Customized user validation

• US 10,021,089 B2
• Filed: 04/09/2015
• Issued: 07/10/2018
• Est. Priority Date: 04/09/2015
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Mortimore, Jr., William Charles, Koren, Sergio Isaac, Mason, Paul Anthony, Vangpat, Alan
• Primary Examiner(s): Su, Sarah
• Application Number:
  US14/682,324
• Publication Number:
  US 20160301679A1
• Time in Patent Office: 1,188 Days
• Field of Search: 726 2, 726 4, 726 5, 726 7, 726 26, 726 27, 726 28
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Mechanisms and techniques for customized user validation. A login attempt is received from a remote electronic device with one or more computing devices that provide access to one or more resources. The login attempt is analyzed to determine a profile from a plurality of profiles corresponding to the login attempt. The one or more computing devices support the plurality profiles with each profile having a corresponding flow. The flow corresponding to the profile is performed prior to allowing continuation of the login attempt. The login attempt is continued, via the one or more computing devices, after the flow corresponding to the profile is completed. Access is granted to the one or more resources, via the one or more computing devices, in response to a successful completion of the login attempt.

Claims

1. A method comprising:

receiving a login attempt with one or more computing devices that provide access to one or more resources, the login attempt from a remote electronic device;

initiating a generic user validation flow in response to receiving the login attempt;

analyzing the login attempt, as part of the generic user validation flow, to determine a login profile corresponding to the login attempt from a plurality of login profiles, wherein each login profile has a corresponding specific login flow and authentication process, each login profile having one or more corresponding users and every user with a selected profile is redirected through the corresponding specific login flow for the selected profile during the login attempt;

causing the specific login flow corresponding to the login profile to be performed prior to allowing continuation of the generic user validation flow;

allowing continuation of the generic user validation flow, via the one or more computing devices, after the specific login flow corresponding to the login profile is completed; and

granting access to the one or more resources, via the one or more computing devices, in response to a successful completion of the specific login flow and the generic user validation flow.

2. The method of claim 1 wherein granting access to the one or more resources in response to a successful completion of the login attempt comprises granting access at a level determined as a result of the specific login flow corresponding to the login profile.

3. The method of claim 1 wherein the specific login flow corresponding to the login profile comprises a time-based one-time password (TOTP) flow.

4. The method of claim 1 wherein the specific login flow corresponding to the login profile comprise a two-factor authentication flow.

5. The method of claim 1 wherein the specific login flow corresponding to the login profile requests user-specific information from a user via a graphical user interface on the remote electronic device.

6. The method of claim 1 wherein the specific login flow corresponding to the login profile gathers device-specific information from the remote electronic device.

7. The method of claim 1 wherein the one or more resources comprise at least an on-demand services environment having at least one database.

8. The method of claim 7 wherein the on-demand services environment comprises at least a multitenant database environment.

9. A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to:

receive a login attempt with one or more computing devices that provide access to one or more resources, the login attempt from a remote electronic device;

initiate a generic user validation flow in response to receiving the login attempt;

analyze the login attempt, as part of the generic user validation flow, to determine a login profile corresponding to the login attempt from a plurality of login profiles, wherein each login profile has a corresponding specific login flow and authentication process, each login profile having one or more corresponding users and every user with a selected profile is redirected through the corresponding specific login flow for the selected profile during the login attempt;

cause the specific login flow corresponding to the login profile to be performed prior to allowing continuation of the generic user validation flow;

allow continuation of the generic user validation flow, via the one or more computing devices, after the specific login flow corresponding to the login profile is completed; and

grant access to the one or more resources, via the one or more computing devices, in response to a successful completion of the specific login flow and the generic user validation flow.

10. The non-transitory computer-readable medium of claim 9 wherein granting access to the one or more resources in response to a successful completion of the login attempt comprises granting access at a level determined as a result of the specific login flow corresponding to the login profile.

11. The non-transitory computer-readable medium of claim 9 wherein the specific login flow corresponding to the login profile comprises a time-based one-time password (TOTP) flow.

12. The non-transitory computer-readable medium of claim 9 wherein the specific login flow corresponding to the login profile comprise a two-factor authentication flow.

13. The non-transitory computer-readable medium of claim 9 wherein the specific login flow corresponding to the login profile requests user-specific information from a user via a graphical user interface on the remote electronic device.

14. The non-transitory computer-readable medium of claim 9 wherein the specific login flow corresponding to the login profile gathers device-specific information from the remote electronic device.

15. The non-transitory computer-readable medium of claim 9 wherein the one or more resources comprise at least an on-demand services environment having at least one database.

16. The non-transitory computer-readable medium of claim 15 wherein the on-demand services environment comprises at least a multitenant database environment.

17. A system of electronic computing devices to provide one or more resources, the system of electronic computing devices to:

receive a login attempt from a remote electronic device;

initiate a generic user validation flow in response to receiving the login attempt;

analyze the login attempt, as part of the generic user validation flow, to determine a login profile corresponding to the login attempt from a plurality of login profiles, wherein each login profile has a corresponding specific login flow and authentication process, each login profile having one or more corresponding users and every user with a selected profile is redirected through the corresponding specific login flow for the selected profile during the login attempt;

cause the specific login flow corresponding to the login profile to be performed prior to allowing continuation of the generic user validation flow;

allow continuation of the generic user validation flow, via the one or more computing devices, after the specific login flow corresponding to the login profile is completed; and

grant access to the one or more resources, via the one or more computing devices, in response to a successful completion of the specific login flow and the generic user validation flow.

18. The system of claim 17 wherein granting access to the one or more resources in response to a successful completion of the login attempt comprises granting access at a level determined as a result of the specific login flow corresponding to the login profile.

19. The system of claim 17 wherein the specific login flow corresponding to the login profile comprises a time-based one-time password (TOTP) flow.

20. The system of claim 17 wherein the specific login flow corresponding to the login profile comprise a two-factor authentication flow.

21. The system of claim 17 wherein the specific login flow corresponding to the login profile requests user-specific information from a user via a graphical user interface on the remote electronic device.

22. The system of claim 17 wherein the specific login flow corresponding to the login profile gathers device-specific information from the remote electronic device.

23. The system of claim 17 wherein the one or more resources comprise at least an on-demand services environment having at least one database.

24. The system of claim 23 wherein the on-demand services environment comprises at least a multitenant database environment.