# US 12,764,164 B2 · Systems, methods, and devices for security enhancements in cloud computing environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,164 B2 - Document ID: US12764164B2 - Status: Granted - Kind: B2 - Application number: 18/159,497 - Filed: 2023-01-25 - Published: 2024-07-25 - Granted: 2026-10-13 - Earliest claimed: 2023-01-25 - Assignees: Salesforce, Inc. - Applicants: Salesforce, Inc. - Inventors: Luis Campo Giralte - Web page: https://patentgrep.com/patent/US12764164B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 61/4511: using domain name system [DNS] - H04L 61/58: Caching of addresses or names - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and devices are disclosed herein that provide security for requests sent to services in service meshes. A computing platform may be implemented using a server system. The computing platform is configurable to cause receiving a request from a service in a cloud-based computing environment, and identifying a chain of trust embedded in a portion of the request, the chain of trust being generated by one or more security entities in the cloud-based computing environment, the chain of trust identifying results of one or more security verification operations performed on the request. The computing platform is further configurable to cause determining if the chain of trust is a valid chain of trust based, at least in part, on one or more security policies, and sending the request to another entity in the cloud-based computing environment in response to determining the chain of trust is a valid chain of trust. ## Claims ### Claim 1 A computing platform implemented using a server system comprising one or more processors, the one or more processors being configurable to cause: receiving a request from a service in a cloud-based computing environment comprising a first service mesh comprising a plurality of services and a plurality of sidecars configured to perform communications operations for associated services; identifying a chain of trust data object embedded in a custom security header of the request generated by the service, the request being configured to include a custom data field storing the security header, the chain of trust data object being generated by one or more security entities in the cloud-based computing environment, the one or more security entities comprising one or more external firewall services provided by a service provider, the chain of trust data object being configured to store results of a sequence of one or more security verification operations performed on the request as it traverses the first service mesh such that the chain of trust data object tracks at least some of the one or more security verification operations performed by the external firewall service as the request traverses the first service mesh, and such that the chain of trust data object includes a first signature from a first service and further includes a second result from a second firewall service and a second signature from a second service; determining if the chain of trust data object embedded in the custom security header is a valid chain of trust based, at least in part, on one or more security policies; and sending, using a sidecar associated with the service, the request to another entity in the cloud-based computing environment identified based on the request and in response to determining the chain of trust data object is a valid chain of trust. ### Claim 2 (depends on 1) The computing platform of claim 1, wherein the chain of trust data object comprises a first result from a first firewall service. ### Claim 3 (depends on 1) The computing platform of claim 1, wherein the one or more security policies comprise a plurality of conditions configured to identify when the request may be sent. ### Claim 4 (depends on 1) The computing platform of claim 1 further comprising: performing a domain name service (DNS) lookup based on one or more data values included in the chain of trust data object. ### Claim 5 (depends on 4) The computing platform of claim 4, wherein the DNS lookup is performed on a domain of the service from which the request is received. ### Claim 6 (depends on 5) The computing platform of claim 5, wherein the DNS lookup is performed using a local cache included in a service mesh. ### Claim 7 A method comprising: receiving a request from a service in a cloud-based computing environment comprising a first service mesh comprising a plurality of services and a plurality of sidecars configured to perform communications operations for associated services; identifying a chain of trust data object embedded in a custom security header of the request generated by the service, the request being configured to include a custom data field storing the security header, the chain of trust data object being generated by one or more security entities in the cloud-based computing environment, the one or more security entities comprising one or more external firewall services provided by a service provider, the chain of trust data object being configured to store results of a sequence of one or more security verification operations performed on the request as it traverses the first service mesh such that the chain of trust data object tracks at least some of the one or more security verification operations performed by the external firewall service as the request traverses the first service mesh, and such that the chain of trust data object includes a first signature from a first service and further includes a second result from a second firewall service and a second signature from a second service; determining if the chain of trust data object embedded in the custom security header is a valid chain of trust based, at least in part, on one or more security policies; and sending, using a sidecar associated with the service, the request to another entity in the cloud-based computing environment identified based on the request and in response to determining the chain of trust data object is a valid chain of trust. ### Claim 8 (depends on 7) The method of claim 7, wherein the chain of trust data object comprises a first result from a first firewall service. ### Claim 9 (depends on 7) The method of claim 7, wherein the one or more security policies comprise a plurality of conditions configured to identify when the request may be sent. ### Claim 10 (depends on 7) The method of claim 7 further comprising: performing a domain name service (DNS) lookup based on one or more data values included in the chain of trust data object. ### Claim 11 (depends on 10) The method of claim 10, wherein the DNS lookup is performed on a domain of the service from which the request is received. ### Claim 12 (depends on 11) The method of claim 11, wherein the DNS lookup is performed using a local cache included in a service mesh. ### Claim 13 A computer program product comprising non-transitory computer-readable program code capable of being executed by one or more processors when retrieved from a non-transitory computer-readable medium, the program code comprising instructions configurable to cause the one or more processors to perform a method comprising: receiving a request from a service in a cloud-based computing environment comprising a first service mesh comprising a plurality of services and a plurality of sidecars configured to perform communications operations for associated services; identifying a chain of trust data object embedded in a custom security header of the request generated by the service, the request being configured to include a custom data field storing the security header, the chain of trust data object being generated by one or more security entities in the cloud-based computing environment, the one or more security entities comprising one or more external firewall services provided by a service provider, the chain of trust data object being configured to store results of a sequence of one or more security verification operations performed on the request as it traverses the first service mesh such that the chain of trust data object tracks at least some of the one or more security verification operations performed by the external firewall service as the request traverses the first service mesh, and such that the chain of trust data object includes a first signature from a first service and further includes a second result from a second firewall service and a second signature from a second service; determining if the chain of trust data object embedded in the custom security header is a valid chain of trust based, at least in part, on one or more security policies; and sending, using a sidecar associated with the service, the request to another entity in the cloud-based computing environment identified based on the request and in response to determining the chain of trust data object is a valid chain of trust. ### Claim 14 (depends on 13) The computer program product recited in claim 13, wherein the chain of trust data object comprises a first result from a first firewall service. ### Claim 15 (depends on 13) The computer program product recited in claim 13, wherein the method further comprises: performing a domain name service (DNS) lookup based on one or more data values included in the chain of trust data object, wherein the DNS lookup is performed on a domain of the service from which the request is received.