium" and "signal medium" should be understood to include any form of modulated data signals, carrier waves, etc. The term "modulated data signal" means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.

[0087] The terms "machine-readable medium," "computer-readable medium," and "device-readable medium" mean the same and may be used interchangeably in this disclosure. These terms are defined to include both machine storage media and transmission media. Thus, these terms include both storage devices / medium and carrier / modulated data signals.

[0088] The various operations of the example methods described herein may be performed at least in part by (e.g., by software) temporarily configured or permanently configured to perform one or more processors of the related operations. Similarly, the method described herein may be implemented by a processor at least in part. For example, at least some operations of the method described herein may be performed by one or more processors. The execution of certain operations may be distributed between one or more processors, which not only reside in a single machine, but also are deployed across multiple machines. In some example embodiments, one or more processors may be located in a single location (e.g., in a home environment, an office environment, or a server farm), and in other embodiments, the processor may be distributed in multiple locations.

[0089] Although embodiments of the present disclosure have been described with reference to specific example embodiments, it is apparent that various modifications and changes may be made to these embodiments without departing from the broader scope of the subject matter of the present invention. Therefore, the specification and the drawings are considered to be illustrative rather than restrictive. The drawings forming part of this document illustrate specific embodiments in which the subject matter can be practiced in an illustrative rather than a limiting manner. The illustrated embodiments are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other embodiments may be used and derived therefrom, so that structural and logical replacements and changes may be made without departing from the scope of the present disclosure. Therefore, this detailed description should not be considered restrictive, and the scope of the various embodiments is limited only by the appended claims and the full scope of equivalents to which these claims are assigned.

[0090] Such embodiments of the subject matter of the present invention may be referred to herein individually and / or collectively by the term "invention", which is merely for convenience and is not intended to voluntarily limit the scope of the present application to any single invention or inventive concept (if more than one invention or inventive concept is actually disclosed). Therefore, although specific embodiments have been illustrated and described herein, it should be understood that any arrangement calculated to achieve the same purpose can be replaced for the specific embodiments shown. The present disclosure is intended to cover any and all modifications or variations of the various embodiments. After reading the above description, those skilled in the art will understand the combination of the above embodiments and other embodiments not specifically described herein.

[0091] In this document, the terms "a" or "an," as is common in patent documents, are used to include one or more than one, independent of any other instance or usage of "at least one" or "one or more." In this document, the term "or" is used to refer to a non-exclusive or, thus "A or B" includes "A but not B," "B but not A," and "A and B," unless otherwise noted. In the appended claims, the terms "including" and "in which" are used as the plain-English equivalents of the respective terms "comprising" and "wherein." Furthermore, in the appended claims, the terms "comprising" and "including" are open-ended; that is, systems, devices, articles, or processes that include elements other than those listed after such terms in a claim are still considered to fall within the scope of the claim.

[0092] Implementations of the described subject matter may include one or more of the features, alone or in combination, as set out below by way of example.

[0093] Example 1. A method comprising: receiving a query from a first user associated with an account in a multi-tenant database system; executing the query by at least one hardware processor in the multi-tenant database system to generate query results; storing the query results in at least one storage device in the multi-tenant database system; generating a security token associated with the stored query results, the security token comprising a unique string value; sharing the security token with a second user; and providing the second user with access to the query results stored in at least one storage device based on the security token.

[0094] Example 2. The method according to Example 1 also includes: receiving a request from a second user to access the stored query results, the request including a security token; and authenticating the second user as belonging to an account in the multi-tenant database system.

[0095] Example 3. A method according to any of Examples 1-2, wherein metadata associated with the security token is stored in a metadata database separate from the stored query results.

[0096] Example 4. A method according to any one of Examples 1-3, wherein the metadata includes a data persistent object, which includes attributes and slices.

[0097] Example 5. A method according to any of Examples 1-4, wherein the life cycle of the security token is managed separately from the life cycle of the stored query results.

[0098] Example 6. The method of any one of Examples 1-5 further includes: tracking access to the stored query results based on use of a security token to generate tracking information.

[0099] Example 7. The method according to any one of Examples 1-6 further includes: generating audit information of access to the stored query results based on the tracking information, wherein the audit information is generated based on slice information stored in metadata associated with the security token.

[0100] Example 8. A system comprising: one or more processors of a machine; and a memory storing instructions, which, when executed by the one or more processors, cause the machine to perform operations implementing any of Example Methods 1 to 7.

[0101] Example 9. A machine-readable storage device containing instructions, which, when executed by a machine, cause the machine to perform operations implementing any one of Example Methods 1 to 7.

Claims

1. A method comprising: receiving a query from a first user associated with an account in the multi-tenant database system; executing the query by at least one hardware processor in the multi-tenant database system to generate a query result; storing the query result in at least one storage device in the multi-tenant database system; generating a security token associated with the stored query result, the security token comprising a unique string value; sharing the security token with a second user; and Based on the security token, the second user is provided access to the stored query results in the at least one storage device.

2. The method according to claim 1, further comprising: receiving a request from the second user to access the stored query results, the request including the security token; and The second user is authenticated as belonging to an account in the multi-tenant database system.

3. The method according to claim 1, wherein: Metadata associated with the security token is stored in a metadata database separately from the stored query results.

4. The method according to claim 3, wherein: The metadata includes a data persistent object, and the data persistent object includes attributes and slices.

5. The method according to claim 1, wherein: The lifecycle of the security token is managed separately from the lifecycle of the stored query results.

6. The method according to claim 1, further comprising: Based on use of the security token, access to the stored query results is tracked to generate tracking information.

7. The method according to claim 6, further comprising: Based on the tracking information, generate audit information for access to the stored query results, wherein the audit information is generated based on slice information stored in metadata associated with the security token.

8. A machine storage medium comprising instructions that, when executed by a machine, cause the machine to perform operations comprising: receiving a query from a first user associated with an account in the multi-tenant database system; executing the query to generate query results; storing the query result in at least one storage device in the multi-tenant database system; generating a security token associated with the stored query result, the security token comprising a unique string value; sharing the security token with a second user; and Based on the security token, the second user is provided access to the stored query results in the at least one storage device.

9. The machine storage medium of claim 8, further comprising: receiving a request from the second user to access the stored query results, the request including the security token; and The second user is authenticated as belonging to an account in the multi-tenant database system.

10. The machine storage medium according to claim 8, wherein: Metadata associated with the security token is stored in a metadata database separately from the stored query results.

11. The machine storage medium according to claim 10, wherein: The metadata includes a data persistent object, and the data persistent object includes attributes and slices.

12. The machine storage medium according to claim 8, wherein: The lifecycle of the security token is managed separately from the lifecycle of the stored query results.

13. The machine storage medium of claim 8, further comprising: Based on use of the security token, access to the stored query results is tracked to generate tracking information.

14. The machine storage medium of claim 13, further comprising: Based on the tracking information, generate audit information for access to the stored query results, wherein the audit information is generated based on slice information stored in metadata associated with the security token.

15. A system comprising: at least one hardware processor; as well as at least one memory storing instructions that, when executed by the at least one hardware processor, cause the at least one hardware processor to perform operations including: receiving a query from a first user associated with an account in the multi-tenant database system; executing the query to generate query results; storing the query result in at least one storage device in the multi-tenant database system; generating a security token associated with the stored query result, the security token comprising a unique string value; sharing the security token with a second user; and Based on the security token, the second user is provided access to the stored query results in the at least one storage device.

16. The system of claim 15, wherein the operations further comprise: receiving a request from the second user to access the stored query results, the request including the security token; and The second user is authenticated as belonging to an account in the multi-tenant database system.

17. The system of claim 15, wherein: Metadata associated with the security token is stored in a metadata database separately from the stored query results.

18. The system of claim 17, wherein: The metadata includes a data persistent object, and the data persistent object includes attributes and slices.

19. The system of claim 15, wherein: The lifecycle of the security token is managed separately from the lifecycle of the stored query results.

20. The system of claim 15, the operations further comprising: Based on use of the security token, access to the stored query results is tracked to generate tracking information.

21. The system of claim 20, wherein the operations further comprise: Based on the tracking information, generate audit information for access to the stored query results, wherein the audit information is generated based on slice information stored in metadata associated with the security token.

Images