# US 12,223,082 B2 · Secure roles for data sharing

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,223,082 B2
- Document ID: US12223082B2
- Status: Granted
- Kind: B2
- Application number: 18/217,288
- Filed: 2023-06-30
- Published: 2024-05-23
- Granted: 2025-02-11
- Earliest claimed: 2022-11-23
- Assignees: Snowflake Inc.
- Applicants: Snowflake Inc.
- Inventors: Vikas Jain; Eric Karlson; Sepideh Khoshnood; Ramana Rao S. Turlapati
- Web page: https://patentgrep.com/patent/US12223082B2

## CPC

- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/102: {Entity profiles}
- H04L 63/105: {Multiple levels of security}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/104: {Grouping of entities}
- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Embodiments of the present disclosure provide systems and methods for managing role hierarchies and assignment of permissions by providing secure roles which are roles where the only user that can grant any privilege to the secure role, is the role that owns the secure role. A set of secure roles that defines a role hierarchy may be generated, wherein only a role that owns the set of secure roles can grant any privilege to each of the secure roles. The role that owns the set of secure roles may grant one or more privileges to a first secure role of the set of secure roles. In response to a user other than the role that owns the set of secure roles attempting to grant a privilege to the first secure role or modify a privilege granted to the first secure role, the attempt may be denied.

## Claims

### Claim 1

A method comprising:
generating a set of secure roles that define a role hierarchy, wherein for each secure role of the set of secure roles:
the secure role comprises an object assigned to a user;
privileges on database objects are granted to the secure role via the object; and
only a role that owns the secure role can grant any privilege to the secure role or modify any privilege granted to the secure role;
generating an inherited grant that specifies a permission on a first type of object and a grant of the permission to a first secure role of the set of secure roles;
in response to a role other than the role that owns the first secure role attempting to grant a privilege to the first secure role or modify a privilege granted to the first secure role, denying the attempt to preserve the role hierarchy;
in response to a first object of a set of objects of the first type being referenced via the first secure role, creating a virtual implied grant based on the inherited grant; and
authorizing utilization of the permission on the first object using the virtual implied grant, wherein the virtual implied grant is transient and exists in-memory only for the purpose of authorizing the utilization of the permission on the first object.

### Claim 2 (depends on 1)

The method of claim 1, wherein the role hierarchy is based on an external authorization model.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
attaching the inherited grant to a container owned by the first secure role, wherein the container includes the set of objects of the first type.

### Claim 4 (depends on 3)

The method of claim 3, wherein at a time the inherited grant is attached to the container, authorizing utilization of the permission on any of the set of objects is performed using a corresponding virtual implied grant that is created based on the inherited grant.

### Claim 5 (depends on 3)

The method of claim 3, further comprising:
removing the inherited grant from the container, wherein at a time the inherited grant is removed from the container, authorizing utilization of the permission on any of the set of objects is no longer performed using a corresponding virtual implied grant that is created based on the inherited grant.

### Claim 6 (depends on 3)

The method of claim 3, wherein the container is a schema or a database.

### Claim 7 (depends on 3)

The method of claim 3, wherein the first type of object is one of: a table, a view, a function, or a native application.

### Claim 8 (depends on 3)

The method of claim 3, wherein the permission is one of: a select privilege, an insert privilege, or a modify privilege.

### Claim 9

A system comprising:
a memory; and
a processing device operatively coupled to the memory, the processing device to:
generate a set of secure roles that define a role hierarchy, wherein for each secure role of the set of secure roles;
the secure role comprises an object assigned to a user;
privileges on database objects are granted to the secure role via the object; and
only a role that owns the secure role can grant any privilege to the secure role or modify any privilege granted to the secure role;
generate an inherited grant that specifies a permission on a first type of object and a grant of the permission to a first secure role of the set of secure roles;
in response to a role other than the role that owns the first secure role attempting to grant a privilege to the first secure role or modify a privilege granted to the first secure role, deny the attempt to preserve the role hierarchy;
in response to a first object of a set of objects of the first type being referenced via the first secure role, create a virtual implied grant based on the inherited grant; and
authorize utilization of the permission on the first object using the virtual implied grant, wherein the virtual implied grant is transient and exists in-memory only for the purpose of authorizing the utilization of the permission on the first object.

### Claim 10 (depends on 9)

The system of claim 9, wherein the role hierarchy is based on an external authorization model.

### Claim 11 (depends on 9)

The system of claim 9, wherein the processing device is further to:
attach the inherited grant to a container owned by the first secure role, wherein the container includes the set of objects of the first type.

### Claim 12 (depends on 11)

The system of claim 11, wherein at a time the inherited grant is attached to the container, the processing device authorizes utilization of the permission on any of the set of objects using a corresponding virtual implied grant that is created based on the inherited grant.

### Claim 13 (depends on 11)

The system of claim 11, wherein the processing device is further to:
remove the inherited grant from the container, wherein at a time the inherited grant is removed from the container, the processing device no longer authorizes utilization of the permission on any of the set of objects using a corresponding virtual implied grant that is created based on the inherited grant.

### Claim 14 (depends on 11)

The system of claim 11, wherein the container is a schema or a database.

### Claim 15 (depends on 11)

The system of claim 11, wherein the first type of object is one of: a table, a view, a function, or a native application.

### Claim 16 (depends on 11)

The system of claim 11, wherein the permission is one of: a select privilege, an insert privilege, or a modify privilege.

### Claim 17

A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processing device, cause the processing device to:
generate a set of secure roles that define a role hierarchy, wherein for each secure role of the set of secure roles:
the secure role comprises an object assigned to a user;
privileges on database objects are granted to the secure role via the object; and
only a role that owns the secure role can grant any privilege to the secure role or modify any privilege granted to the secure role;
generate an inherited grant that specifies a permission on a first type of object and a grant of the permission to a first secure role of the set of secure roles;
in response to a user other than the role that owns the first secure role attempting to grant a privilege to the first secure role or modify a privilege granted to the first secure role, deny the attempt to preserve the role hierarchy;
in response to a first object of a set of objects of the first type being referenced via the first secure role, create a virtual implied grant based on the inherited grant; and
authorize utilization of the permission on the first object using the virtual implied grant, wherein the virtual implied grant is transient and exists in-memory only for the purpose of authorizing the utilization of the permission on the first object.

### Claim 18 (depends on 17)

The non-transitory computer-readable medium of claim 17, wherein the role hierarchy is based on an external authorization model.

### Claim 19 (depends on 17)

The non-transitory computer-readable medium of claim 17, wherein the processing device is further to:
attach the inherited grant to a container owned by the first secure role, wherein the container includes the set of objects of the first type.

### Claim 20 (depends on 19)

The non-transitory computer-readable medium of claim 19, wherein at a time the inherited grant is attached to the container, the processing device authorizes utilization of the permission on any of the set of objects using a corresponding virtual implied grant that is created based on the inherited grant.

### Claim 21 (depends on 19)

The non-transitory computer-readable medium of claim 19, wherein the processing device is further to:
remove the inherited grant from the container, wherein at a time the inherited grant is removed from the container, the processing device no longer authorizes utilization of the permission on any of the set of objects using a corresponding virtual implied grant that is created based on the inherited grant.

### Claim 22 (depends on 19)

The non-transitory computer-readable medium of claim 19, wherein the container is a schema or a database.

### Claim 23 (depends on 19)

The non-transitory computer-readable medium of claim 19, wherein the first type of object is one of: a table, a view, a function, or a native application.

### Claim 24 (depends on 19)

The non-transitory computer-readable medium of claim 19, wherein the permission is one of: a select privilege, an insert privilege, or a modify privilege.