Salesforce Com, Inc.

Salesforce, Inc.

Ryan Guest

Jayesh Sureshchandra

Aaron Fiske

Prasad Peddada

Addison Luh

Peter Dapkus

Irandi Upeka Bulumulla

Nikita Prokopev

Bulent Cinarkaya

Alex S Warshavsky

Taher Elgamal

Steven Scott Lawrance

Aaron Johnson

Jonathan Brossard

Travis Emmert

Jeremy Horwitz

Matthew Steele

Bradley Vine

Sean Gill

Ricardo Vazquez Reyes

Theresa Vietvu

Yujia Hu

An exemplary system having a processor and a memory therein includes means for creating an isolation group, in which creating the isolation groups includes: defining isolation requirements, identifying a group of features utilizing call-out functions, and selecting from among the group of features utilizing call-out functions a group of features having the defined isolation requirements; deploying platform software integrating the isolation requirements, in which the platform software contains instructions to map the isolation requirements to a customer organization; creating the customer organization; creating a unique variant of the customer organization, in which creating the unique variant of the customer organization includes declaratively applying an isolation layer containing isolation requirements on top of a base layer for the customer organization; and deploying the unique variant of the customer organization onto the customer organization's computing infrastructure, in which the unique variant validates per-tenant distinctions for various applications subjected to the isolation requirements.

Systems, methods, and apparatuses for pre-configured per-tenant isolation in a multi-tenant cloud based computing environment

Methods and systems for securing customer data in a multi-tenant database environment are described. A key identifier received from a security server may be stored by an application server. The key identifier may be associated with a private key that is accessible by the security server and not accessible by the application server. A request to derive a symmetric key may be transmitted from the application server to the security server, the request including a public key generated by the application server, a salt value, and the key identifier. The symmetric key may then be derived based on the transmitted public key and the private key using a key derivation function. The application server may then receive and store the symmetric key in an in-memory cache, and be used to securely encrypt data received by the application server from client devices.

Securing data using key agreement

Securing data with symmetric keys generated using inaccessible private keys

Systems and methods for performing migration may include receiving, by a server computing system, a request to access a data element from a second data store, the data element having been migrated to the second data store from a first data store; accessing, by the server computing system, the data element from the second data store and its counterpart data element from the first data store; and based on the data element from the second data store being different from the counterpart data element from the first data store, responding, by the server computing system, to the request by providing the counterpart data element from the first data store instead of the data element from the second data store.

Methods and systems for data migration

A method of collecting data from multiple sources in a multi-tenant system is provided. The method includes obtaining data corresponding to a first tenant in the multi-tenant system and a second tenant in the multi-tenant system from a first source, obtaining data corresponding to the first tenant in the multi-tenant system and the second tenant in the multi-tenant system from a second source, and aggregating the data obtained from the first and second sources into a single database and associating each entry of the obtained data with at least one of the tenants of the multi-tenant system.

Systems and methods for automatic collection of performance data in a multi-tenant database system environment

Systems and methods for automatically collection of performance data in a multi-tenant database system environment

The disclosed technology for a hardware system to access a secure backend system uses non-volatile memory to hold encrypted secrets, volatile memory to hold decrypted secrets ready for use, a keys-for-all (K4A) server, and app servers running K4A clients. To access the backend system in production, each app server uses a decrypted secret and a certificate that identifies the app server and certifies its role and physical and logical location. At initialization of the app server, a K4A client is instantiated that launches and tracks processes, running on the app server, that are authorized to request decryption services. The K4A client responds to a decryption request from an authorized process, determined based on tracking of processes launched, by requesting decryption by a K4A server, using the certificate, and returns to the process, in volatile memory, a decrypted secret or a reference to the decrypted secret, decrypted by the K4A server.

Language-agnostic secure application development

In accordance with embodiments, there are provided mechanisms and methods for serving an application from a custom subdomain. These mechanisms and methods for serving an application from a custom subdomain can enable improved data security, enhanced system performance, optimized resource utilization, etc.

System, method and computer program product for serving an application from a custom subdomain

Language-agnostic secure application deployment

Embodiments include an apparatus for securing customer data and include a processor, and one or more stored sequences of instructions which, when executed, cause the processor to store an encrypted first key fragment in a first storage area, store an encrypted second key fragment in a separate second storage area, wherein access to the first storage area and to the second storage area is mutually exclusive. The instructions further cause the processor to decrypt the encrypted first key fragment and the encrypted second key fragment using a key set and keys associated with a hardware security module based on receiving a request to derive a master key. The master key is derived using the decrypted first key fragment and the decrypted second key fragment and stored in an in-memory cache. The master key is used to encrypt or to decrypt encrypted customer data.

Systems and methods for securing data

In accordance with embodiments, there are provided mechanisms and methods for performing one or more actions utilizing a uniform resource locator. These mechanisms and methods for performing one or more actions utilizing a uniform resource locator can enable improved overall URL usage, more efficient search engine URL results, improved URL comprehension by users, etc.

System, method and computer program product for performing one or more actions utilizing a uniform resource locator

Growing community of inventors

Stockton, CA, United States of America

Ryan Guest