# US 12,184,610 B2 · Bi-directional data sharing between private and public clouds > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,184,610 B2 - Document ID: US12184610B2 - Status: Granted - Kind: B2 - Application number: 18/429,215 - Filed: 2024-01-31 - Published: 2024-05-23 - Granted: 2024-12-31 - Earliest claimed: 2022-10-31 - Assignees: Snowflake Inc. - Applicants: Snowflake Inc. - Inventors: Khondokar Sami Iqram; Laxman Mamidi; Sanjay Srivastava; Chieh-Sheng Wang; Di Wu - Web page: https://patentgrep.com/patent/US12184610B2 ## CPC - H04L 63/0263: {Rule management} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/0272: {Virtual private networks} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for secure data synchronization and sharing between distinct cloud environments is disclosed. The method involves establishing a trust relationship between a data provider's private cloud deployment and a data consumer's public cloud deployment. Utilizing hardware processors, a cross-region group sharing token is generated and validated to facilitate secure communication and data traffic between the two cloud deployments. Upon validation, a firewall policy that previously restricted data exchange is disabled, allowing for the replication of a target database from the private cloud to a secure share area accessible by the public cloud deployment. The data consumer is then enabled to access and utilize the replicated database within this secure area. The method ensures consistent data management across both deployments by managing the synchronization of the replicated database with the data provider's original database, thereby maintaining data consistency and integrity. ## Claims ### Claim 1 A method comprising: establishing a trust relationship between a private cloud deployment of a data provider and a public cloud deployment of a data consumer; generating a cross-region group sharing token to facilitate secure communication between the private cloud deployment and the public cloud deployment; validating, by at least one hardware processor, the cross-region group sharing token to confirm an identity of the data provider and the data consumer; disabling a firewall policy that restricts data traffic between the private cloud deployment and the public cloud deployment based on the established trust relationship; replicating a target database from the private cloud deployment of the data provider to a secure share area accessible by the public cloud deployment of the data consumer; enabling the data consumer to at least access the replicated target database within the secure share area; and managing synchronization of the replicated target database with the target database of the data provider to maintain data consistency across the private cloud deployment and the public cloud deployment. ### Claim 2 (depends on 1) The method of claim 1, wherein the private cloud deployment is a virtual private cloud deployment in a first region designated as the private region and the public cloud deployment is a public multi-tenant cloud deployment in a second region designated as a public multi-tenant region. ### Claim 3 (depends on 1) The method of claim 1, wherein the disabling of the firewall policy comprises: employing rules that selectively restrict the data traffic based on geographic location, and the disabling of the firewall policy being contingent upon a location of the data consumer being within an approved geographic region. ### Claim 4 (depends on 1) The method of claim 1, comprising: employing a replication feature to create at least one redundant copy of the replicated target database for enhanced disaster recovery. ### Claim 5 (depends on 1) The method of claim 1, comprising: managing data analysis tasks; and performing data integrity checks on the replicated target database using statistical analysis to ensure data accuracy post-replication. ### Claim 6 (depends on 1) The method of claim 1, comprising: storing metadata available in one or more local caches of a database system; and utilizing the metadata to optimize query execution against the replicated target database by avoiding unnecessary data processing. ### Claim 7 (depends on 6) The method of claim 6, comprising: enabling the data provider to grant permission to a user of the database system to share the data in a public multi-tenant region. ### Claim 8 A system comprising: one or more hardware processors of a machine; and at least one memory storing instructions that, when executed by the one or more hardware processors, cause the system to perform operations comprising: establishing a trust relationship between a private cloud deployment of a data provider and a public cloud deployment of a data consumer; generating a cross-region group sharing token to facilitate secure communication between the private cloud deployment and the public cloud deployment; validating, by at least one hardware processor, the cross-region group sharing token to confirm an identity of the data provider and the data consumer; disabling a firewall policy that restricts data traffic between the private cloud deployment and the public cloud deployment based on the established trust relationship; replicating a target database from the private cloud deployment of the data provider to a secure share area accessible by the public cloud deployment of the data consumer; enabling the data consumer to at least access the replicated target database within the secure share area; and managing synchronization of the replicated target database with the target database of the data provider to maintain data consistency across the private cloud deployment and the public cloud deployment. ### Claim 9 (depends on 8) The system of claim 8, wherein the private cloud deployment is a virtual private cloud deployment in a first region designated as the private region and the public cloud deployment is a public multi-tenant cloud deployment in a second region designated as a public multi-tenant region. ### Claim 10 (depends on 8) The system of claim 8, wherein the disabling of the firewall policy comprises: employing rules that selectively restrict the data traffic based on geographic location, and the disabling of the firewall policy being contingent upon a location of the data consumer being within an approved geographic region. ### Claim 11 (depends on 8) The system of claim 8, comprising: employing a replication feature to create at least one redundant copy of the replicated target database for enhanced disaster recovery. ### Claim 12 (depends on 8) The system of claim 8, comprising: managing data analysis tasks; and performing data integrity checks on the replicated target database using statistical analysis to ensure data accuracy post-replication. ### Claim 13 (depends on 8) The system of claim 8, comprising: storing metadata available in one or more local caches of a database system; and utilizing the metadata to optimize query execution against the replicated target database by avoiding unnecessary data processing. ### Claim 14 (depends on 8) The system of claim 8, comprising: enabling the data provider to grant permission to a user of the database system to share the data in a public multi-tenant region. ### Claim 15 A machine-storage medium embodying instructions that, when executed by a machine, cause the machine to perform operations comprising: establishing a trust relationship between a private cloud deployment of a data provider and a public cloud deployment of a data consumer; generating a cross-region group sharing token to facilitate secure communication between the private cloud deployment and the public cloud deployment; validating, by at least one hardware processor, the cross-region group sharing token to confirm an identity of the data provider and the data consumer; disabling a firewall policy that restricts data traffic between the private cloud deployment and the public cloud deployment based on the established trust relationship; replicating a target database from the private cloud deployment of the data provider to a secure share area accessible by the public cloud deployment of the data consumer; enabling the data consumer to at least access the replicated target database within the secure share area; and managing synchronization of the replicated target database with the target database of the data provider to maintain data consistency across the private cloud deployment and the public cloud deployment. ### Claim 16 (depends on 15) The machine-storage medium of claim 15, wherein the private cloud deployment is a virtual private cloud deployment in a first region designated as the private region and the public cloud deployment is a public multi-tenant cloud deployment in a second region designated as a public multi-tenant region. ### Claim 17 (depends on 15) The machine-storage medium of claim 15, wherein the disabling of the firewall policy comprises: employing rules that selectively restrict the data traffic based on geographic location, and the disabling of the firewall policy being contingent upon a location of the data consumer being within an approved geographic region. ### Claim 18 (depends on 15) The machine-storage medium of claim 15, comprising: employing a replication feature to create at least one redundant copy of the replicated target database for enhanced disaster recovery. ### Claim 19 (depends on 15) The machine-storage medium of claim 15, comprising: managing data analysis tasks; and performing data integrity checks on the replicated target database using statistical analysis to ensure data accuracy post-replication. ### Claim 20 (depends on 15) The machine-storage medium of claim 15, comprising: storing metadata available in one or more local caches of a database system; and utilizing the metadata to optimize query execution against the replicated target database by avoiding unnecessary data processing.