Salesforce · Security · Filed May 19, 2025 · USPTO published Aug 13, 2026 · Aug 13 release

Salesforce Patents a System to Block Harmful Requests Before They Reach Its Cloud Servers

Every time a bad actor sends a malicious request to a cloud service, something has to catch it before it does damage. Salesforce has patented a system that builds a kind of fingerprint for suspicious traffic and blocks matching requests automatically, without a human having to write a new rule each time.

By Patentlyze Team · Updated Aug 14, 2026 · 3 min read

Architecture of application gateways and control planes filtering web traffic. Drawing from patent filing US 2026/0238615 A1. — Architecture of application gateways and control planes filtering web traffic.All 13 drawings ↓

Publication number: US 2026/0238615 A1(US20260238615A1)
Applicant: Salesforce, Inc.
Filed · Published: May 19, 2025 · Aug 13, 2026
Inventors: Kaushal BANSAL, Simone MAINARDI, Prabhat SINGH
Status when we published: Waiting for an examiner
Document: 20 claims
US classification: 726/11
Examiner: DESROSIERS, EVANS (Art Unit 2491)
Parent application: Claims priority from a provisional application 63757468 (filed Feb 12, 2025)

How Salesforce's traffic fingerprinting actually works

A security camera stares at an empty hallway all night, recording nothing useful. But the moment something looks off, it flags the clip for review. Salesforce is applying the same instinct to internet traffic hitting its cloud services.

When your company uses Salesforce, thousands of requests flow in and out every hour. Most are legitimate. Some are not. This patent describes a system that creates a fingerprint for each incoming request, a kind of digital signature, and compares it against a database of known bad patterns. If the request looks like a threat, it gets blocked before it ever reaches its destination.

What makes this different from older approaches is that the fingerprinting is designed to catch threats that are similar to known bad ones, not only exact copies. So even if an attacker tweaks their attack slightly, the system can still recognize the family resemblance and block it.

From the filing · CLAIM 1

… a locality-based fingerprint determined based on a locality-sensitive hashing function that maps similar input values to similar output values …

Translation: It creates digital signatures so that closely related attack requests generate similar output patterns.

Inside the locality hashing and entropy detection engine

The patent describes an application gateway, a checkpoint that sits between the outside world and Salesforce's internal services. Every incoming request passes through this gateway and gets analyzed by a fingerprint engine.

The engine creates two types of fingerprints for each request:

Locality-based fingerprint: Uses a technique called locality-sensitive hashing (a math function that groups similar inputs into similar outputs, so two slightly different attacks still hash to nearby values and can be caught together).
Entropy-based fingerprint: Measures how much randomness or "information" is packed into the request data. Malicious payloads, like encoded shellcode or obfuscated commands, tend to have unusually high or low entropy compared to normal traffic.

These two fingerprints are then checked against a fingerprint database of known bad patterns. If there is a match, a fingerprint filter blocks the request outright before it reaches the application or server it was targeting.

The mention of machine learning in the title signals that the system can also learn and update its database over time, adapting as new attack patterns emerge rather than relying purely on static, hand-written rules.

From the filing · THE ABSTRACT

… a fingerprint filter configured to block the application-layer request message from being transmitted to a request destination upon determining that the fingerprint information matches a predetermined filter fingerprint value …

Translation: The system stops harmful web traffic right at the gate if its signature matches a known threat profile.

What this means for Salesforce cloud security at scale

For anyone whose company runs on Salesforce, a smarter traffic filter means fewer successful attacks slipping through during the gap between when a new threat appears and when a human security analyst writes a rule to block it. That gap, sometimes hours or days, is exactly when attackers do their most damage. A system that catches near-matches to known attacks closes that window significantly.

Cloud security gatekeeping at this layer is an area where several large platforms are filing aggressively, and Salesforce's approach of combining two complementary fingerprint types, one for similarity, one for statistical strangeness, is a practical way to handle both copycats and genuinely novel attacks. This filing joins a steady stream of newest Big Tech patents targeting AI-assisted network threat detection, a space that is moving fast as cloud infrastructure becomes the primary attack surface for enterprise breaches.

Source: US 2026/0238615 A1 at the USPTO (PDF). Full patent text and figures are in the official publication.

Get our take in your Top Stories

Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Salesforce patent news breaks.

Add Patentlyze on Google One click.

There are more where this came from

We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.