# US 12,223,085 B2 · Identity resolution and data enrichment application framework

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,223,085 B2
- Document ID: US12223085B2
- Status: Granted
- Kind: B2
- Application number: 18/497,205
- Filed: 2023-10-30
- Published: 2024-07-04
- Granted: 2025-02-11
- Earliest claimed: 2022-12-29
- Assignees: Snowflake Inc.
- Applicants: Snowflake Inc.
- Inventors: Marcus A. Henderson; Justin Langseth
- Web page: https://patentgrep.com/patent/US12223085B2

## CPC

- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- G06F 16/2255: {Hash tables}
- G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 2221/2113: Multi-level security, e.g. mandatory access control
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Techniques for identity resolution and data enrichment include instantiating, at an account of a data consumer, an identity resolution application using an installer stored procedure. A data object is configured, at the account of the data consumer, to share log data generated by the identity resolution application with an account of a data provider. The identity resolution application is enabled, at the account of the data consumer, for an identity resolution process using source data based on an instruction originating from the account of the data provider. The instruction is based on the configuring of the data object.

## Claims

### Claim 1

A system comprising:
at least one hardware processor; and
at least one memory storing instructions that cause the at least one hardware processor to perform operations comprising:
instantiating, at an account of a data consumer, an identity resolution application using an installer stored procedure;
configuring, at the account of the data consumer, a data object to share log data generated by the identity resolution application with an account of a data provider;
enabling, at the account of the data consumer, the identity resolution application for an identity resolution process using source data based on an instruction originating from the account of the data provider, the instruction based on the configuring of the data object; and
performing the identity resolution process at the account of the data consumer using the source data based at least on granting a record enrichment stored procedure of the identity resolution application, a write access privilege to a result data table being stored at the account of the data consumer.

### Claim 2 (depends on 1)

The system of claim 1, wherein the operations to configure the data object further comprise:
configuring the data object as an outbound share, the outbound share designating a share at the account of the data provider as a receiving share to receive the log data.

### Claim 3 (depends on 1)

The system of claim 1, wherein the operations to enable the identity resolution application further comprise:
enabling, at the account of the data consumer, a record enrichment stored procedure of the identity resolution application for the identity resolution process based on the instruction.

### Claim 4 (depends on 3)

The system of claim 3, the operations further comprising:
accessing using the record enrichment stored procedure, the source data from the account of the data provider, the source data associated with the identity resolution process.

### Claim 5 (depends on 1)

The system of claim 1, the operations further comprising:
performing the identity resolution process at the account of the data consumer using the source data based on:
granting the record enrichment stored procedure, first read access privileges to an input data table stored at the account of the data consumer; and
granting the record enrichment stored procedure, second read access privileges to the source data managed by the account of the data provider.

### Claim 6 (depends on 5)

The system of claim 5, the operations further comprising:
retrieving by the record enrichment stored procedure, personally identifiable information (PII) from the input data table, using the first read access privileges.

### Claim 7 (depends on 6)

The system of claim 6, the operations further comprising:
generating, by the record enrichment stored procedure, a secure identifier of a user associated with the PII based on the source data.

### Claim 8 (depends on 7)

The system of claim 7, the operations further comprising:
updating, by the record enrichment stored procedure, the result data table with the secure identifier using the write access privilege.

### Claim 9 (depends on 1)

The system of claim 1, the operations further comprising:
generating an application log of the identity resolution application as the log data, the application log being based on one or more functions performed by the identity resolution application during the identity resolution process.

### Claim 10 (depends on 9)

The system of claim 9, the operations further comprising:
generating at the account of the data consumer, a hash of the application log using a hash function associated with the account of the data provider;
revising the application log with the hash to generate a revised application log; and
sharing the revised application log with a log verification procedure at the account of the data provider using the data object.

### Claim 11

A method comprising:
performing, by at least one hardware processor, operations comprising:
instantiating, at an account of a data consumer, an identity resolution application using an installer stored procedure;
configuring, at the account of the data consumer, a data object to share log data generated by the identity resolution application with an account of a data provider;
enabling, at the account of the data consumer, the identity resolution application for an identity resolution process using source data based on an instruction originating from the account of the data provider, the instruction based on the configuring of the data object; and
performing the identity resolution process at the account of the data consumer using the source data based at least on granting a record enrichment stored procedure of the identity resolution application, a write access privilege to a result data table being stored at the account of the data consumer.

### Claim 12 (depends on 11)

The method of claim 11, wherein the configuring of the data object further comprises:
configuring the data object as an outbound share, the outbound share designating a share at the account of the data provider as a receiving share to receive the log data.

### Claim 13 (depends on 11)

The method of claim 11, wherein the enabling of the identity resolution application further comprises:
enabling, at the account of the data consumer, a record enrichment stored procedure of the identity resolution application for the identity resolution process based on the instruction.

### Claim 14 (depends on 13)

The method of claim 13, further comprising:
accessing using the record enrichment stored procedure, the source data from the account of the data provider, the source data associated with the identity resolution process.

### Claim 15 (depends on 11)

The method of claim 11, further comprising:
performing the identity resolution process at the account of the data consumer using the source data based on:
granting the record enrichment stored procedure, first read access privileges to an input data table stored at the account of the data consumer; and
granting the record enrichment stored procedure, second read access privileges to the source data managed by the account of the data provider.

### Claim 16 (depends on 15)

The method of claim 15, further comprising:
retrieving by the record enrichment stored procedure, personally identifiable information (PII) from the input data table, using the first read access privileges.

### Claim 17 (depends on 16)

The method of claim 16, further comprising:
generating, by the record enrichment stored procedure, a secure identifier of a user associated with the PII based on the source data.

### Claim 18 (depends on 17)

The method of claim 17, further comprising:
updating, by the record enrichment stored procedure, the result data table with the secure identifier using the write access privilege.

### Claim 19 (depends on 11)

The method of claim 11, further comprising:
generating an application log of the identity resolution application as the log data, the application log being based on one or more functions performed by the identity resolution application during the identity resolution process.

### Claim 20 (depends on 19)

The method of claim 19, further comprising:
generating at the account of the data consumer, a hash of the application log using a hash function associated with the account of the data provider;
revising the application log with the hash to generate a revised application log; and
sharing the revised application log with a log verification procedure at the account of the data provider using the data object.

### Claim 21

A computer-storage medium comprising instructions that, when executed by one or more processors of a machine, configure the machine to perform operations comprising:
instantiating, at an account of a data consumer, an identity resolution application using an installer stored procedure;
configuring, at the account of the data consumer, a data object to share log data generated by the identity resolution application with an account of a data provider;
enabling, at the account of the data consumer, the identity resolution application for an identity resolution process using source data based on an instruction originating from the account of the data provider, the instruction based on the configuring of the data object; and
performing the identity resolution process at the account of the data consumer using the source data based at least on granting a record enrichment stored procedure of the identity resolution application, a write access privilege to a result data table being stored at the account of the data consumer.

### Claim 22 (depends on 21)

The computer-storage medium of claim 21, wherein the operations to configure the data object further comprise:
configuring the data object as an outbound share, the outbound share designating a share at the account of the data provider as a receiving share to receive the log data.

### Claim 23 (depends on 21)

The computer-storage medium of claim 21, wherein the operations to enable the identity resolution application further comprise:
enabling, at the account of the data consumer, a record enrichment stored procedure of the identity resolution application for the identity resolution process based on the instruction.

### Claim 24 (depends on 23)

The computer-storage medium of claim 23, the operations further comprising:
accessing using the record enrichment stored procedure, the source data from the account of the data provider, the source data associated with the identity resolution process.

### Claim 25 (depends on 21)

The computer-storage medium of claim 21, the operations further comprising:
performing the identity resolution process at the account of the data consumer using the source data based on:
granting the record enrichment stored procedure, first read access privileges to an input data table stored at the account of the data consumer; and
granting the record enrichment stored procedure, second read access privileges to the source data managed by the account of the data provider.

### Claim 26 (depends on 25)

The computer-storage medium of claim 25, the operations further comprising:
retrieving by the record enrichment stored procedure, personally identifiable information (PII) from the input data table, using the first read access privileges.

### Claim 27 (depends on 26)

The computer-storage medium of claim 26, the operations further comprising:
generating, by the record enrichment stored procedure, a secure identifier of a user associated with the PII based on the source data.

### Claim 28 (depends on 27)

The computer-storage medium of claim 27, the operations further comprising:
updating, by the record enrichment stored procedure, the result data table with the secure identifier using the write access privilege.

### Claim 29 (depends on 21)

The computer-storage medium of claim 21, the operations further comprising:
generating an application log of the identity resolution application as the log data, the application log being based on one or more functions performed by the identity resolution application during the identity resolution process.

### Claim 30 (depends on 29)

The computer-storage medium of claim 29, the operations further comprising:
generating at the account of the data consumer, a hash of the application log using a hash function associated with the account of the data provider;
revising the application log with the hash to generate a revised application log; and
sharing the revised application log with a log verification procedure at the account of the data provider using the data object.