Managing access to an on-demand service

• US 9,667,622 B2
• Filed: 06/30/2015
• Issued: 05/30/2017
• Est. Priority Date: 11/15/2007
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Junod, Forrest A., Fly, Robert C., Dapkus, Peter, Yancey, Scott W., Lawrance, Steven S., Fell, Simon Z.
• Primary Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US14/788,309
• Publication Number:
  US 20150304305A1
• Time in Patent Office: 700 Days
• Field of Search: 726 5, 726 9, 726 1, 455411
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/01 Protocols

Abstract

In accordance with embodiments, there are provided mechanisms and methods for managing a risk of access to an on-demand service as a condition of permitting access to the on-demand service. These mechanisms and methods for providing such management can enable embodiments to help prohibit an unauthorized user from accessing an account of an authorized user when the authorized user inadvertently loses login information. The ability of embodiments to provide such management may lead to an improved security feature for accessing on-demand services.

Claims

1. A method comprising:

receiving, from a client device, a first request including authentication information for a user and information identifying the client device, the information identifying the client device including an IP address;

validating the authentication information of the user, the authentication information associated with a user account;

responsive to validating the authentication information of the user, determining whether the IP address is associated with a location associated with the user account; and

responsive to determining that the IP address is not associated with the location associated with the user account;

sending a token to a channel associated with the user account,

receiving, from the client device, a second request including the token sent to the channel associated with the user account, and

responsive to receiving the second request including the token from the client device, authenticating the user.

2. The method of claim 1, wherein the token is a password.

3. The method of claim 1, wherein the token is a PIN.

4. The method of claim 1, wherein the token is a one time password.

5. The method of claim 1, wherein the channel is one selected from a group consisting of:

an email and a short message service (SMS).

6. The method of claim 1, wherein the token is time-constrained.

7. The method of claim 1, wherein the first request is a login request submitted via a user interface to access a database system.

8. The method of claim 1, wherein determining whether the IP address is associated with a user account associated with the authentication information includes determining whether the first request is from an unknown source.

9. A non-transitory computer readable medium configured to store instruction, the instructions when executed by a processor, cause the processor to:

receive, from a client device, a first request including authentication information for a user and information identifying the client device, the information identifying the client device including an IP address;

validate the authentication information of the user, the authentication information associated with a user account;

responsive to validating the authentication information of the user, determine whether the IP address is associated with a location associated with user account; and

responsive to determining that the IP address is not associated with the location associated with the user account;

send a token to a channel associated with the user account,

receive, from the client device, a second request including the token sent to the channel associated with the user account, and

responsive to receiving the second request including the token from the client device, authenticate the user.

10. The non-transitory computer readable medium of claim 9, wherein the token is a password.

11. The non-transitory computer readable medium of claim 9, wherein the token is a PIN.

12. The non-transitory computer readable medium of claim 9, wherein the token is a one time password.

13. The non-transitory computer readable medium of claim 9, wherein the channel is one selected from a group consisting of:

a voice message, and an instant message.

14. The non-transitory computer readable medium of claim 9, wherein the token is time-constrained.

15. The non-transitory computer readable medium of claim 9, wherein the first request is a login request via a user interface.

16. The non-transitory computer readable medium of claim 9, wherein determining whether the IP address is associated with a user account associated with the authentication information includes determining whether the first request is from an unknown source.