System, method and computer program product for authenticating and authorizing an external entity

• US 8,646,048 B2
• Filed: 11/16/2010
• Issued: 02/04/2014
• Est. Priority Date: 03/31/2010
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Lee, Jong
• Primary Examiner(s): Dada, Beemnet
• Assistant Examiner(s): BELL, KALISH K
• Application Number:
  US12/947,760
• Publication Number:
  US 20110247066A1
• Time in Patent Office: 1,176 Days
• Field of Search: 726 2- 7, 726 9- 10, 726 16- 21, 726 27- 28
• US Class Current: 726/4
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

In accordance with embodiments, there are provided mechanisms and methods for authenticating and authorizing an external entity. These mechanisms and methods for authenticating and authorizing an external entity can enable improved data security, more efficient data transfer, improved data access channels, etc.

Claims

1. A computer program product embodied on a non-transitory computer readable medium, the computer program product including instructions which, when executed by a processor, cause the processor to perform a method comprising:

identifying the creation of a remote access object for an entity external to a system, where the creation of the remote access object is identified within the system, and where the remote access object enables remote access of the system by the entity;

in response to the identification of the creation of the remote access object, generating within the system both a key identifying the entity and security information associated with the entity, where the key and the security information are separate from the remote access object;

receiving at a first instance of the system a request from the entity for user data of the user of the system, wherein the user data is stored in the system, and where the system includes a plurality of instances;

authenticating and authorizing the entity by;

receiving authorization from the user for the entity to access the user data,

wherein the authorization is received at the system via a device of the user;

in response to receiving the authorization from the user, providing the security information associated with the entity from the system to the entity; and

authenticating the entity using the security information supplied by the entity to the system;

globally replicating the key and the security information to all of the instances within the system;

routing the request from the first instance of the system where it is received to a second instance of the system where an organization associated with the user is present for responding to the request; and

returning the user data to the entity, based on receiving from the user the authorization for the entity to access the user data, and authenticating the entity using the security information supplied by the entity.

2. The computer program product of claim 1, wherein the entity provides a service to the user.

3. The computer program product of claim 1, wherein the user data includes one or more files within the system.

4. The computer program product of claim 1, wherein the user data is associated with a user organization of the system.

5. The computer program product of claim 1, wherein the entity provides a service to the user, and the service requires the user data stored in the system.

6. The computer program product of claim 1, wherein the security information includes one or more of a secret, a password, a token, and encrypted data.

7. The computer program product of claim 6, wherein the key and the security information are different from the user'"'"'s login information for the system.

8. The computer program product of claim 1, wherein when the entity requests the user data from the system for the first time, the user is presented with a login page at the system.

9. The computer program product of claim 8, wherein the user grants access permission to the entity via the login page, utilizing the user'"'"'s login information.

10. The computer program product of claim 9, wherein the security information is provided to the entity after the user grants access permission to the entity via the login page.

11. The computer program product of claim 1, wherein the user data is returned to the entity if the security information received from the entity matches the security information associated with the entity in the system.

12. A method, comprising:

identifying the creation of a remote access object for an entity external to a system, where the creation of the remote access object is identified within the system, and where the remote access object enables remote access of the system by the entity;

in response to the identification of the creation of the remote access object, generating within the system both a key identifying the entity and security information associated with the entity, where the key and the security information are separate from the remote access object;

receiving at a first instance of the system a request from the entity for user data of the user of the system, wherein the user data is stored in the system, and where the system includes a plurality of instances;

authenticating and authorizing the entity by;

receiving authorization from the user for the entity to access the user data,

wherein the authorization is received at the system via a device of the user;

in response to receiving the authorization from the user, providing the security information associated with the entity from the system to the entity; and

authenticating the entity using the security information supplied by the entity to the system;

globally replicating the key and the security information to all of the instances within the system;

routing the request from the first instance of the system where it is received to a second instance of the system where an organization associated with the user is present for responding to the request; and

returning the user data to the entity, based on receiving from the user the authorization for the entity to access the user data, and authenticating the entity using the security information supplied by the entity.

13. An apparatus, comprising:

a hardware processor for;

identifying the creation of a remote access object for an entity external to a system, where the creation of the remote access object is identified within the system, and where the remote access object enables remote access of the system by the entity;

in response to the identification of the creation of the remote access object, generating within the system both a key identifying the entity and security information associated with the entity, where the key and the security information are separate from the remote access object;

receiving at a first instance of the system a request from the entity for user data of the user of the system, wherein the user data is stored in the system, and

where the system includes a plurality of instances,

authenticating and authorizing the entity by;

receiving authorization from the user for the entity to access the user data,

wherein the authorization is received at the system via a device of the user;

in response to receiving the authorization from the user, providing the security information associated with the entity from the system to the entity; and

authenticating the entity using the security information supplied by the entity to the system,

globally replicating the key and the security information to all of the instances within the system;

routing the request from the first instance of the system where it is received to a second instance of the system where an organization associated with the user is present for responding to the request; and

returning the user data to the entity, based on receiving from the user the authorization for the entity to access the user data, and authenticating the entity using the security information supplied by the entity.