Database Role Sharing Using Hidden Cross-Account Role Mapping

The patent segments database access control into multiple hierarchical levels: account-level roles, database-level roles, and table-level roles. This segmentation allows fine-grained control over data sharing permissions, enabling different security policies for different data granularities while maintaining overall system security. The layered role structure prevents unauthorized access by requiring permission validation at each level.

The patent introduces an intermediary role-granting mechanism that acts as a mediator between data providers and data consumers. The system automatically manages role assignments and permission propagation through this intermediary layer, reducing direct security exposure between accounts while enabling controlled data sharing. The intermediary validates and enforces security policies during the data sharing process.

The patent creates a universal role-granting framework that can be applied across multiple customer accounts and database instances. The account-level roles and database-level roles serve multiple functions: they control access within a single account, manage sharing between accounts, and propagate permissions across the entire database system. This multi-functional role system enables scalable data sharing without requiring separate implementation for each account pair.

The patent implements preliminary action by pre-defining account-level roles and database-level roles before actual data sharing occurs. These roles are prepared in advance with appropriate permission templates, allowing rapid deployment of data sharing arrangements when needed. The pre-configured roles reduce the complexity of real-time permission management and enable scalable onboarding of new data sharing relationships.

The patent implements a nested role structure where account-level roles contain database-level roles, which in turn contain table-level roles. This nested doll architecture allows hierarchical permission management where broader account-level permissions are broken down into more specific database and table level permissions. The nesting reduces operational complexity by allowing administrators to manage permissions at the highest appropriate level while maintaining fine-grained control at lower levels.

The patent merges multiple permission management functions into a unified role-granting system. Account-level roles, database-level roles, and table-level roles are combined into a single coherent framework that handles both internal account access control and external data sharing permissions. This merging eliminates the need for separate permission management systems and reduces operational overhead through centralized role administration.