Packages Policy Allowlists and Blocklists for Secure UDF Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud data platforms lack robust security mechanisms for managing third-party packages, leading to insecure and non-granular access control, which exposes customers to security vulnerabilities and limits functionality.
Innovation Solution
Implementing a packages policy object with allowlists and blocklists that provide granular access control over packages, applied during UDF creation and execution, ensuring only permitted packages are used, and enabling dynamic updates and sandbox environments for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If third-party packages are made available to all users in a cloud data platform, then functionality and user experience are improved, but security vulnerabilities and access control risks increase
Solution Approach 1:
The patent segments package access control by introducing account-level packages policies that can be applied at different scopes (account, schema, database, table). This allows granular control where packages are made available to specific users or groups based on their role and permissions, rather than uniformly to all users. The segmentation enables functionality to be maintained for authorized users while blocking access for unauthorized users, thus resolving the contradiction between package availability and security.
Solution Approach 2:
The patent introduces packages policies as an intermediary mechanism between the package repository and the users. This policy layer acts as a mediator that filters and controls which packages are accessible to which users. The intermediary packages policy object includes allowlists and blocklists that intervene in the package resolution process, preventing direct access to all packages while maintaining controlled access to authorized packages, thereby reducing security vulnerabilities while preserving functionality.
2Object-affected harmful factors
If granular access control for packages is implemented, then security is improved, but device complexity and system complexity increase
Solution Approach 1:
The patent implements packages policies as a universal mechanism that serves multiple functions: access control, security filtering, package resolution, and audit logging. By making the packages policy system multi-functional, the patent reduces the need for separate security mechanisms and simplifies the overall system architecture. The universal packages policy object can be applied at multiple scopes (account, schema, database, table) without requiring separate control mechanisms for each scope, thereby improving security while managing complexity.
Solution Approach 2:
The patent applies packages policies at package resolution time, which is a preliminary action before the actual package is loaded or executed. By performing security checks and access control decisions in advance during the package resolution phase, the system prevents unauthorized packages from being loaded without requiring continuous monitoring or complex runtime control mechanisms. This preliminary action simplifies the overall system by shifting security complexity to the package resolution layer rather than requiring complex runtime enforcement mechanisms.
3Ease of operation
If existing UDF execution techniques are used, then ease of operation is maintained, but security mechanisms and audit visibility are insufficient
Solution Approach 1:
The patent introduces feedback mechanisms through audit logging and monitoring of package access and execution. The system provides feedback to administrators about which packages are being accessed, by whom, and under what conditions. This feedback enables continuous improvement of security policies and audit capabilities while maintaining ease of operation for users. The feedback loop allows the system to automatically adjust access controls based on observed usage patterns, enhancing security without requiring users to change their operational workflows.
Data Source
AI summary
A system includes one or more hardware processors and at least one memory storing instructions. The hardware processors receive a packages policy for a cloud data platform account, the packages policy including at least one allowlist and at least one blocklist. The hardware processors receive a request to generate a report associated with the packages policy. In response, the hardware processors generate a report identifying, for the account, packages or versions of packages allowed by the allowlist and packages or versions of packages blocked by the blocklist, at a specified time or over a specified period. The hardware processors generate a notification to a user when a package is added to or removed from the allowlist or blocklist, the notification including a summary of changes and a reference to access an updated version of the report.