# US 12,120,189 B2 · Remote execution using a global identity

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,120,189 B2
- Document ID: US12120189B2
- Status: Granted
- Kind: B2
- Application number: 18/497,720
- Filed: 2023-10-30
- Published: 2024-02-22
- Granted: 2024-10-15
- Earliest claimed: 2020-07-17
- Assignees: Snowflake Inc.
- Applicants: Snowflake Inc.
- Inventors: Khalid Zaman Bijon; Damien Carru; Christopher Peter Child; Eric Karlson; Zheng Mi
- Web page: https://patentgrep.com/patent/US12120189B2

## CPC

- H04L 67/306: User profiles
- G06F 9/54: Interprogram communication
- G06F 9/547: {Remote procedure calls [RPC]; Web services}
- G06F 21/31: User authentication
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 41/50: Network service management, e.g. ensuring proper service fulfilment according to agreements
- H04L 41/5041: characterised by the time relationship between creation and deployment of a service
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 63/102: {Entity profiles}
- H04L 63/105: {Multiple levels of security}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- H04L 67/59: Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable
- H04L 67/60: Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources (admission control or resource allocation H04L47/70)
- G06F 2209/541: Client-server
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Embodiments of the present disclosure may provide a streamlined process for performing operations, such as data sharing and data replication, using multiple accounts. A global identity (also referred to as an organization user) may be employed, where the global identity may have access to multiple accounts across the same or different deployments. The global identity may switch between accounts from its login session and perform various tasks in the context of different accounts without undergoing further authentication.

## Claims

### Claim 1

A method comprising:
establishing, at a first deployment, a session pool for a login session for a user providing access to a plurality of accounts associated with an organization based on a global identity;
providing, using the session pool, a first remote session with a first remote session ID using a first proxy user associated with the user for the first remote session;
providing, using the session pool, a second remote session with a second remote session ID using a second proxy user associated with the user for the second remote session;
receiving, in the session pool, a first selection for the first remote session;
transmitting, from the first deployment, a first execution request to a second deployment associated with the first remote session, the second deployment being configured to execute the first execution request in context of the first proxy user;
receiving, in the session pool, a second selection for the second remote session; and
transmitting, from the first deployment, a second execution request to a third deployment associated with the second remote session, the third deployment being configured to execute the second execution request in context of the second proxy user.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
receiving, from the second deployment, a first result based on the first execution request; and
receiving, from a third deployment, a second result based on the second execution request.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
combining the first and second results to generate a final result.

### Claim 4 (depends on 2)

The method of claim 2, wherein receiving the first result includes retrieving the first result from a cloud storage location.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
authenticating a one-way trust relationship associated with the global identity,
wherein the login session provides access to the plurality of accounts without further authentication.

### Claim 6 (depends on 5)

The method of claim 5, wherein the authenticating is performed using a single sign-on token.

### Claim 7 (depends on 1)

The method of claim 1, wherein at least one property value of the first proxy user indicates that that the first proxy user is standing in for the global identity.

### Claim 8

A system comprising:
one or more processors of a machine; and
at least one memory storing instructions that, when executed by the one or more processors, cause the machine to perform operations comprising:
establishing, at a first deployment, a session pool for a login session for a user providing access to a plurality of accounts associated with an organization based on a global identity;
providing, using the session pool, a first remote session with a first remote session ID using a first proxy user associated with the user for the first remote session;
providing, using the session pool, a second remote session with a second remote session ID using a second proxy user associated with the user for the second remote session;
receiving, in the session pool, a first selection for the first remote session;
transmitting, from the first deployment, a first execution request to a second deployment associated with the first remote session, the second deployment being configured to execute the first execution request in context of the first proxy user;
receiving, in the session pool, a second selection for the second remote session; and
transmitting, from the first deployment, a second execution request to a third deployment associated with the second remote session, the third deployment being configured to execute the second execution request in context of the second proxy user.

### Claim 9 (depends on 8)

The system of claim 8, the operations further comprising:
receiving, from the second deployment, a first result based on the first execution request; and
receiving, from a third deployment, a second result based on the second execution request.

### Claim 10 (depends on 9)

The system of claim 9, further comprising:
combining the first and second results to generate a final result.

### Claim 11 (depends on 9)

The system of claim 9, wherein receiving the first result includes retrieving the first result from a cloud storage location.

### Claim 12 (depends on 8)

The system of claim 8, the operations further comprising:
authenticating a one-way trust relationship associated with the global identity,
wherein the login session provides access to the plurality of accounts without further authentication.

### Claim 13 (depends on 12)

The system of claim 12, wherein the authenticating is performed using a single sign-on token.

### Claim 14 (depends on 8)

The system of claim 8, wherein at least one property value of the first proxy user indicates that that the first proxy user is standing in for the global identity.

### Claim 15

A non-transitory computer readable storage media storing instructions that, when executed by one or more processors, cause the one or more processors to:
establishing, at a first deployment, a session pool for a login session for a user providing access to a plurality of accounts associated with an organization based on a global identity;
providing, using the session pool, a first remote session with a first remote session ID using a first proxy user associated with the user for the first remote session;
providing, using the session pool, a second remote session with a second remote session ID using a second proxy user associated with the user for the second remote session;
receiving, in the session pool, a first selection for the first remote session;
transmitting, from the first deployment, a first execution request to a second deployment associated with the first remote session, the second deployment being configured to execute the first execution request in context of the first proxy user;
receiving, in the session pool, a second selection for the second remote session; and
transmitting, from the first deployment, a second execution request to a third deployment associated with the second remote session, the third deployment being configured to execute the second execution request in context of the second proxy user.

### Claim 16 (depends on 15)

The non-transitory computer readable storage media of claim 15, further comprising:
receiving, from the second deployment, a first result based on the first execution request; and
receiving, from a third deployment, a second result based on the second execution request.

### Claim 17 (depends on 16)

The non-transitory computer readable storage media of claim 16, further comprising:
combining the first and second results to generate a final result.

### Claim 18 (depends on 16)

The non-transitory computer readable storage media of claim 16, wherein receiving the first result includes retrieving the first result from a cloud storage location.

### Claim 19 (depends on 15)

The non-transitory computer readable storage media of claim 15, further comprising:
authenticating a one-way trust relationship associated with the global identity,
wherein the login session provides access to the plurality of accounts without further authentication.

### Claim 20 (depends on 19)

The non-transitory computer readable storage media of claim 19, wherein the authenticating is performed using a single sign-on token.

### Claim 21 (depends on 15)

The non-transitory computer readable storage media of claim 15, wherein at least one property value of the first proxy user indicates that that the first proxy user is standing in for the global identity.