IP Library › Granted Patent US 10,958,431
Granted Patent B2
US 10,958,431 · App. 15/993,430 · Granted Mar 23, 2021

Authenticating computing system requests across tenants of a multi-tenant database system

Inventors: Matthew Bahrenburg (San Francisco, CA); Alan Vangpat (Pittsburgh, PA); Anupam Jain (Dublin, CA); William Charles Mortimore, Jr. (San Francisco, CA); Srinath Krishna Ananthakrishnan (San Mateo, CA); Peter S. Wisnovsky (Oakland, CA)
Assignee: salesforce.com, inc.
H04L9/30G06F21/602H04L9/3213
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,958,431
App. No.
15/993,430
Granted
Mar 23, 2021
Kind
B2
Abstract

Disclosed are some implementations of systems, apparatus, methods and computer program products for facilitating the authentication of computing system requests across tenants of at least one multi-tenant database system. Authentication is facilitated using a central registry that is accessible by and independent from the tenants of the multi-tenant database system.

Claims (56)

1. A system comprising:

a database system implemented using a server system including a memory and a processor, the database system configurable to cause:

storing, by the server system in a database, a registry including metadata corresponding to a plurality of tenants of one or more database systems, the metadata of the registry indicating, for each of the tenants, a public key and a set of permissions, the set of permissions indicating a set of the tenants and indicating, for each of the tenants in the set, one or more applications that are trusted;

processing, by the server system, at least one registry request received from a computing system of a target tenant that has received a tenant request from a requesting tenant, the tenant request being a request for data associated with the target tenant, the registry request identifying the requesting tenant and an application of the requesting tenant that is requesting access to the target tenant, the registry request being a request for metadata associated with the requesting tenant;

performing, by the server system, a lookup in the registry to obtain a public key of the target tenant;

authenticating, by the server system, the registry request using the public key of the target tenant;

after authenticating the registry request, performing, by the server system, a lookup in the registry to obtain a public key of the requesting tenant;

facilitating, by the server system, authentication of the tenant request received by the target tenant from the requesting tenant using the public key of the requesting tenant;

generating, by the server system, a registry reply using the registry, the registry reply including metadata indicating whether the application of the requesting tenant is trusted; and

transmitting, by the server system, the registry reply to the computing system of the target tenant.

2. The system as recited in claim 1 , the database system further configurable to cause:

facilitating authentication of the tenant request received by the target tenant from the requesting tenant by applying the public key of the requesting tenant.

3. The system as recited in claim 1 , the database system further configurable to cause:

facilitating authentication of the tenant request received by the target tenant from the requesting tenant by transmitting the public key of the requesting tenant to the target tenant.

4. The system as recited in claim 1 , the set of permissions further indicating, for each of the applications that are trusted, data that is accessible from the target tenant.

5. The system as recited in claim 1 , the database system further configurable to cause:

storing, in the database, the public key of the target tenant responsive to receiving the public key of the target tenant from the target tenant.

6. The system as recited in claim 1 , the registry being external to and independent from each of the tenants and the database systems.

7. The system as recited in claim 1 , the registry request comprising a JavaScript Object Notation (JSON) web token.

8. A computer program product, comprising one or more non-transitory computer-readable media having computer program instructions stored therein, the computer program instructions being configurable to cause:

storing, by a server system in a database, a registry including metadata corresponding to a plurality of tenants of one or more database systems, the metadata of the registry indicating, for each of the tenants, a public key and a set of permissions, the set of permissions indicating a set of the tenants and indicating, for each of the tenants in the set, one or more applications that are trusted;

processing, by the server system, at least one registry request received from a computing system of a target tenant that has received a tenant request from a requesting tenant, the tenant request being a request for data associated with the target tenant, the registry request identifying the requesting tenant and an application of the requesting tenant that is requesting access to the target tenant, the registry request being a request for metadata associated with the requesting tenant;

performing, by the server system, a lookup in the registry to obtain a public key of the target tenant;

authenticating, by the server system, the registry request using the public key of the target tenant;

after authenticating the registry request, performing, by the server system, a lookup in the registry to obtain a public key of the requesting tenant;

facilitating authentication, by the server system, of the tenant request received by the target tenant from the requesting tenant using the public key of the requesting tenant;

generating, by the server system, a registry reply using the registry, the registry reply including metadata indicating whether the application of the requesting tenant is trusted; and

transmitting, by the server system, the registry reply to the computing system of the target tenant.

9. The computer program product as recited in claim 8 , the computer program instructions further configurable to cause:

facilitating authentication of the tenant request received by the target tenant from the requesting tenant by applying the public key of the requesting tenant.

10. The computer program product as recited in claim 8 , the computer program instructions further configurable to cause:

facilitating authentication of the tenant request received by the target tenant from the requesting tenant by transmitting the public key of the requesting tenant to the target tenant.

11. The computer program product as recited in claim 8 , the set of permissions further indicating, for each of the applications that are trusted, data that is accessible from the target tenant.

12. The computer program product as recited in claim 8 , the computer program instructions further configurable to cause:

storing, in the database, the public key of the target tenant responsive to receiving the public key of the target tenant from the target tenant.

13. The computer program product as recited in claim 8 , the registry being external to and independent from each of the tenants and the database systems.

14. The computer program product as recited in claim 8 , the registry request comprising a JavaScript Object Notation (JSON) web token.

15. A method, comprising:

storing, by a server system in a database, a registry including metadata corresponding to a plurality of tenants of one or more database systems, the metadata of the registry indicating, for each of the tenants, a public key and a set of permissions, the set of permissions indicating a set of the tenants and indicating, for each of the tenants in the set, one or more applications that are trusted;

processing, by the server system, at least one registry request received from a computing system of a target tenant, the registry request identifying a requesting tenant and an application of the requesting tenant that is requesting access to the target tenant;

processing, by the server system, at least one registry request received from a computing system of a target tenant that has received a tenant request from a requesting tenant, the tenant request being a request for data associated with the target tenant, the registry request identifying the requesting tenant and an application of the requesting tenant that is requesting access to the target tenant, the registry request being a request for metadata associated with the requesting tenant;

performing, by the server system, a lookup in the registry to obtain a public key of the target tenant;

authenticating, by the server system, the registry request using the public key of the target tenant;

after authenticating the registry request, performing, by the server system, a lookup in the registry to obtain a public key of the requesting tenant;

facilitating, by the server system, authentication of the tenant request received by the target tenant from the requesting tenant using the public key of the requesting tenant;

generating, by the server system, a registry reply using the registry, the registry reply including metadata indicating whether the application of the requesting tenant is trusted; and

transmitting, by the server system, the registry reply to the computing system of the target tenant.

16. The method as recited in claim 15 , further comprising:

facilitating authentication of the tenant request received by the target tenant from the requesting tenant by applying the public key of the requesting tenant.

17. The method as recited in claim 15 , further comprising:

facilitating authentication of the tenant request received by the target tenant from the requesting tenant by transmitting the public key of the requesting tenant to the target tenant.

18. The method as recited in claim 15 , the set of permissions further indicating, for each of the applications that are trusted, data that is accessible from the target tenant.

19. The method as recited in claim 15 , further comprising:

storing, in the database, the public key of the target tenant responsive to receiving the public key of the target tenant from the target tenant.

20. The method as recited in claim 15 , the registry being external to and independent from each of the tenants and the database systems.

21. The system as recited in claim 1 , wherein performing a lookup in the registry to obtain a public key of the requesting tenant.

Assignments (2)
CHANGE OF NAME Recorded Aug 4, 2026
From: SALESFORCE.COM, INC.
To: SALESFORCE, INC.
Reel/Frame 076118/0548 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 1, 2018
From: BAHRENBURG, MATTHEW; VANGPAT, ALAN; JAIN, ANUPAM; MORTIMORE, WILLIAM CHARLES, JR; ANANTHAKRISHNAN, SRINATH KRISHNA; WISNOVSKY, PETER S.
To: SALESFORCE.COM, INC.
Reel/Frame 045961/0470 →
Continuity (1)
Related Publication 20190372766A1 · Dec 5, 2019
Cited By (1)
US 12,556,389