# US 10,313,329 B2 · On-demand service security system and method for managing a risk of access as a condition of permitting access to the on-demand service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,329 B2 - Document ID: US10313329B2 - Status: Granted - Kind: B2 - Application number: 15/786,400 - Filed: 2017-10-17 - Published: 2018-02-22 - Granted: 2019-06-04 - Earliest claimed: 2007-11-15 - Assignees: salesforce.com, inc. - Applicants: salesforce.com, inc. - Inventors: Forrest A. Junod; Robert C. Fly; Peter Dapkus; Scott W. Yancey; Steven S. Lawrance; Simon Z. Fell - Web page: https://patentgrep.com/patent/US10313329B2 ## CPC - G06F 21/42: using separate channels for security data - G06F 21/60: Protecting data - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 51/04: Real-time or near real-time messaging, e.g. instant messaging [IM] - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/14: {for detecting or protecting against malicious traffic} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In accordance with embodiments, there are provided mechanisms and methods for managing a risk of access to an on-demand service as a condition of permitting access to the on-demand service. These mechanisms and methods for providing such management can enable embodiments to help prohibit an unauthorized user from accessing an account of an authorized user when the authorized user inadvertently loses login information. The ability of embodiments to provide such management may lead to an improved security feature for accessing on-demand services. ## Claims ### Claim 1 A non-transitory machine-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to: receiving, with one or more hardware processors, a request to access an on-demand service from a requestor associated with one of a plurality of entities of the on-demand service; determining, with the one or more hardware processors, that the request to access the on-demand service is from a source providing a risk of access, the determination being based at least in part on stored information associated with at least one of a plurality of users or the one of the plurality of entities, wherein the request has an associated one-time use token that cannot be reused and expires after a predetermined amount of time; and managing, with the one or more hardware processors, the risk of access to the on-demand service by the requestor as a condition of permitting the requestor to access the on-demand service by providing an additional authentication sequence selected based on whether a requestor device is known, wherein the additional authentication sequence comprises completing additional subsequent authentication communications with the requestor device. ### Claim 2 (depends on 1) The non-transitory machine-readable medium of claim 1, wherein the on-demand service includes an on-demand database service. ### Claim 3 (depends on 2) The non-transitory machine-readable medium of claim 2, wherein the on-demand service includes a multi-tenant on-demand database service. ### Claim 4 (depends on 1) The non-transitory machine-readable medium of claim 1, wherein managing the risk of access to the on-demand service by the requestor includes generating a document. ### Claim 5 (depends on 1) The non-transitory machine-readable medium of claim 1, wherein the determination that the request is from the source providing the risk of access is further based, at least in part, on the device associated with the requestor. ### Claim 6 (depends on 5) The non-transitory machine-readable medium of claim 5, wherein it is determined that the request is from the source providing the risk of access because the device associated with the requestor has not previously been associated with the at least one of a plurality of users identified by stored information of the one of the plurality of entities of the on-demand service to which the access is requested. ### Claim 7 (depends on 5) The non-transitory machine-readable medium of claim 5, wherein it is determined that the request is from the source providing the risk of access because the device associated with the requestor has previously been associated with the at least one of a plurality of users identified by stored information of the one of the plurality of entities of the on-demand service to which the access is requested. ### Claim 8 (depends on 6) The non-transitory machine-readable medium of claim 6, wherein managing the risk of access includes generating a document and permitting the requestor access to the on-demand service in response to: the device associated with the requestor not being previously associated with the at least one of the plurality of users identified by the stored information of the one of the plurality of entities of the on-demand service to which the access is requested, and providing the valid token to the requestor. ### Claim 9 (depends on 6) The non-transitory machine-readable medium of claim 6, wherein managing the risk of access includes generating a document and providing the requestor access to the on-demand service in response to: the device associated with the requestor being previously associated with the at least one of the plurality of users identified by the stored information of the one of the plurality of entities of the on-demand service to which the access is requested, and providing the valid token to the requestor. ### Claim 10 (depends on 1) The non-transitory machine-readable medium of claim 1, wherein managing the risk of access to the on-demand service by the requestor includes comparing information in the request to access the on-demand service with a list of at least one of users and entities pre-determined to be granted access to the on-demand service. ### Claim 11 A method, comprising: receiving, with one or more hardware processors, a request to access an on-demand service from a requestor associated with one of a plurality of entities of the on-demand service; determining, with the one or more hardware processors, that the request to access the on-demand service is from a source providing a risk of access, the determination being based at least in part on stored information associated with at least one of a plurality of users or the one of the plurality of entities, wherein the request has an associated one-time use token that cannot be reused and expires after a predetermined amount of time; and managing, with the one or more hardware processors, the risk of access to the on-demand service by the requestor as a condition of permitting the requestor to access the on-demand service by providing an additional authentication sequence selected based on whether a requestor device is known, wherein the additional authentication sequence comprises completing additional subsequent authentication communications with the requestor device. ### Claim 12 An apparatus, comprising: a processor; and one or more stored sequences of instructions which, when executed by the processor, cause the processor to: receiving, with one or more hardware processors, a request to access an on-demand service from a requestor associated with one of a plurality of entities of the on-demand service; determining, with the one or more hardware processors, that the request to access the on-demand service is from a source providing a risk of access, the determination being based at least in part on stored information associated with at least one of a plurality of users or the one of the plurality of entities, wherein the request has an associated one-time use token that cannot be reused and expires after a predetermined amount of time; and managing, with the one or more hardware processors, the risk of access to the on-demand service by the requestor as a condition of permitting the requestor to access the on-demand service by providing an additional authentication sequence selected based on whether a requestor device is known, wherein the additional authentication sequence comprises completing additional subsequent authentication communications with the requestor device. ### Claim 13 (depends on 11) The method of claim 11, wherein it is determined that the request is from the source providing the risk of access because the device associated with the requestor has not previously been associated with the at least one of a plurality of users identified by stored information of the one of the plurality of entities of the on-demand service to which the access is requested. ### Claim 14 (depends on 11) The method of claim 11, wherein it is determined that the request is from the source providing the risk of access because the device associated with the requestor has previously been associated with the at least one of a plurality of users identified by stored information of the one of the plurality of entities of the on-demand service to which the access is requested. ### Claim 15 (depends on 11) The method of claim 11, wherein managing the risk of access includes generating a document and permitting the requestor access to the on-demand service in response to: the device associated with the requestor not being previously associated with the at least one of the plurality of users identified by the stored information of the one of the plurality of entities of the on-demand service to which the access is requested, and providing the valid token to the requestor. ### Claim 16 (depends on 11) The method of claim 11, wherein managing the risk of access includes generating a document and providing the requestor access to the on-demand service in response to: the device associated with the requestor being previously associated with the at least one of the plurality of users identified by the stored information of the one of the plurality of entities of the on-demand service to which the access is requested, and providing the valid token to the requestor. ### Claim 17 (depends on 12) The apparatus of claim 12, wherein it is determined that the request is from the source providing the risk of access because the device associated with the requestor has not previously been associated with the at least one of a plurality of users identified by stored information of the one of the plurality of entities of the on-demand service to which the access is requested. ### Claim 18 (depends on 12) The apparatus of claim 12, wherein it is determined that the request is from the source providing the risk of access because the device associated with the requestor has previously been associated with the at least one of a plurality of users identified by stored information of the one of the plurality of entities of the on-demand service to which the access is requested. ### Claim 19 (depends on 12) The apparatus of claim 12, wherein managing the risk of access includes generating a document and permitting the requestor access to the on-demand service in response to: the device associated with the requestor not being previously associated with the at least one of the plurality of users identified by the stored information of the one of the plurality of entities of the on-demand service to which the access is requested, and providing the valid token to the requestor. ### Claim 20 (depends on 12) The apparatus of claim 12, wherein managing the risk of access includes generating a document and providing the requestor access to the on-demand service in response to: the device associated with the requestor being previously associated with the at least one of the plurality of users identified by the stored information of the one of the plurality of entities of the on-demand service to which the access is requested, and providing the valid token to the requestor.