Granted Patent B2

US 12,621,289 · App. 18/426,119 · Granted May 5, 2026

Inventor: Prasad Peddada (Alameda, CA)

Assignee: Salesforce, Inc.

H04L63/083H04L9/0825H04L9/3226H04L63/0442

Abstract

Claims (69)

1 . A method for data processing, comprising:

transmitting, to a key protection component of a server host, a message including a user-configured password and a wrapped symmetric key, wherein the user-configured password is related to an account associated with a tenant of a multi-tenant cloud platform;

receiving, from the key protection component and in response to the message, an encrypted payload and an initialization vector associated with the encrypted payload, wherein the encrypted payload comprises a hash value of the user-configured password for the account and an indicator of a hashing algorithm used for generation of the hash value, and wherein the encrypted payload and the initialization vector are stored in a database in association with the account, wherein the database is associated with the multi-tenant cloud platform;

receiving, at the server host, a login request that includes a clear text password for the account associated with a tenant of a multi-tenant cloud platform;

retrieving, from the database associated with the multi-tenant cloud platform, the encrypted payload stored in association with the account, the encrypted payload comprising a hash value of a user-configured password for the account and an indicator of a hashing algorithm used for generation of the hash value;

obtaining the wrapped symmetric key provisioned by a symmetric key distribution service, wherein the symmetric key is wrapped using an asymmetric public key associated with the server host;

transmitting an application programming interface (API) request comprising the encrypted payload retrieved from the database, the clear text password extracted from the login request, and the wrapped symmetric key provisioned by the symmetric key distribution service; and

receiving an API response that indicates whether a hash value of the clear text password from the login request corresponds to the hash value of the user-configured password for the account.

2 . The method of claim 1 , wherein the message is configured to cause the key protection component to:

unwrap the symmetric key using an asymmetric private key corresponding to the asymmetric public key of the server host;

transform the user-configured password into the hash value using the hashing algorithm;

generate the payload comprising the hash value and the indication of the hashing algorithm;

encrypt the payload using the unwrapped symmetric key and the initialization vector;

and return the encrypted payload to the server host along with the initialization vector.

3 . The method of claim 1 , further comprising:

storing, within the database, the encrypted payload and the initialization vector in association with the account;

retrieving the encrypted payload and the initialization vector from the database in response to the login request; and

including the encrypted payload and the initialization vector in the API request.

4 . The method of claim 1 , wherein the hashing algorithm used to transform the user-configured password into the hash value is selected by the key protection component.

5 . The method of claim 1 , wherein the wrapped symmetric key is provisioned by the symmetric key distribution service that comprises at least one of a hardware security module (HSM), or a master host, or a quorum-based key sharing service.

6 . The method of claim 1 , wherein the API request is configured to cause the key protection component of the server host to:

unwrap the symmetric key using an asymmetric private key corresponding to the asymmetric public key of the server host;

decrypt the payload using the unwrapped symmetric key and the initialization vector associated with the payload;

generate a hash value of the clear text password from the login request using the hashing algorithm indicated by the decrypted payload; and

compare the hash value of the clear text password to the hash value of the user-configured password indicated by the decrypted payload.

7 . The method of claim 1 , wherein obtaining the wrapped symmetric key comprises:

transmitting, to the symmetric key distribution service associated with the multi-tenant cloud platform, a first message indicating the asymmetric public key of the server host and the symmetric key that is wrapped using an intermediate key provisioned by the symmetric key distribution service, wherein the asymmetric public key of the server host is included in a certificate of the server host; and

receiving, from the symmetric key distribution service, a second message indicating the symmetric key that is wrapped using the asymmetric public key associated with the server host.

8 . The method of claim 7 , wherein the first message is configured to cause the symmetric key distribution service to:

unwrap the symmetric key using the intermediate key provisioned by the symmetric key distribution service;

rewrap the symmetric key using the asymmetric public key of the server host; and

return the rewrapped symmetric key to the server host via the second message.

9 . The method of claim 7 , further comprising:

storing, within the database, the symmetric key that is wrapped using the intermediate key provisioned by the symmetric key distribution service.

10 . The method of claim 1 , wherein obtaining the symmetric key comprises:

retrieving, from the database, the symmetric key that is wrapped using the asymmetric public key associated with the server host, wherein the database comprises two or more instances of the symmetric key that are wrapped using respective asymmetric public keys associated with other server hosts in a sub-system of the multi-tenant cloud platform that includes the server host and the database.

11 . The method of claim 1 , wherein the user-configured password is locally hashed and encrypted by the key protection component of the server host.

12 . The method of claim 1 , wherein the hashing algorithm comprises a 256-bit secure hashing algorithm (SHA-256), a 384-bit secure hashing algorithm (SHA-384), a 512-bit secure hashing algorithm (SHA-512), or a Keccak algorithm.

13 . The method of claim 1 , wherein the API response comprises a Boolean to indicate whether a hash value of the clear text password from the login request corresponds to the hash value of the user-configured password for the account.

14 . The method of claim 1 , wherein the symmetric key is provisioned for a sub-system of the multi-tenant cloud platform that includes the server host and the database.

15 . An apparatus for data processing, comprising:

at least one processor;

at least one memory coupled with the at least one processor; and

instructions stored in the at least one memory and executable by the at least one processor to cause the apparatus to:

transmit, to a key protection component of a server host, a message including a user-configured password and a wrapped symmetric key, wherein the user-configured password is related to an account associated with a tenant of a multi-tenant cloud platform;

receive, from the key protection component and in response to the message, an encrypted payload and an initialization vector associated with the encrypted payload, wherein the encrypted payload comprises a hash value of the user-configured password for the account and an indicator of a hashing algorithm used for generation of the hash value, and wherein the encrypted payload and the initialization vector are stored in a database in association with the account, wherein the database is associated with the multi-tenant cloud platform;

receive, at the server host, a login request that includes a clear text password for the account associated with a tenant of a multi-tenant cloud platform;

retrieve, from the database associated with the multi-tenant cloud platform, the encrypted payload stored in association with the account, the encrypted payload comprising a hash value of a user-configured password for the account and an indicator of a hashing algorithm used for generation of the hash value;

obtain the wrapped symmetric key provisioned by a symmetric key distribution service, wherein the symmetric key is wrapped using an asymmetric public key associated with the server host;

transmit an application programming interface (API) request that includes the encrypted payload retrieved from the database, the clear text password extracted from the login request, and the wrapped symmetric key provisioned by the symmetric key distribution service; and

receive an API response that indicates whether a hash value of the clear text password from the login request corresponds to the hash value of the user-configured password for the account.

16 . The apparatus of claim 15 , wherein the message is configured to cause the key protection component to:

unwrap the symmetric key using an asymmetric private key corresponding to the asymmetric public key of the server host;

transform the user-configured password into the hash value using the hashing algorithm;

generate the payload comprising the hash value and the indication of the hashing algorithm;

encrypt the payload using the unwrapped symmetric key and the initialization vector; and

return the encrypted payload to the server host along with the initialization vector.

17 . The apparatus of claim 15 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:

store, within the database, the encrypted payload and the initialization vector in association with the account;

retrieve the encrypted payload and the initialization vector from the database in response to the login request; and

include the encrypted payload and the initialization vector in the API request.

18 . A non-transitory computer-readable medium storing code for data processing, the code comprising instructions executable by at least one processor to:

transmit, to a key protection component of a server host, a message including a user-configured password and a wrapped symmetric key, wherein the user-configured password is related to an account associated with a tenant of a multi-tenant cloud platform;

receive, from the key protection component and in response to the message, an encrypted payload and an initialization vector associated with the encrypted payload, wherein the encrypted payload comprises a hash value of the user-configured password for the account and an indicator of a hashing algorithm used for generation of the hash value, and wherein the encrypted payload and the initialization vector are stored in a database in association with the account, wherein the database is associated with the multi-tenant cloud platform;

receive, at the server host, a login request that includes a clear text password for the account associated with a tenant of a multi-tenant cloud platform;

retrieve, from the database associated with the multi-tenant cloud platform, the encrypted payload stored in association with the account, the encrypted payload comprising a hash value of a user-configured password for the account and an indicator of a hashing algorithm used for generation of the hash value;

obtain the wrapped symmetric key provisioned by a symmetric key distribution service, wherein the symmetric key is wrapped using an asymmetric public key associated with the server host;

transmit an application programming interface (API) request that includes the encrypted payload retrieved from the database, the clear text password extracted from the login request, and the wrapped symmetric key provisioned by the symmetric key distribution service; and

receive an API response that indicates whether a hash value of the clear text password from the login request corresponds to the hash value of the user-configured password for the account.

Assignments (3)

Continuity (3)

References Cited (30)