# US 12,764,097 B2 · Network egress access control with untrusted intermediary > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,097 B2 - Document ID: US12764097B2 - Status: Granted - Kind: B2 - Application number: 18/614,312 - Filed: 2024-03-22 - Published: 2025-09-25 - Granted: 2026-10-13 - Earliest claimed: 2024-03-22 - Assignees: Snowflake Inc. - Applicants: Snowflake Inc. - Inventors: David B. Bailey; Brandon S. Baker; Andreas Emil Bauer; Derek Denny-Brown; Shengda Wang; Ethan Grant Young; Haowei Yu; Thant Htoo Zaw - Web page: https://patentgrep.com/patent/US12764097B2 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A network egress request is received from a container service within a cloud data platform. A cryptographically signed egress policy associated with the network egress request is received by a trusted service controller of the cloud data platform. The network egress request is validated against the cryptographically signed egress policy. Based on the validation, a determination of whether the network egress request complies with the cryptographically signed egress policy is established. Upon validation, the network egress request is granted or denied based on the determination. ## Claims ### Claim 1 A system comprising: one or more hardware processors of a machine; and at least one memory storing instructions that, when executed by the one or more hardware processors, cause the system to perform operations comprising: receiving a network egress request, via an untrusted execution node, from a container service within a cloud data platform; receiving a cryptographically signed egress policy associated with the network egress request; validating the network egress request against the cryptographically signed egress policy, the validating comprising forwarding Domain Name System (DNS) requests from the container service to an off-node DNS resolver including policy enforcement capabilities; establishing a determination of whether the network egress request complies with the cryptographically signed egress policy based on the validating; and granting or denying the network egress request based on the determination, the granting comprising proxying network traffic associated with the network egress request through an egress proxy that performs network address translation to route outbound and corresponding return traffic for the container service. ### Claim 2 (depends on 1) The system of claim 1, wherein the network egress request includes a request to access an external service over a public communication network. ### Claim 3 (depends on 1) The system of claim 1, the operations further comprising: configuring the container service to use a local DNS resolver for the DNS requests; and resolving the DNS requests based on allowed hostnames specified in the cryptographically signed egress policy, wherein the off-node DNS resolver is located within a control plane node of the cloud data platform. ### Claim 4 (depends on 3) The system of claim 3, the operations further comprising: generating a pinned IP policy based on the allowed hostnames; registering the pinned IP policy with an egress proxy, the egress proxy configured to receive network traffic from an untrusted worker node; and enabling secure network egress for the container service based on the pinned IP policy. ### Claim 5 (depends on 4) The system of claim 4, the operations further comprising: defining an external access integration (EAI) that specifies allowed destination IP: Port pairs and DNS hostnames that the egress proxy is allowed to use; signing a configmap comprising the egress policy with a digital signature to generate a signed configmap; and storing the signed configmap in a secure repository of the cloud data platform, the secure repository being accessible to the egress proxy. ### Claim 6 (depends on 1) The system of claim 1, wherein validating the network egress request against the cryptographically signed egress policy further comprises: intercepting network traffic originating from the container service using an extended Berkeley Packet Filter (eBPF) program; enforcing a network policy on the network traffic according to the eBPF program; and dropping unauthorized network traffic. ### Claim 7 (depends on 1) The system of claim 1, wherein the cryptographically signed egress policy associated with the network egress request includes a list of trusted domains for DNS resolution, the list of trusted domains is defined by a customer account administrator. ### Claim 8 A method comprising: receiving, via an untrusted execution node, a network egress request from a container service within a cloud data platform; receiving a cryptographically signed egress policy associated with the network egress request; validating the network egress request against the cryptographically signed egress policy, the validating comprising forwarding Domain Name System (DNS) requests from the container service to an off-node DNS resolver including policy enforcement capabilities; establishing a determination of whether the network egress request complies with the cryptographically signed egress policy based on the validating; and granting or denying the network egress request based on the determination, the granting comprising proxying network traffic associated with the network egress request through an egress proxy that performs network address translation to route outbound and corresponding return traffic for the container service. ### Claim 9 (depends on 8) The method of claim 8, wherein the network egress request includes a request to access an external service over a public communication network. ### Claim 10 (depends on 8) The method of claim 8, further comprising: configuring the container service to use a local DNS resolver for the DNS requests; and resolving the DNS requests based on allowed hostnames specified in the cryptographically signed egress policy, wherein the off-node DNS resolver is located within a control plane node of the cloud data platform. ### Claim 11 (depends on 10) The method of claim 10, further comprising: generating a pinned IP policy based on the allowed hostnames; registering the pinned IP policy with an egress proxy, the egress proxy configured to receive network traffic from an untrusted worker node; and enabling secure network egress for the container service based on the pinned IP policy. ### Claim 12 (depends on 11) The method of claim 11, further comprising: defining an external access integration (EAI) that specifies allowed destination IP: Port pairs and DNS hostnames that the egress proxy is allowed to use; signing a configmap comprising the egress policy with a digital signature to generate a signed configmap; and storing the signed configmap in a secure repository of the cloud data platform, the secure repository accessible to the egress proxy. ### Claim 13 (depends on 8) The method of claim 8, wherein validating the network egress request against the cryptographically signed egress policy further comprises: intercepting network traffic originating from the container service using an extended Berkeley Packet Filter (eBPF) program; enforcing a network policy on the network traffic according to the eBPF program; and dropping unauthorized network traffic. ### Claim 14 (depends on 8) The method of claim 8, wherein the cryptographically signed egress policy associated with the network egress request includes a list of trusted domains for DNS resolution, the list of trusted domains is defined by a customer account administrator. ### Claim 15 A machine-storage medium embodying instructions that, when executed by a machine, cause the machine to perform operations comprising: receiving a network egress request from a container service within a cloud data platform; receiving, via an untrusted execution node by a trusted service controller of the cloud data platform, a cryptographically signed egress policy associated with the network egress request; validating, by one or more hardware processors, the network egress request against the cryptographically signed egress policy, the validating comprising forwarding Domain Name System (DNS) requests from the container service to an off-node DNS resolver including policy enforcement capabilities; establishing a determination of whether the network egress request complies with the cryptographically signed egress policy based on the validating; and granting or denying the network egress request based on the determination, the granting comprising proxying network traffic associated with the network egress request through an egress proxy that performs network address translation to route outbound and corresponding return traffic for the container service. ### Claim 16 (depends on 15) The machine-storage medium of claim 15, wherein the network egress request includes a request to access an external service over a public communication network. ### Claim 17 (depends on 15) The machine-storage medium of claim 15, the operations further comprising: configuring the container service to use a local DNS resolver for the DNS requests; and resolving the DNS requests based on allowed hostnames specified in the cryptographically signed egress policy, wherein the off-node DNS resolver is located within a control plane node of the cloud data platform. ### Claim 18 (depends on 17) The machine-storage medium of claim 17, the operations further comprising: generating a pinned IP policy based on the allowed hostnames; registering the pinned IP policy with an egress proxy, the egress proxy configured to receive network traffic from an untrusted worker node; and enabling secure network egress for the container service based on the pinned IP policy. ### Claim 19 (depends on 18) The machine-storage medium of claim 18, the operations further comprising: defining an external access integration (EAI) that specifies allowed destination IP: Port pairs and DNS hostnames that the egress proxy is allowed to use; signing a configmap comprising the egress policy with a digital signature to generate a signed configmap; and storing the signed configmap in a secure repository of the cloud data platform, the secure repository being accessible to the egress proxy. ### Claim 20 (depends on 15) The machine-storage medium of claim 15, wherein validating the network egress request against the cryptographically signed egress policy further comprises: intercepting network traffic originating from the container service using an extended Berkeley Packet Filter (eBPF) program; enforcing a network policy on the network traffic according to the eBPF program; and dropping unauthorized network traffic.