# US 10,313,313 B2 · Methods and systems for proxying data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,313 B2 - Document ID: US10313313B2 - Status: Granted - Kind: B2 - Application number: 15/885,472 - Filed: 2018-01-31 - Published: 2018-06-07 - Granted: 2019-06-04 - Earliest claimed: 2011-10-07 - Assignees: salesforce.com, inc. - Applicants: salesforce.com, inc. - Inventors: Yoel Gluck - Web page: https://patentgrep.com/patent/US10313313B2 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - G06F 16/9038: Presentation of query results - G06F 16/9535: Search customisation based on user profiles and personalisation - H04L 63/0281: {Proxies} - H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - H04L 63/126: {the source of the received data} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems are provided for proxying data between an application server and a client device. One exemplary application system includes an application server to generate a virtual application and a proxy server coupled to the application server over a network to provide the virtual application to a client device. The proxy server receives input data from the client device and provides the input data to the application server, wherein the application server encodes the input data for an action in response to authenticating the proxy server and provides the data encoded for the action to the proxy server. The proxy server performs the action on the data and provides the result to the client device. ## Claims ### Claim 1 A method, comprising: receiving, by a proxy server, an input comprising first data and second data; encrypting, by the proxy server, the second data based upon a determination that the second data requires encryption according to a rule associated with the input; forwarding, by the proxy server, the first data, the encrypted second data, and an identifier that indicates encryption of the second data to an application server; receiving, by the proxy server, instructions from the application server that integrate the first data, the encrypted second data, and a post-decryption action bypassed by the application server; decrypting, by the proxy server, the encrypted second data and processing the post-decryption action on the decrypted second data; and providing, by the proxy server in response to the input, the instructions with the decrypted second data as processed by the post-decryption action. ### Claim 2 (depends on 1) The method of claim 1, wherein decrypting the encrypted second data includes: detecting, by the proxy server, malicious code in the decrypted second data; and performing, by the proxy server, a remedial action configured to prevent execution of the malicious code. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving, by the proxy server, an identifier that indicates the post-decryption action. ### Claim 4 (depends on 1) The method of claim 1, wherein the identifier that indicates encryption of the second data is a unique identifier associated with the application server, and wherein decrypting the encrypted second data comprises: using the unique identifier to mark operators of code generated by the application server separately from potentially malicious code. ### Claim 5 (depends on 1) The method of claim 1, wherein encrypting the second data comprises generating the identifier that indicates encryption of the second data as a unique identifier associated with the application server. ### Claim 6 (depends on 1) The method of claim 1, wherein decrypting the encrypted second data and processing the post-decryption action includes distinguishing the encrypted second data from the instructions based on an encoding authentication protocol established between the proxy server and the application server. ### Claim 7 (depends on 1) The method of claim 1, wherein encrypting the second data further comprises: hashing, by the proxy server, the encrypted second data to a hexadecimal representation; and provide, by the proxy server, the hexadecimal representation as a parameter to a post-decryption function. ### Claim 8 A non-transitory, computer-readable medium storing computer executable instructions configured to cause a processor to perform operations comprising: receiving, by a proxy server, an input comprising first data and second data; encrypting, by the proxy server, the second data based upon a determination that the second data requires encryption according to a rule associated with the input; forwarding, by the proxy server, the first data, the encrypted second data, and an identifier that indicates encryption of the second data to an application server; receiving, by the proxy server, instructions from the application server that integrate the first data, the encrypted second data, and a post-decryption action bypassed by the application server; decrypting, by the proxy server, the encrypted second data and processing the post-decryption action on the decrypted second data; and providing, by the proxy server in response to the input, the instructions with the decrypted second data as processed by the post-decryption action. ### Claim 9 (depends on 8) The computer-readable medium of claim 8, wherein decrypting the encrypted second data includes: detecting, by the proxy server, malicious code in the decrypted second data; and performing, by the proxy server, a remedial action configured to prevent execution of the malicious code. ### Claim 10 (depends on 8) The computer-readable medium of claim 8, wherein the identifier that indicates encryption of the second data is a unique identifier associated with the application server, and wherein decrypting the encrypted second data comprises: using the unique identifier to mark operators of code generated by the application server separately from potentially malicious code. ### Claim 11 (depends on 8) The computer-readable medium of claim 8, wherein encrypting the second data comprises generating the identifier that indicates encryption of the second data as a unique identifier associated with the application server. ### Claim 12 (depends on 8) The computer-readable medium of claim 8, wherein decrypting the encrypted second data and processing the post-decryption action includes distinguishing the encrypted second data from the instructions based on an encoding authentication protocol established between the proxy server and the application server. ### Claim 13 (depends on 8) The computer-readable medium of claim 8, wherein encrypting the second data further comprises: hashing, by the proxy server, the encrypted second data to a hexadecimal representation; and provide, by the proxy server, the hexadecimal representation as a parameter to a post-decryption function. ### Claim 14 (depends on 8) The computer-readable medium of claim 8, the operations further comprising: receiving, by the proxy server, an identifier that indicates the post-decryption action. ### Claim 15 A system, comprising: a memory; and at least one processor coupled to the memory and configured to: receive, by a proxy server, an input comprising first data and second data; encrypt, by the proxy server, the second data based upon a determination that the second data requires encryption according to a rule associated with the input; forward, by the proxy server, the first data, the encrypted second data, and an identifier that indicates encryption of the second data to an application server; receive, by the proxy server, instructions from the application server that integrate the first data, the encrypted second data, and a post-decryption action bypassed by the application server; decrypt, by the proxy server, the encrypted second data and process the post-decryption action on the decrypted second data; and provide, by the proxy server in response to the input, the instructions with the decrypted second data as processed by the post-decryption action. ### Claim 16 (depends on 15) The system of claim 15, the at least one processor further configured to: receive, by the proxy server, an identifier that indicates the post-decryption action. ### Claim 17 (depends on 15) The system of claim 15, wherein the identifier that indicates encryption of the second data is a unique identifier associated with the application server, and wherein to decrypt the encrypted second data, the at least one processor is configured to: use, by the proxy server, the unique identifier to mark operators of code generated by the application server separately from potentially malicious code. ### Claim 18 (depends on 15) The system of claim 15, wherein to encrypt the second data, the at least one processor is configured to: hash, by the proxy server, the encrypted second data to a hexadecimal representation; and provide, by the proxy server, the hexadecimal representation as a parameter to a post-decryption function. ### Claim 19 (depends on 15) The system of claim 15, wherein to decrypt the encrypted second data, the at least one processor is configured to: detect, by the proxy server, malicious code in the encrypted second data; and perform, by the proxy server, a remedial action configured to prevent execution of the malicious code. ### Claim 20 (depends on 15) The system of claim 15, wherein to decrypt the encrypted second data and process the post-decryption action, the at least one processor is configured to: distinguish the encrypted second data from the instructions based on an encoding authentication protocol established between the proxy server and the application server.