# US 11,363,024 B2 · Supplanting access credentials for shared data visualizations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,363,024 B2 - Document ID: US11363024B2 - Status: Granted - Kind: B2 - Application number: 17/015,579 - Filed: 2020-09-09 - Published: 2022-03-10 - Granted: 2022-06-14 - Earliest claimed: 2020-09-09 - Assignees: Sigma Computing, Inc. - Applicants: Sigma Computing, Inc. - Inventors: Gregory G. Owen; Donald Huang; Stipo Josipovic; Kenneth Truong; Nipurn Doshi - Web page: https://patentgrep.com/patent/US11363024B2 ## CPC - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/10: {for controlling access to devices or network resources} - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Supplanting access credentials for shared data visualizations including receiving, from a first identity provider (IDP) account, a request to generate a data visualization utilizing restricted data from a cloud-based data warehouse, wherein the data visualization is generated by accessing the restricted data using the first IDP account; in response to receiving a request to share the data visualization with a receiving entity without access to the restricted data, associating, by a data visualizer, the data visualization with a service account with access to the restricted data, wherein the service account is not authenticated as a user of the first IDP account; and providing, by the data visualizer to the receiving entity, access to the data visualization including generating the data visualization by accessing, using the service account, the restricted data from the cloud-based data warehouse. ## Claims ### Claim 1 A method of supplanting access credentials for shared data visualizations, the method comprising: receiving, from a first identity provider (IDP) account, a request to generate a data visualization utilizing restricted data from a cloud-based data warehouse, wherein the data visualization is generated by accessing the restricted data using the first IDP account; in response to receiving a request to share the data visualization with a receiving entity without access to the restricted data, associating, by a data visualizer, the data visualization with a service account with access to the restricted data, wherein the service account is not authenticated as a user of the first IDP account; providing, by the data visualizer to the receiving entity, access to the data visualization including generating the data visualization by accessing, using the service account, the restricted data from the cloud-based data warehouse; and wherein the receiving entity is a second IDP account without access to the restricted data, wherein the service account is not authenticated as a user of the second IDP account, and wherein providing, to the receiving entity, access to the data visualization comprises providing, to the second IDP account, access to the data visualization. ### Claim 2 (depends on 1) The method of claim 1, wherein the second IDP account has read-only access to the data visualization. ### Claim 3 (depends on 1) The method of claim 1, wherein the request to share the data visualization comprises a request to autogenerate a static version of the data visualization based on a schedule, and wherein providing, to the receiving entity, access to the data visualization comprises sending the data visualization to an external destination. ### Claim 4 (depends on 1) The method of claim 1, further comprising providing to the receiving entity, access to an updated data visualization including generating the updated data visualization by accessing, using the service account, updated restricted data from the cloud-based data warehouse, wherein the updated restricted data is stored on the cloud-based data warehouse after receiving the request to share the data visualization. ### Claim 5 (depends on 1) The method of claim 1, wherein the first IDP account is authorized to access the cloud-based data warehouse and the data visualizer, and wherein the first IDP account is mapped to permissions within the data visualizer. ### Claim 6 (depends on 1) The method of claim 1, wherein the service account accesses the restricted data on the cloud-based data warehouse using a token. ### Claim 7 (depends on 1) The method of claim 1, wherein the service account accesses the restricted data on the cloud-based data warehouse without using a token. ### Claim 8 (depends on 1) The method of claim 1, wherein the data visualization is an abstraction of a worksheet comprising the restricted data from the cloud-based data warehouse. ### Claim 9 (depends on 1) The method of claim 1, wherein the service account is under the control of the data visualizer and is not authenticated for any particular user. ### Claim 10 An apparatus for supplanting access credentials for shared data visualizations, the apparatus comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of: receiving, from a first identity provider (IDP) account, a request to generate a data visualization utilizing restricted data from a cloud-based data warehouse, wherein the data visualization is generated by accessing the restricted data using the first IDP account; in response to receiving a request to share the data visualization with a receiving entity without access to the restricted data, associating, by a data visualizer, the data visualization with a service account with access to the restricted data, wherein the service account is not authenticated as a user of the first IDP account; providing, by the data visualizer to the receiving entity, access to the data visualization including generating the data visualization by accessing, using the service account, the restricted data from the cloud-based data warehouse; and wherein the receiving entity is a second IDP account without access to the restricted data, wherein the service account is not authenticated as a user of the second IDP account, and wherein providing, to the receiving entity, access to the data visualization comprises providing, to the second IDP account, access to the data visualization. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein the second IDP account has read-only access to the data visualization. ### Claim 12 (depends on 10) The apparatus of claim 10, wherein the request to share the data visualization comprises a request to autogenerate a static version of the data visualization based on a schedule, and wherein providing, to the receiving entity, access to the data visualization comprises sending the data visualization to an external destination. ### Claim 13 (depends on 10) The apparatus of claim 10, wherein the computer program instructions further cause the apparatus to carry out the step of providing to the receiving entity, access to an updated data visualization including generating the updated data visualization by accessing, using the service account, updated restricted data from the cloud-based data warehouse, wherein the updated restricted data is stored on the cloud-based data warehouse after receiving the request to share the data visualization. ### Claim 14 (depends on 10) The apparatus of claim 10, wherein the first IDP account is authorized to access the cloud-based data warehouse and the data visualizer, and wherein the first IDP account is mapped to permissions within the data visualizer. ### Claim 15 (depends on 10) The apparatus of claim 10, wherein the service account accesses the restricted data on the cloud-based data warehouse using a token. ### Claim 16 (depends on 10) The apparatus of claim 10, wherein the service account accesses the restricted data on the cloud-based data warehouse without using a token. ### Claim 17 (depends on 10) The apparatus of claim 10, wherein the data visualization is an abstraction of a worksheet comprising the restricted data from the cloud-based data warehouse. ### Claim 18 A computer program product for supplanting access credentials for shared data visualizations, the computer program product disposed upon a non-transitory computer readable medium, the computer program product comprising computer program instructions that, when executed, cause a computer to carry out the steps of: receiving, from a first identity provider (IDP) account, a request to generate a data visualization utilizing restricted data from a cloud-based data warehouse, wherein the data visualization is generated by accessing the restricted data using the first IDP account; in response to receiving a request to share the data visualization with a receiving entity without access to the restricted data, associating, by a data visualizer, the data visualization with a service account with access to the restricted data, wherein the service account is not authenticated as a user of the first IDP account; providing, by the data visualizer to the receiving entity, access to the data visualization including generating the data visualization by accessing, using the service account, the restricted data from the cloud-based data warehouse; and wherein the receiving entity is a second IDP account without access to the restricted data, wherein the service account is not authenticated as a user of the second IDP account, and wherein providing, to the receiving entity, access to the data visualization comprises providing, to the second IDP account, access to the data visualization.