# US 11,113,390 B1 · Secure execution of a user defined function > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,390 B1 - Document ID: US11113390B1 - Status: Granted - Kind: B1 - Application number: 17/236,812 - Filed: 2021-04-21 - Granted: 2021-09-07 - Earliest claimed: 2020-06-02 - Assignees: Snowflake Inc. - Applicants: Snowflake Inc. - Inventors: Elliott Brossard; Derek Denny-Brown; Isaac Kunen; Soumitr Rajiv Pandey; Jacob Salassi; Srinath Shankar; Haowei Yu; Andong Zhan - Web page: https://patentgrep.com/patent/US11113390B1 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 16/221: {Column-oriented storage; Management thereof} - G06F 21/54: by adding security routines or objects to programs - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The subject technology receives, in a first computing process, a user defined function, the user defined function including code related to at least one operation to be performed. The subject technology sends a request based at least in part on the at least one operation to a second computing process to perform. The subject technology determines, by a security manager executing within the second computing process, whether performing the at least one operation is permitted, the security manager determines restrictions, based at least in part on a security policy, on operations executing within a sandbox environment provided by the second computing process. The subject technology performs, in the second computing process, the at least one operation, the security manager executing within the second computing process. ## Claims ### Claim 1 A system comprising: at least one hardware processor; and a memory storing instructions that cause the at least one hardware processor to perform operations comprising: receiving, in a first computing process, a user defined function, the user defined function including code related to at least one operation to be performed; sending a request based at least in part on the at least one operation to a second computing process to perform; determining, by a security manager executing within the second computing process, whether performing the at least one operation is permitted, the security manager determines restrictions, based at least in part on a security policy, on operations executing within a sandbox environment provided by the second computing process; performing, in the second computing process, the at least one operation, the security manager executing within the second computing process; and sending, by the second computing process, a result of the at least one operation to the first computing process, wherein sending, by the second computing process, the result of the at least one operation utilizes a data transport mechanism that supports a network transfer of columnar data, the columnar data is transferred without memory copying or serialization. ### Claim 2 (depends on 1) The system of claim 1, wherein the security manager forwards the at least one operation to a user code runtime executing within the security manager to perform the at least one operation. ### Claim 3 (depends on 1) The system of claim 1, wherein the second computing process comprises a sandbox process for executing the at least one operation in the sandbox environment. ### Claim 4 (depends on 1) The system of claim 1, wherein performing, in the second computing process, the least one operation occurs within the sandbox environment. ### Claim 5 (depends on 4) The system of claim 4, wherein the second computing process comprises a child process of the first computing process, the first computing process comprises an execution node process, the execution node process executing a user defined function client. ### Claim 6 (depends on 1) The system of claim 1, wherein the first computing process and the second computing process are executed on a same execution node of an execution platform. ### Claim 7 (depends on 6) The system of claim 6, wherein the execution platform comprises a plurality of virtual warehouses, each virtual warehouse comprises a plurality of execution nodes, and a particular virtual warehouse from the plurality of virtual warehouse includes the same execution node that executes the first computing process and the second computing process. ### Claim 8 (depends on 1) The system of claim 1, wherein the first computing process, executing on an execution node, comprises an execution node process executing on the execution node, the execution node process executes a user defined function (UDF) client, and the UDF client communicates with the second computing process and submits at least one request to perform a database query to the second computing process. ### Claim 9 A method comprising: receiving, in a first computing process, a user defined function, the user defined function including code related to at least one operation to be performed; sending a request based at least in part on the at least one operation to a second computing process to perform; determining, by a security manager executing within the second computing process, whether performing the at least one operation is permitted, the security manager determines restrictions, based at least in part on a security policy, on operations executing within a sandbox environment provided by the second computing process; performing, in the second computing process, the at least one operation, the security manager executing within the second computing process; and sending, by the second computing process, a result of the at least one operation to the first computing process, wherein sending, by the second computing process, the result of the at least one operation utilizes a data transport mechanism that supports a network transfer of columnar data, the columnar data is transferred without memory copying or serialization. ### Claim 10 (depends on 9) The method of claim 9, wherein the security manager forwards the at least one operation to a user code runtime executing within the security manager to perform the at least one operation. ### Claim 11 (depends on 9) The method of claim 9, wherein the second computing process comprises a sandbox process for executing the at least one operation in the sandbox environment. ### Claim 12 (depends on 9) The method of claim 9, wherein performing, in the second computing process, the least one operation occurs within the sandbox environment. ### Claim 13 (depends on 12) The method of claim 12, wherein the second computing process comprises a child process of the first computing process, the first computing process comprises an execution node process, the execution node process executing a user defined function client. ### Claim 14 (depends on 9) The method of claim 9, wherein the first computing process and the second computing process are executed on a same execution node of an execution platform. ### Claim 15 (depends on 14) The method of claim 14, wherein the execution platform comprises a plurality of virtual warehouses, each virtual warehouse comprises a plurality of execution nodes, and a particular virtual warehouse from the plurality of virtual warehouse includes the same execution node that executes the first computing process and the second computing process. ### Claim 16 (depends on 9) The method of claim 9, wherein the first computing process, executing on an execution node, comprises an execution node process executing on the execution node, the execution node process executes a user defined function (UDF) client, and the UDF client communicates with the second computing process and submits at least one request to perform a database query to the second computing process. ### Claim 17 A non-transitory computer-storage medium comprising instructions that, when executed by one or more processors of a machine, configure the machine to perform operations comprising: receiving, in a first computing process, a user defined function, the user defined function including code related to at least one operation to be performed; sending a request based at least in part on the at least one operation to a second computing process to perform; determining, by a security manager executing within the second computing process, whether performing the at least one operation is permitted, the security manager determines restrictions, based at least in part on a security policy, on operations executing within a sandbox environment provided by the second computing process; performing, in the second computing process, the at least one operation, the security manager executing within the second computing process; and sending, by the second computing process, a result of the at least one operation to the first computing process, wherein sending, by the second computing process, the result of the at least one operation utilizes a data transport mechanism that supports a network transfer of columnar data, the columnar data is transferred without memory copying or serialization. ### Claim 18 (depends on 17) The non-transitory computer-storage medium of claim 17, wherein the security manager forwards the at least one operation to a user code runtime executing within the security manager to perform the at least one operation. ### Claim 19 (depends on 17) The non-transitory computer-storage medium of claim 17, wherein performing, in the second computing process, the least one operation occurs within the sandbox environment, wherein the second computing process comprises a child process of the first computing process, the first computing process comprises an execution node process, the execution node process executing a user defined function client. ### Claim 20 (depends on 17) The non-transitory computer-storage medium of claim 17, wherein the first computing process, executing on an execution node, comprises an execution node process executing on the execution node, the execution node process executes a user defined function (UDF) client, and the UDF client communicates with the second computing process and submits at least one request to perform a database query to the second computing process.