# US 12,001,581 B2 · Query processing in a secure data clean room > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,581 B2 - Document ID: US12001581B2 - Status: Granted - Kind: B2 - Application number: 18/162,705 - Filed: 2023-01-31 - Published: 2023-06-08 - Granted: 2024-06-04 - Earliest claimed: 2021-06-30 - Assignees: Snowflake Inc. - Applicants: Snowflake Inc. - Inventors: Justin Langseth; Michael Earle Rainey - Web page: https://patentgrep.com/patent/US12001581B2 ## CPC - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 16/245: Query processing - G06F 16/258: {Data format conversion from or to a database} - G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor - G06F 21/602: {Providing cryptographic facilities or services} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A first database account shares, with a second database account, a secure function configured to accept an encrypted dataset and a decryption parameter. The first database account includes a first dataset. The second database account includes a second dataset. The second database account selects one or more rows and one or more columns of the second dataset as a searchable dataset, generates an encrypted searchable dataset by encrypting the searchable dataset with a key, and calls the secure function with the encrypted searchable dataset and the key. The secure function generates results of a query by: generating a decrypted searchable dataset by decrypting the encrypted searchable dataset with the key in a secure environment, obtaining the results by executing the query against a combination of the first dataset and the decrypted dataset in the secure environment to generated query-results data, and outputting the results to the second database account. ## Claims ### Claim 1 A method performed by executing instructions on at least one hardware processor, the method comprising: sharing, by a first database account with a second database account, a secure function configured to accept as input and to process an encrypted dataset and a decryption parameter, the first database account including a first dataset, the second database account including a second dataset; selecting, by the second database account, one or more rows and one or more columns of the second dataset as a searchable dataset; generating, by the second database account, an encrypted searchable dataset by encrypting the searchable dataset with a key; calling, by the second database account, the secure function by inputting the encrypted searchable dataset and the key into the secure function; and based on the inputted encrypted searchable dataset and the key, generating, by the secure function, query results of a query by performing operations comprising: generating a decrypted searchable dataset by decrypting the encrypted searchable dataset with the key in a secure environment; anonymizing the decrypted searchable dataset by generating a cross reference table that cross references the anonymized searchable dataset and the decrypted searchable dataset; obtaining the query results by executing the query against a combination of the first dataset and the anonymized searchable dataset in the secure environment to generated query-results data, the first dataset separate from the second database account; and outputting the query results to the second database account. ### Claim 2 (depends on 1) The method of claim 1, further comprising selecting, by the first database account, one or more first-dataset columns of the first dataset as one or more permitted fields in queries, wherein the generating, by the secure function, of the query results further comprises verifying that the query is directed only to the one or more permitted fields. ### Claim 3 (depends on 1) The method of claim 1, wherein: the first database account does not have access to the second dataset in plain-text format; and the second database account does not have access to the first dataset in plain-text format. ### Claim 4 (depends on 1) The method of claim 1, wherein both the first and second database accounts reside in a distributed database. ### Claim 5 (depends on 1) The method of claim 1, wherein: the first database account resides in a first networked database platform; and the second database resides in a second networked database platform. ### Claim 6 (depends on 5) The method of claim 5, wherein the first networked database platform and the second networked database platform are in different geographic regions. ### Claim 7 (depends on 1) The method of claim 1, wherein the secure function comprises a user-defined function. ### Claim 8 (depends on 1) The method of claim 1, wherein the secure function comprises a stored procedure. ### Claim 9 (depends on 1) The method of claim 1, wherein the query performs overlap analysis between the first and second datasets. ### Claim 10 (depends on 9) The method of claim 9, wherein the overlap analysis is with respect to a user-identifier column in both the first and second datasets. ### Claim 11 (depends on 1) The method of claim 1, wherein the secure function is configured to prevent the second database account from accessing underlying code of the secure function. ### Claim 12 (depends on 1) The method of claim 1, wherein the secure function is configured to prevent the second database account from accessing logs corresponding to usage by the first database account of the secure function. ### Claim 13 (depends on 1) The method of claim 1, wherein the cross reference table includes cross references of the anonymized searchable dataset and the decrypted searchable dataset for overlapping data in the first dataset and the decrypted searchable dataset. ### Claim 14 (depends on 13) The method of claim 13, wherein the cross reference table includes dummy identifiers for non-overlapping data in the first dataset and the decrypted searchable dataset. ### Claim 15 A computer system comprising: at least one hardware processor; and one or more non-transitory computer readable storage media containing instructions that, when executed by the at least one hardware processor, cause the computer system to perform operations comprising: sharing, by a first database account with a second database account, a secure function configured to accept as input and to process an encrypted dataset and a decryption parameter, the first database account including a first dataset, the second database account including a second dataset; selecting, by the second database account, one or more rows and one or more columns of the second dataset as a searchable dataset; generating, by the second database account, an encrypted searchable dataset by encrypting the searchable dataset with a key; calling, by the second database account, the secure function by inputting the encrypted searchable dataset and the key into the secure function; and based on the inputted encrypted searchable dataset and the key, generating, by the secure function, query results of a query by performing operations comprising: generating a decrypted searchable dataset by decrypting the encrypted searchable dataset with the key in a secure environment; anonymizing the decrypted searchable dataset by generating a cross reference table that cross references the anonymized searchable dataset and the decrypted searchable dataset: obtaining the query results by executing the query against a combination of the first dataset and the anonymized searchable dataset in the secure environment to generated query-results data, the first dataset separate from the second database account; and outputting the query results to the second database account. ### Claim 16 (depends on 15) The computer system of claim 15, the operations further comprising selecting, by the first database account, one or more first-dataset columns of the first dataset as one or more permitted fields in queries, wherein the generating, by the secure function, of the query results further comprises verifying that the query is directed only to the one or more permitted fields. ### Claim 17 (depends on 15) The computer system of claim 15, wherein: the first database account does not have access to the second dataset in plain-text format; and the second database account does not have access to the first dataset in plain-text format. ### Claim 18 (depends on 15) The computer system of claim 15, wherein both the first and second database accounts reside in a distributed database. ### Claim 19 (depends on 15) The computer system of claim 15, wherein: the first database account resides in a first networked database platform; and the second database resides in a second networked database platform. ### Claim 20 (depends on 19) The computer system of claim 19, wherein the first networked database platform and the second networked database platform are in different geographic regions. ### Claim 21 (depends on 15) The computer system of claim 15, wherein the secure function comprises a user-defined function. ### Claim 22 (depends on 15) The computer system of claim 15, wherein the secure function comprises a stored procedure. ### Claim 23 (depends on 15) The computer system of claim 15, wherein the query performs overlap analysis between the first and second datasets. ### Claim 24 (depends on 23) The computer system of claim 23, wherein the overlap analysis is with respect to a user-identifier column in both the first and second datasets. ### Claim 25 One or more non-transitory computer readable storage media containing instructions that, when executed by at least one hardware processor of a computer system, cause the computer system to perform operations comprising: sharing, by a first database account with a second database account, a secure function configured to accept as input and to process an encrypted dataset and a decryption parameter, the first database account including a first dataset, the second database account including a second dataset; selecting, by the second database account, one or more rows and one or more columns of the second dataset as a searchable dataset; generating, by the second database account, an encrypted searchable dataset by encrypting the searchable dataset with a key; calling, by the second database account, the secure function by inputting the encrypted searchable dataset and the key into the secure function; and based on the inputted encrypted searchable dataset and the key, generating, by the secure function, query results of a query by performing operations comprising: generating a decrypted searchable dataset by decrypting the encrypted searchable dataset with the key in a secure environment; anonymizing the decrypted searchable dataset by generating a cross reference table that cross references the anonymized searchable dataset and the decrypted searchable dataset; obtaining the query results by executing the query against a combination of the first dataset and the anonymized searchable dataset in the secure environment to generated query-results data, the first dataset separate from the second database account; and outputting the query results to the second database account. ### Claim 26 (depends on 25) The one or more non-transitory computer readable storage media of claim 25, the operations further comprising selecting, by the first database account, one or more first-dataset columns of the first dataset as one or more permitted fields in queries, wherein the generating, by the secure function, of the query results further comprises verifying that the query is directed only to the one or more permitted fields. ### Claim 27 (depends on 25) The one or more non-transitory computer readable storage media of claim 25, wherein: the first database account does not have access to the second dataset in plain-text format; and the second database account does not have access to the first dataset in plain-text format. ### Claim 28 (depends on 25) The one or more non-transitory computer readable storage media of claim 25, wherein both the first and second database accounts reside in a distributed database. ### Claim 29 (depends on 25) The one or more non-transitory computer readable storage media of claim 25, wherein: the first database account resides in a first networked database platform; and the second database resides in a second networked database platform. ### Claim 30 (depends on 29) The one or more non-transitory computer readable storage media of claim 29, wherein the first networked database platform and the second networked database platform are in different geographic regions.