Bloom filter whitelist and blacklist operations

Patent metadata

Field	Value
Publication number	US-12086277-B2
Application number	US-201816236984-A
Country	US
Kind code	B2
Filing date	Dec 25, 2018
Priority date	Dec 25, 2018
Publication date	Sep 10, 2024
Grant date	Sep 10, 2024

Abstract

Computer system security can be improved through the use of whitelists and blacklists based on Bloom filters in the context of real-time data and electronic actions. A transaction may use a specific asset. A first search of the specific asset can be conducted in a Bloom filter whitelist comprising first assets classified as having a first status. The first search may return a plurality of first binary results corresponding to different hash functions performed the first assets. A second search of the specific asset can be conducted in a Bloom filter blacklist comprising second assets classified as having a second status different from the first status. The second search can return a plurality of second binary results corresponding to different hash function performed on the second assets, and the specific asset can be determined to be good or bad based on values of the first and second binary results.

First claim

What is claimed is:

1. A method relating to whitelist usage, comprising:
generating a Bloom filter whitelist at least in part by:
mapping, via a first hash function, each asset of a plurality of first assets to a different first bit of a first binary vector, wherein each of the first assets is classified as having a first status; and
mapping, via a second hash function different from the first hash function, each asset of the plurality of first assets to a different second bit of the first binary vector, wherein each of the different second bits is different from each of the different first bits;

receiving a request to determine a status of a specific asset, the request being associated with a transaction that requires a use of the specific asset for completion;
conducting a first search of the specific asset in the Bloom filter whitelist at least in part by mapping the specific asset to a third bit of the first binary vector via the first hash function and by mapping the specific asset to a fourth bit of the first binary vector via the second hash function; the first search returning a plurality of first binary results
conducting a second search of the specific asset in a Bloom filter blacklist comprising a plurality of second assets classified as having a second status different from the first status, the second search returning a plurality of second binary results that each correspond to the first hash function or the second hash function performed on one of the second assets; and
determining whether the specific asset is a first type of asset based on values of the first binary results and values of the second binary results.

2. The method of claim 1 , further comprising,
generating the Bloom filter blacklist at least in part by:
mapping, via the first hash function, each asset of the plurality of second assets to a different first bit of a second binary vector; and
mapping, via the second hash function, each asset of the plurality of second assets to a different second bit of the second binary vector, wherein each of the different second bits of the second binary vector is different from each of the different first bits of the second binary vector.

3. The method of claim 2 , wherein the second search is conducted at least in part by mapping the specific asset to a third bit of the second binary vector via the first hash function and by mapping the specific asset to a fourth bit of the second binary vector via the second hash function.

4. The method of claim 2 , wherein generating the second binary vector comprises:
initializing each bit of the second binary vector with a 0; and
setting the different first bits and the different second bits of the second binary vector with a 1 based on the mapping via the first hash function and the second hash function as a part of the generating the Bloom filter blacklist.

5. The method of claim 1 , wherein the first hash function and the second hash function have different hashing algorithms.

6. The method of claim 1 , wherein:
the mapping via the first hash function is performed such that the different first bits are separated from one another by other bits of the first binary vector; or
the mapping via the second hash function is performed such that the different second bits are separated from one another by other bits of the first binary vector.

7. The method of claim 1 , wherein generating the first binary vector comprises:
initializing each bit of the first binary vector with a 0; and
setting the different first bits and the different second bits of the first binary vector with a 1 based on the mapping via the first hash function and the mapping via the second hash function as a part of the generating the Bloom filter whitelist.

8. The method of claim 1 , wherein the determining whether the specific asset is a first type of asset comprises: determining that the specific asset is a first type of asset in response to the plurality of first binary results containing all 1s and the plurality of second binary results containing at least one 0.

9. The method of claim 8 , further comprising: facilitating the transaction in response to the determining that the specific asset is a first type of asset.

10. The method of claim 1 , wherein the determining whether the specific asset is a first type of asset comprises: determining that the specific asset is a second type of asset in response to the plurality of second binary results containing all 1s.

11. The method of claim 10 , further comprising: denying the transaction in response to the determining that the specific asset is a second type of asset.

12. The method of claim 1 , wherein the determining whether the specific asset is a first type of asset comprises: determining that the specific asset is an unknown asset in response to the plurality of first binary results containing at least one 0 and the plurality of second binary results containing at least one 0.

13. The method of claim 12 , further comprising: conducting a risk assessment of the specific asset in response to the determining that the specific asset is an unknown asset.

14. The method of claim 1 , wherein:
the transaction comprises a transaction to purchase a good or a service or a request to modify one or more resources of an electronic database; and
the specific asset comprises an Internet Protocol (IP) address, a device identifier, an email address, or a phone number.

15. A system, comprising:
a non-transitory memory; and
one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
receiving, from an entity, a request to engage in a computer operation that involves a particular asset that includes an Internet Protocol (IP) address, a device identifier, an email address, a phone number, or a payment instrument;
generating a Bloom filter whitelist at least in part by, mapping, via at least a first hash function and a second hash function different from the first hash function, each asset of a plurality of first assets to a different first bit and to a different second bit of a first binary vector, respectively, wherein each of the first assets has been previously confirmed as being trustworthy or safe;
mapping, at least in part via the first hash function and the second hash function, the particular asset to the Bloom filter whitelist;
obtaining a first result based on the mapping the particular asset to the Bloom filter whitelist;
mapping, at least in part via the first hash function and the second hash function, the particular asset to a Bloom filter blacklist, wherein the Bloom filter blacklist includes a plurality of components that have been mapped by at least the first hash function and the second hash function to a plurality of second assets that have been previously confirmed as being untrustworthy or unsafe;
obtaining a second result based on the mapping the particular asset to the Bloom filter blacklist; and
determining whether the request should be granted based on the first result and the second result.

16. The system of claim 15 , wherein the operations further comprise:
determining, based on a transaction, whether a further asset used in the transaction belongs to the plurality of first assets or to the plurality of second assets;
updating, in response to a determination that the further asset belongs to the plurality of first assets, the Bloom filter whitelist by mapping the further asset to a subset of components of the Bloom filter whitelist at least in part via the

Assignees

• Paypal Inc

Inventors

• Lin Ying

Classifications

• G06F21/44

  Program or device authentication · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title