System, method, and computer program product for security verification of communications to tenants of an on-demand database service

• US 8,677,470 B1
• Filed: 01/22/2009
• Issued: 03/18/2014
• Est. Priority Date: 01/22/2008
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Cadden, Michael P., Stevens, Richard Alan, Kimble, Ron H., Mencke, Rasmus, Corson, Travis D., Shanabrook, Susan
• Primary Examiner(s): Patel, Nirav B
• Assistant Examiner(s): FIELDS, COURTNEY D
• Application Number:
  US12/357,999
• Time in Patent Office: 1,881 Days
• Field of Search: 726/11, 726/21, 726/26, 726/4, 709/206, 709/224, 709/225
• US Class Current: 726/11
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

In accordance with embodiments, there are provided mechanisms and methods for security verification of communications to tenants of an on-demand database service. These mechanisms and methods for security verification of communications to tenants of an on-demand database service can enable embodiments to allow tenants to selectively implement security measures with respect to inbound communications, etc. The ability of embodiments to provide such feature may allow tenants to efficiently and effectively implement security measures for in-bound emails.

Claims

1. A method, comprising:

receiving a communication destined to a first tenant of a plurality of tenants using at least one on-demand service;

applying a plurality of security processes to the communication to obtain a return code, the return code being associated with at least one of the plurality of security processes, where the return code includes a code indicative of a result of the at least one of the plurality of security processes, where the return code is based on a result of combining a plurality of codes returned by the plurality of security processes, and where the return code includes a summary of all codes returned by the plurality of security processes; and

determining, based at least in part on the return code, whether to process the communication.

2. The method of claim 1, wherein it is determined to process the communication when the return code indicates at least one pass.

3. The method of claim 1, wherein it is determined not to process the communication when the return code indicates at least one failure.

4. The method of claim 1, wherein the plurality of codes returned by the plurality of security processes are obtained, and it is determined to process the communication if at least one of the plurality of codes indicates a pass and none of the plurality of codes indicates a failure.

5. The method of claim 1, further comprising indicating a refusal to process the communication when the return code indicates a failure.

6. The method of claim 5, further comprising determining a security preference associated with the first tenant.

7. The method of claim 6, wherein determining the security preference associated with the first tenant is based at least in part on the communication.

8. The method of claim 1, wherein the determining is based at least in part on the result of the combining the plurality of codes.

9. The method of claim 1, wherein the return code indicates a pass when at least one of the plurality of security processes indicates a pass.

10. The method of claim 9, wherein the return code indicates the pass when none of the plurality of security processes indicates a failure.

11. The method of claim 1, wherein the return code indicates the pass when at least one of the plurality of security processes indicates a pass and none of the plurality of security processes indicates a failure.

12. The method of claim 1, wherein the plurality of security processes includes tests corresponding to at least one security protocol.

13. The method of claim 12, wherein the at least one security protocol includes at least one of a sender policy framework (SPF) security protocol, a Sender ID security protocol, a DomainKeys security protocol, and a DornainKeys Identified Mail (DKIM) security protocol.

14. The method of claim 1, wherein the communication includes an email.

15. The method of claim 14, further comprising verifying at least a portion of an email address of a sender of the email.

16. The method of claim 15, wherein the at least a portion of the email address of the sender is verified by comparing the at least a portion of the email address to information in a white list.

17. The method of claim 1, wherein the on-demand service includes a multi-tenant on-demand database service.

21. The method of claim 6, wherein the plurality of security processes are applied to the communication, based on the determined security preference.

22. The method of claim 7, wherein the determined security preference is implemented only with respect to predetermined senders of communications.

18. A non-transitory machine-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving a communication destined to a first tenant of a plurality of tenants using at least one on-demand service;

applying a plurality of security processes to the communication to obtain a return code, the return code being associated with at least one of the plurality of security processes, where the return code includes a code indicative of a result of the at least one of the plurality of security processes, where the return code is based on a result of combining a plurality of codes returned by the plurality of security processes, and where the return code includes a summary of all codes returned by the plurality of security processes; and

determining, based at least in part on the return code, whether to process the communication.

19. An apparatus, comprising:

a hardware processor; and

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

receiving a communication destined to a first tenant of a plurality of tenants using at least one on-demand service;

applying a plurality of security processes to the communication to obtain a return code, the return code being associated with at least one of the plurality of security processes, where the return code includes a code indicative of a result of the at least one of the plurality of security processes, where the return code is based on a result of combining a plurality of codes returned by the plurality of security processes, and where the return code includes a summary of all codes returned by the plurality of security processes; and

determining, based at least in part on the return code, whether to process the communication.

20. A method for transmitting code for use in a multi-tenant database system on a transmission medium, the method comprising:

transmitting code for receiving a communication destined to a first tenant of a plurality of tenants using at least one on-demand service;

transmitting code for applying a plurality of security processes to the communication to obtain a return code, the return code being associated with at least one of the plurality of security processes, where the return code includes a code indicative of a result of the at least one of the plurality of security processes, where the return code is based on a result of combining a plurality of codes returned by the plurality of security processes, and where the return code includes a summary of all codes returned by the plurality of security processes; and

transmitting code for determining, based at least in part on the return code, whether to process the communication.