FIREWALLS FOR SECURING CUSTOMER DATA IN A MULTI-TENANT ENVIRONMENT

• US 20120047570A1
• Filed: 11/01/2011
• Published: 02/23/2012
• Est. Priority Date: 12/02/2005
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Chan, Eric, Weissman, Craig, Nakada, Paul, Moellenhoff, Dave, McKinnon, Todd
• Granted Patent: US 8,620,876 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Network security is enhanced in a multi-tenant database network environment using a query plan detection module to continually poll the database system to locate and raise an alert for suspect query plans. Security also can be enhanced using a firewall system sitting between the application servers and the client systems that records user and organization information for each client request received, compares this with information included in a response from an application server, and verifies that the response is being sent to the appropriate user. Security also can be enhanced using a client-side firewall system with logic executing on the client system that verifies whether a response from an application server is being sent to the appropriate user system by comparing user and organization id information stored at the client with similar information in the response.

Claims

1. A multi-tenant database system, comprising:

a database system to store data for multiple tenants;

an application server communicably coupled to the database system and to a network, the application server providing network access to the database system for at least one client system; and

at least one firewall server communicably coupled between the application server and the at least one client system, the at least one firewall server operable to;

receive a client request;

extract user and organization information from the client request;

forward the client request to the application server; and

compare user and organization information included in a response message received from the application server with the user and organization information extracted from the client request.

2. The multi-tenant database system of claim 1, wherein the user and organization information is included in at least one of a session id (SID) cookie and a string data field, and wherein the client request and the response message each include at least one of the session id (SID) cookie and the string data field.

3. The multi-tenant database system of claim 1, wherein the firewall server strips a portion of the user and organization information from the body of a page included as part of the response message and forward the response message to the client system.

4. The multi-tenant database system of claim 1, wherein the firewall server raises an alert when the user and organization information in the response does not match the extracted user and organization information.

5. The multi-tenant database system of claim 1, wherein the firewall server generates and sends an error code in response to the client request when the user and organization information in the response does not match the extracted user and organization information.

6. The multi-tenant database system of claim 1, wherein the firewall server logs the client system out of the application server in response to the client request when the user and organization information in the response does not match the extracted user and organization information.

7. The multi-tenant database system of claim 1, wherein the firewall server records error information when the user and organization information in the response does not match the extracted user and organization information.

8. The multi-tenant database system of claim 1, wherein the firewall server uses a unique id of the user and organization information to track an identity of a user requesting a page.

9. The multi-tenant database system of claim 1, wherein the firewall server extracts the user and organization information included in the response message.

10. The multi-tenant database system of claim 1, wherein the firewall server extracts the user and organization information from an HTML header of the response message.

11. A method of providing a client-side firewall in a multi-tenant database system to store data for multiple tenants, the method comprising:

at the database system, responsive to a login request received from a first client system, responding to the first client system with a login response message that includes user and organization information and first validation logic, wherein the database system includes an application server communicably coupling the database system to a network, and wherein the application server provides network access to the database system for at least one client system;

at the first client system, executing the first validation logic to set the user and organization information;

at the database system, responsive to a subsequent request received from the first client system, responding to the first client system with a response message that includes user and organization information and second validation logic; and

at the first client system, executing the second validation logic to validate that the user and organization information received in the response message matches the user and organization information that was set at the first client system.

12. The method of claim 11, wherein the user and organization information is included in at least one of a session id (SID) cookie and a string data field, and wherein the login response and the response message each include at least one of the session id (SID) cookie and the string data field.

13. The method of claim 11, wherein if the user and organization information received in the response message does not match the user and organization information that was set at the first client system, the user is automatically logged out of the application server.

14. The method of claim 11, wherein if the user and organization information received in the response message does not match the user and organization information that was set at the first client system, the first client system sends an alert to a system administrator.

15. A method of providing a client-side firewall for a multi-tenant database system storing data for multiple tenants, wherein the database system includes an application server communicably coupling the database system to a network, and wherein the application server provides network access to the database system for at least one client system, the method comprising:

at a first client system, sending a first login request to the database system;

receiving, from the database system, a first login response message that includes user and organization information and first validation logic;

at the first client system, executing the first validation logic to set the user and organization information;

sending a second login request to the database system;

receiving, from the database system, a second login response message that includes user and organization information and second validation logic; and

at the first client system, executing the second validation logic to validate that the user and organization information received in the second login response message matches the user and organization information that was set by executing the first validation logic.