On-demand database service system, method and computer program product for conditionally allowing an application of an entity access to data of another entity

• US 9,268,963 B2
• Filed: 01/23/2015
• Issued: 02/23/2016
• Est. Priority Date: 07/19/2007
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Viripaeff, Alexis, Mehra, Vinod, Warshavsky, Alex, Horne, Nate, Dapkus, Peter J.
• Primary Examiner(s): Perveen, Rehana
• Assistant Examiner(s): BUI, THUY T
• Application Number:
  US14/604,604
• Publication Number:
  US 20150134701A1
• Time in Patent Office: 396 Days
• Field of Search: 707/781, 707/783, 707/78, 707/784, 707/785, 726/27, 726/28, 726/29, 726/30
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24573 using data annotations, e.g. user-defined metadata
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

In accordance with embodiments, there are provided mechanisms and methods for conditionally allowing an application of an entity access to data of another entity in an on-demand database service. These mechanisms and methods for conditionally allowing an application of an entity access to data of another entity in an on-demand database service can enable embodiments to limit such access to the data, as desired. Furthermore, embodiments of such mechanisms and methods may provide additional security when sharing data among different subscribers to an on-demand database service.

Claims

1. A computer program product embodied on a non-transitory computer readable medium, the computer program product including computer code adapted to be executed by a computer to implement a method comprising:

receiving, by a system, a package created by a first entity of the system, the package including an application and the package specifying permissions required by the application;

storing, by the system, the package;

making the stored package available to one or more users of the system, by the system;

receiving, by the system from one of the users, a request to install the application;

determining, by the system, whether the user is authorized to install the application;

when the system determines that the user is not authorized to install the application, disallowing the user from installing the application, by the system;

when the system determines that the user is authorized to install the application;

determining, from the stored package by the system, the permissions required by the application,

presenting, through the system, the determined permissions to the user, after presenting the determined permissions to the user, determining, by the system, whether the user grants the permissions required by the application, wherein the presenting, through the system, the determined permissions to the user, and the determining, by the system, whether the user grants the permissions required by the application, are performed during the installing of the application,

when the system determines that the user does not grant the permissions required by the application, disallowing the user from completing the installing of the application, by the system, and

when the system determines that the user grants the permissions required by the application, allowing the user to complete the installing of the application, by the system;

after the user installs the application, receiving, by the system from the first entity, an indication that the permissions required by the application have changed; and

in response to receiving the indication that the permissions required by the application have changed, notifying the user of the change to the permissions required by the application.

2. The computer program product of claim 1, wherein when the user grants the permissions required by the application, the permissions are stored in a security profile of the user.

3. The computer program product of claim 1, wherein the permissions required by the application include access to data.

4. The computer program product of claim 3, wherein the data is of the user.

5. The computer program product of claim 3, wherein the data is stored by the system.

6. The computer program product of claim 1, wherein the determined permissions are presented to the user in a user interface.

7. The computer program product of claim 1, wherein the user grants the permissions required by the application to accept installation of the application.

8. The computer program product of claim 1, further comprising authenticating the application, by the system, prior to allowing the user to initiate installation of the application.

9. The computer program product of claim 1, wherein the permissions required by the application include write access by the application to metadata.

10. The computer program product of claim 1, wherein the permissions required by the application indicate a level of data required to be accessed by the application.

11. A method comprising:

receiving, by a system, a package created by a first entity of the system, the package including an application and the package specifying permissions required by the application;

storing, by the system, the package;

making the stored package available to one or more users of the system, by the system;

receiving, by the system from one of the users, a request to install the application;

determining, by the system, whether the user is authorized to install the application;

when the system determines that the user is not authorized to install the application, disallowing the user from installing the application, by the system;

when the system determines that the user is authorized to install the application;

determining, from the stored package by the system, the permissions required by the application,

presenting, through the system, the determined permissions to the user, after presenting the determined permissions to the user, determining, by the system, whether the user grants the permissions required by the application, wherein the presenting, through the system, the determined permissions to the user, and the determining, by the system, whether the user grants the permissions required by the application, are performed during the installing of the application,

when the system determines that the user does not grant the permissions required by the application, disallowing the user from completing the installing of the application, by the system, and

when the system determines that the user grants the permissions required by the application, allowing the user to complete the installing of the application, by the system;

after the user installs the application, receiving, by the system from the first entity, an indication that the permissions required by the application have changed; and

in response to receiving the indication that the permissions required by the application have changed, notifying the user of the change to the permissions required by the application.

12. A system, comprising:

a processor; and

memory storing instructions adapted to be executed by the processor to perform a method comprising;

receiving, by the system, a package created by a first entity of the system, the package including an application and the package specifying permissions required by the application;

storing, by the system, the package;

making the stored package available to one or more users of the system, by the system;

receiving, by the system from one of the users, a request to install the application;

determining, by the system, whether the user is authorized to install the application;

when the system determines that the user is not authorized to install the application, disallowing the user from installing the application, by the system;

when the system determines that the user is authorized to install the application;

determining, from the stored package by the system, the permissions required by the application,

presenting, through the system, the determined permissions to the user, wherein the presenting, through the system, the determined permissions to the user, and the determining, by the system, whether the user grants the permissions required by the application, are performed during the installing of the application,

when the system determines that the user does not grant the permissions required by the application, disallowing the user from completing the installing of the application, by the system, and

when the system determines that the user grants the permissions required by the application, allowing the user to complete the installing of the application, by the system;

after the user installs the application, receiving, by the system from the first entity, an indication that the permissions required by the application have changed; and

in response to receiving the indication that the permissions required by the application have changed, notifying the user of the change to the permissions required by the application.