Salesforce Patents a System to Block Harmful Requests Before They Reach Its Cloud Servers
Every time a bad actor sends a malicious request to a cloud service, something has to catch it before it does damage. Salesforce has patented a system that builds a kind of fingerprint for suspicious traffic and blocks matching requests automatically, without a human having to write a new rule each time.
How Salesforce's traffic fingerprinting actually works
A security camera stares at an empty hallway all night, recording nothing useful. But the moment something looks off, it flags the clip for review. Salesforce is applying the same instinct to internet traffic hitting its cloud services.
When your company uses Salesforce, thousands of requests flow in and out every hour. Most are legitimate. Some are not. This patent describes a system that creates a fingerprint for each incoming request, a kind of digital signature, and compares it against a database of known bad patterns. If the request looks like a threat, it gets blocked before it ever reaches its destination.
What makes this different from older approaches is that the fingerprinting is designed to catch threats that are similar to known bad ones, not only exact copies. So even if an attacker tweaks their attack slightly, the system can still recognize the family resemblance and block it.
… a locality-based fingerprint determined based on a locality-sensitive hashing function that maps similar input values to similar output values …
Translation: It creates digital signatures so that closely related attack requests generate similar output patterns.
Inside the locality hashing and entropy detection engine
The patent describes an application gateway, a checkpoint that sits between the outside world and Salesforce's internal services. Every incoming request passes through this gateway and gets analyzed by a fingerprint engine.
The engine creates two types of fingerprints for each request:
- Locality-based fingerprint: Uses a technique called locality-sensitive hashing (a math function that groups similar inputs into similar outputs, so two slightly different attacks still hash to nearby values and can be caught together).
- Entropy-based fingerprint: Measures how much randomness or "information" is packed into the request data. Malicious payloads, like encoded shellcode or obfuscated commands, tend to have unusually high or low entropy compared to normal traffic.
These two fingerprints are then checked against a fingerprint database of known bad patterns. If there is a match, a fingerprint filter blocks the request outright before it reaches the application or server it was targeting.
The mention of machine learning in the title signals that the system can also learn and update its database over time, adapting as new attack patterns emerge rather than relying purely on static, hand-written rules.
… a fingerprint filter configured to block the application-layer request message from being transmitted to a request destination upon determining that the fingerprint information matches a predetermined filter fingerprint value …
Translation: The system stops harmful web traffic right at the gate if its signature matches a known threat profile.
What this means for Salesforce cloud security at scale
For anyone whose company runs on Salesforce, a smarter traffic filter means fewer successful attacks slipping through during the gap between when a new threat appears and when a human security analyst writes a rule to block it. That gap, sometimes hours or days, is exactly when attackers do their most damage. A system that catches near-matches to known attacks closes that window significantly.
Cloud security gatekeeping at this layer is an area where several large platforms are filing aggressively, and Salesforce's approach of combining two complementary fingerprint types, one for similarity, one for statistical strangeness, is a practical way to handle both copycats and genuinely novel attacks. This filing joins a steady stream of newest Big Tech patents targeting AI-assisted network threat detection, a space that is moving fast as cloud infrastructure becomes the primary attack surface for enterprise breaches.
What Salesforce customers would actually get from this is real but easy to miss: fewer security incidents during the window when new attack variants are circulating but rules haven't caught up. No one notices that protection in a product update; it earns its keep in the breach that never happens. The combination of similarity-based and entropy-based fingerprinting is a thoughtful engineering choice, covering both slightly-modified known attacks and statistically weird payloads in a single pass.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
13 drawing sheets from US 2026/0238615 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →