Firewalls for securing customer data in a multi-tenant environment

• US 8,620,876 B2
• Filed: 11/01/2011
• Issued: 12/31/2013
• Est. Priority Date: 12/02/2005
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Chan, Eric, Weissman, Craig, Nakada, Paul, Moellenhoff, Dave, McKinnon, Todd
• Primary Examiner(s): OBISESAN, AUGUSTINE KUNLE
• Application Number:
  US13/286,461
• Publication Number:
  US 20120047570A1
• Time in Patent Office: 791 Days
• Field of Search: None
• US Class Current: 707/691
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Network security is enhanced in a multi-tenant database network environment using a query plan detection module to continually poll the database system to locate and raise an alert for suspect query plans. Security also can be enhanced using a firewall system sitting between the application servers and the client systems that records user and organization information for each client request received, compares this with information included in a response from an application server, and verifies that the response is being sent to the appropriate user. Security also can be enhanced using a client-side firewall system with logic executing on the client system that verifies whether a response from an application server is being sent to the appropriate user system by comparing user and organization id information stored at the client with similar information in the response.

Claims

1. A multi-tenant database system, comprising:

a database system to store data for multiple tenants, wherein each of the tenants represents an organization having a respective organization identifier (ID);

an application server communicably coupled to the database system and to a network, the application server providing network access to the database system for a client system via the network; and

a firewall server communicably coupled between the application server and the client system, the firewall server operable to;

receive a client request for a page from the client system, the client request being associated with a user of the client system, the client request including a user ID corresponding to the user, an organization ID corresponding to one of the tenants, and a client IP address corresponding to the client system;

extract the user ID and the organization ID from the client request;

record the extracted user ID and the extracted organization ID;

forward the client request to the application server;

receive a response message from the application server, the response message including the page and a received user ID and a received organization ID added by the application server when responding to the client request;

compare the received user ID and the received organization ID included in the response message received from the application server with the recorded user ID and the recorded organization ID extracted from the client request, to determine whether the received user ID matches the recorded user ID and whether the received organization ID matches the recorded organization ID; and

when the received user ID matches the recorded user ID and the received organization ID matches the recorded organization ID;

remove the received user ID and the received organization ID from the response message; and

forward the response message to the client system.

2. The multi-tenant database system of claim 1, wherein the user ID and the organization ID is included in at least one of a session id (SID) cookie and a string data field, and wherein the client request and the response message each include at least one of the session id (SID) cookie and the string data field.

3. The multi-tenant database system of claim 1, wherein the firewall server strips the user ID and the organization ID from the body of the page included as part of the response message.

4. The multi-tenant database system of claim 1, wherein the firewall server raises an alert when the received user ID and the received organization ID in the response message does not match the extracted user ID and the extracted organization ID.

5. The multi-tenant database system of claim 1, wherein the firewall server generates and sends an error code in response to the client request when the user ID and the organization ID in the response message does not match the extracted user ID and the extracted organization ID.

6. The multi-tenant database system of claim 1, wherein the firewall server logs the client system out of the application server in response to the client request when the received user ID and the received organization ID in the response message does not match the extracted user ID and the extracted organization ID.

7. The multi-tenant database system of claim 1, wherein the firewall server records error information when the received user ID and the received organization ID in the response message does not match the extracted user ID and the extracted organization ID.

8. The multi-tenant database system of claim 1, wherein the firewall server uses a unique id of the user ID and the organization ID to track an identity of the user requesting the page.

9. The multi-tenant database system of claim 1, wherein the firewall server extracts the received user ID and the received organization ID from an HTML header of the response message.