IP Library › Granted Patent US 11,218,461
Granted Patent B2
US 11,218,461 · App. 16/024,455 · Granted Jan 4, 2022

Authenticating computing system requests with an unknown destination across tenants of a multi-tenant system

Inventors: Matthew Bahrenburg (San Francisco, CA); Alan Vangpat (Pittsburgh, PA); Anupam Jain (Dublin, CA); Koson Thambundit (San Ramon, CA); Sanjay Thakkar (San Mateo, CA)
Assignee: salesforce.com, inc.
H04L63/0807G06F16/95H04L63/0442H04L63/0876H04L63/10H04L67/1097G06F21/6218
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,218,461
App. No.
16/024,455
Granted
Jan 4, 2022
Kind
B2
Abstract

Disclosed are some implementations of systems, apparatus, methods and computer program products for facilitating the authentication of computing system requests with an unknown destination across tenants of at least one multi-tenant database system. Authentication is facilitated using an intermediate system that is accessible by and independent from the tenants of the multi-tenant database system.

Claims (62)

1. A system comprising:

a database system implemented using a server system, the database system configurable to cause:

receiving a tenant request transmitted by a computing system of a first tenant of a plurality of tenants of a database system, the tenant request including an identifier of the first tenant, an identifier of a particular trust group to which the tenant request is addressed, and an indication of at least one of data or an application to which the first tenant requests access;

performing a lookup in a registry to obtain a public key of the first tenant, the registry including metadata corresponding to the plurality of tenants, the metadata of the registry indicating, for each of the tenants, a public key and trust group memberships;

facilitating, using the public key of the first tenant, authentication of the tenant request;

verifying, using the registry, that the first tenant is a member of the particular trust group;

verifying, using the registry, that the first tenant is authorized to access the data or application to which the first tenant requests access;

selecting a member of the particular trust group that can provide access to the data or application, the selected member of the particular trust group being a second tenant of the plurality of tenants; and

forwarding the tenant request to a computing system of the second tenant.

2. The system as recited in claim 1 , the database system further configurable to cause:

determining, from a type field of the tenant request, whether the tenant request is directed to a trust group.

3. The system as recited in claim 1 , the database system further configurable to cause:

processing a system request received from the second tenant, the system request pertaining to or including the tenant request; and

facilitating authentication of the tenant request by transmitting the public key of the first tenant to the second tenant.

4. The system as recited in claim 1 , the database system further configurable to cause:

processing a system request received from the second tenant, the system request including the tenant request; and

facilitating authentication of the tenant request by authenticating the tenant request using the public key of the first tenant.

5. The system as recited in claim 1 , the database system further configurable to cause:

processing a system request received from the second tenant, the system request including a registry request identifying the first tenant and indicating a request for authentication of the tenant request; and

authenticating the registry request using a public key of the second tenant obtained from the registry.

6. The system as recited in claim 5 , wherein the database system further configurable to cause:

performing at least one of facilitating authentication of the tenant request, verifying that the first tenant is a member of the particular trust group, or verifying that the first tenant is authorized to access the data or application responsive to processing the system request.

7. A computer program product comprising computer-readable program code capable of being executed by one or more processors when retrieved from a non-transitory computer-readable medium, the program code comprising computer-readable instructions configurable to cause:

receiving a tenant request transmitted by a computing system of a first tenant of a plurality of tenants of a database system, the tenant request including an identifier of the first tenant, an identifier of a particular trust group to which the tenant request is addressed, and an indication of at least one of data or an application to which the first tenant requests access;

performing a lookup in a registry to obtain a public key of the first tenant, the registry including metadata corresponding to the plurality of tenants, the metadata of the registry indicating, for each of the tenants, a public key and trust group memberships;

facilitating, using the public key of the first tenant, authentication of the tenant request;

verifying, using the registry, that the first tenant is a member of the particular trust group;

verifying, using the registry, that the first tenant is authorized to access the data or application to which the first tenant requests access;

selecting a member of the particular trust group that can provide access to the data or application, the selected member of the particular trust group being a second tenant of the plurality of tenants; and

forwarding the tenant request to a computing system of the second tenant.

8. The computer program product as recited in claim 7 , the program code comprising instructions further configured to cause:

determining, from a type field of the tenant request, whether the tenant request is directed to a trust group.

9. The computer program product as recited in claim 7 , the program code comprising instructions further configured to cause:

processing a system request received from the second tenant, the system request pertaining to or including the tenant request; and

facilitating authentication of the tenant request by transmitting the public key of the first tenant to the second tenant.

10. The computer program product as recited in claim 7 , the program code comprising instructions further configured to cause:

processing a system request received from the second tenant, the system request including the tenant request; and

facilitating authentication of the tenant request by authenticating the tenant request using the public key of the first tenant.

11. The computer program product as recited in claim 7 , the program code comprising instructions further configured to cause:

processing a system request received from the second tenant, the system request including a registry request identifying the first tenant and indicating a request for authentication of the tenant request; and

authenticating the registry request using a public key of the second tenant obtained from the registry.

12. The computer program product as recited in claim 7 , the program code comprising instructions further configured to cause:

performing at least one of facilitating authentication of the tenant request, verifying that the first tenant is a member of the particular trust group, or verifying that the first tenant is authorized to access the data or application responsive to processing the system request.

13. A method, comprising:

receiving a tenant request transmitted by a computing system of a first tenant of a plurality of tenants of a database system, the tenant request including an identifier of the first tenant, an identifier of a particular trust group to which the tenant request is addressed, and an indication of at least one of data or an application to which the first tenant requests access;

performing a lookup in a registry to obtain a public key of the first tenant, the registry including metadata corresponding to the plurality of tenants, the metadata of the registry indicating, for each of the tenants, a public key and trust group memberships;

facilitating, using the public key of the first tenant, authentication of the tenant request;

verifying, using the registry, that the first tenant is a member of the particular trust group;

verifying, using the registry, that the first tenant is authorized to access the data or application to which the first tenant requests access;

selecting a member of the particular trust group that can provide access to the data or application, the selected member of the particular trust group being a second tenant of the plurality of tenants; and

forwarding the tenant request to a computing system of the second tenant.

14. The method as recited in claim 13 , the method further comprising:

determining, from a type field of the tenant request, whether the tenant request is directed to a trust group.

15. The method as recited in claim 13 , the method further comprising:

processing a system request received from the second tenant, the system request pertaining to or including the tenant request; and

facilitating authentication of the tenant request by transmitting the public key of the first tenant to the second tenant from which the system request was received.

16. The method as recited in claim 13 , further comprising:

processing a system request received from the second tenant, the system request including the tenant request; and:

authenticating the tenant request using the public key of the first tenant.

17. The method as recited in claim 13 , the method further comprising:

processing a system request received from the second tenant, the system request including a registry request received from the second tenant, the registry request identifying the first tenant and indicating a request for authentication of the tenant request; and

authenticating the registry request using a public key of the second tenant obtained from the registry.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 10, 2019
From: BAHRENBURG, MATTHEW; VANGPAT, ALAN; JAIN, ANUPAM; THAMBUNDIT, KOSON; THAKKAR, SANJAY
To: SALESFORCE.COM, INC.
Reel/Frame 050684/0516 →
Continuity (1)
Related Publication 20200007529A1 · Jan 2, 2020
Cited By (1)
US 12,556,389