Methods and systems for providing a token-based application firewall correlation

• US 9,350,705 B2
• Filed: 12/30/2010
• Issued: 05/24/2016
• Est. Priority Date: 06/25/2010
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Gluck, Yoel
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Le, Canh
• Application Number:
  US12/982,751
• Publication Number:
  US 20110321148A1
• Time in Patent Office: 1,972 Days
• Field of Search: 726/9
• US Class Current: 1/1
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Token-based firewall functionality. A request is received for access to a resource from a remote user device, the request received by an application firewall. A token is associated with the request. The token and associated information are stored in an event correlator coupled with the application firewall. The token is associated with one or more subsequent actions by the resource in response to receiving the request. A response to the request including the token is generated. The response with the token is transmitted to the remote user device via the application firewall. The application firewall analyzes the response and determines an action to be taken on the response based on the token and the associated information.

Claims

1. A method comprising:

receiving a request for access to a resource within a secure computing environment from a remote user device, the request received by an application-level firewall;

associating a token with the request, by the application-level firewall, wherein the token is added to a session context and the token is injected into multiple events that originate from the request to service the request within the secure computing environment during the session to allow the application-level firewall to correlate the request with a corresponding session;

storing, by the application-level firewall, the token and associated information in an event correlator within the secure computing environment that is communicatively coupled with the application-level firewall;

associating, by the application-level firewall, the token with one or more subsequent actions within the secure computing environment during the session by the resource to service the request, wherein the one or more subsequent actions comprises at least generating a database query based on the request, the database query including the token and the token is included in a logic of the database query;

creating, by the application-level firewall, at least one statistical model to identify abnormalities and react based on security policies;

generating a response to the request, the response including the token; and

transmitting the response with the token to the remote user device via the application-level firewall, wherein the application-level firewall analyzes the response and determines an action to be taken on the response based on the token and the associated information.

2. The method of claim 1 wherein the resource is part of a multitenant environment.

3. The method of claim 2 wherein the multitenant environment comprises a multitenant database environment, wherein the multitenant database environment stores data for multiple client entities each identified by a tenant identifier (ID) having one or more users associated with the tenant ID, wherein users of each of multiple client entities can only access data identified by a tenant ID associated with the respective client entity, and wherein the multitenant database is a hosted database provided by an entity separate from the client entities, and provides on-demand database service to the client entities.

4. The method of claim 1 wherein associating a token with the request comprises the application-level firewall inserting the token in at least a header of the request.

5. The method of claim 1 wherein associating a token with the request comprises the application-level firewall modifying logic of the request to include the token.

6. The method of claim 1 wherein the one or more subsequent actions comprises at least generating a file event based on the request, the file event including the token.

7. The method of claim 1 wherein the one or more subsequent actions comprises at least generating a network request based on the request, the network request including the token.

8. An article comprising a non-transitory computer-readable storage medium having stored thereon instructions that are configurable to, when executed by one or more processors, cause the one or more processors to:

receive a request for access to a resource within a secure computing environment from a remote user device, the request received by an application-level firewall;

associate a token with the request, by the application-level firewall, wherein the token is added to a session context and the token is injected into multiple events that originate from the request to service the request within the secure computing environment during the session to allow the application-level firewall to correlate the request with a corresponding session;

store the token and associated information in an event correlator within the secure computing environment that is communicatively coupled with the application-level firewall;

associate the token with one or more subsequent actions within the secure computing environment during the session by the resource to service the request, wherein the one or more subsequent actions comprises at least generating a database query based on the request, the database query including the token and the token is included in a logic of the database query;

create at least one statistical model to identify abnormalities and react based on security policies;

generate a response to the request, the response including the token; and

transmit a response including the token to the remote user device via the application-level firewall, wherein the application-level firewall analyzes the response and determines an action to be taken on the response based on the token and the associated information.

9. The article of claim 8 wherein the resource is part of a multitenant environment.

10. The article of claim 9 wherein the multitenant environment comprises a multitenant database environment, wherein the multitenant database environment stores data for multiple client entities each identified by a tenant identifier (ID) having one or more users associated with the tenant ID, wherein users of each of multiple client entities can only access data identified by a tenant ID associated with the respective client entity, and wherein the multitenant database is a hosted database provided by an entity separate from the client entities, and provides on-demand database service to the client entities.

11. The article of claim 8 wherein the instructions that cause the one or more processors to associate a token with the request comprise instructions that, when executed, cause the one or more processors to insert the token in at least a header of the request.

12. The article of claim 8 wherein the instructions that cause the one or more processors to associate a token with the request comprise instructions that, when executed, cause the one or more processor to modify logic of the request to include the token.

13. The article of claim 8 wherein the one or more subsequent actions comprises at least generating a file event based on the request, the file event including the token.

14. The method of claim 8 wherein the one or more subsequent actions comprises at least generating a network request based on the request, the network request including the token.

15. A system comprising:

a plurality of hardware server computing platforms coupled over a network to communicate with multiple user computing systems to provide a multitenant environment comprising at least an application-level firewall and an application running on at least one of the hardware server computing platforms, both coupled to receive traffic from the multiple user computing systems, the application-level firewall and the application configurable to;

receive a request for access to a resource within a secure computing environment from a remote user device, the request received by an application-level firewall;

associate a token with the request, by the application-level firewall, wherein the token is added to a session context and the token is injected into multiple events that originate from the request to service the request within the secure computing environment during the session to allow the application-level firewall to correlate the request with a corresponding session;

store the token and associated information in an event correlator within the secure computing environment that is communicatively coupled with the application-level firewall;

associate the token with one or more subsequent actions within the secure computing environment during the session by the resource to service the request, wherein the one or more subsequent actions comprises at least generating a database query based on the request, the database query including the token and the token is included in a logic of the database query;

create at least one statistical model to identify abnormalities and react based on security policies;

generate a response to the request, the response including the token; and

transmit a response including the token to the remote user device via the application-level firewall, wherein the application-level firewall analyzes the response and determines an action to be taken on the response based on the token and the associated information.

16. The system of claim 15 wherein associating a token with the request comprises the application-level firewall inserting the token in at least a header of the request.

17. The system of claim 15 wherein associating a token with the request comprises the firewall modifying logic of the request to include the token.

18. The system of claim 15 wherein the one or more subsequent actions comprises at least generating a file event based on the request, the file event including the token.

19. The system of claim 15 wherein the one or more subsequent actions comprises at least generating a network request based on the request, the network request including the token.