Bloom filter whitelist and blacklist operations

Patent metadata

Field	Value
Publication number	US-2021319127-A1
Application number	US-201816236984-A
Country	US
Kind code	A1
Filing date	Dec 25, 2018
Priority date	Dec 25, 2018
Publication date	Oct 14, 2021
Grant date	—

Abstract

Computer system security can be improved through the use of whitelists and blacklists based on Bloom filters in the context of real-time data and electronic actions. A transaction may use a specific asset. A first search of the specific asset can be conducted in a Bloom filter whitelist comprising first assets classified as having a first status. The first search may return a plurality of first binary results corresponding to different hash functions performed the first assets. A second search of the specific asset can be conducted in a Bloom filter blacklist comprising second assets classified as having a second status different from the first status. The second search can return a plurality of second binary results corresponding to different hash function performed on the second assets, and the specific asset can be determined to be good or bad based on values of the first and second binary results.

First claim

What is claimed is:

1 . A method relating to whitelist usage, comprising:
receiving a request to determine a status of a specific asset, the request being associated with a transaction that requires a use of the specific asset for completion; conducting a first search of the specific asset in a Bloom filter whitelist comprising a plurality of first assets classified as having a first status, the first search returning a plurality of first binary results that each correspond to a different hash function performed on one of the first assets, wherein each different hash function belongs to a set of predefined hash functions; conducting a second search of the specific asset in a Bloom filter blacklist comprising a plurality of second assets classified as having a second status different from the first status, the second search returning a plurality of second binary results that each correspond to a different hash function performed on one of the second assets, wherein each different hash function belongs to the set of predefined hash functions; and determining whether the specific asset is a first type of asset based on values of the first binary results and values of the second binary results.

2 . The method of claim 1 , further comprising, before the receiving the request:
receiving reports from a plurality of first transactions that the first assets are verified first type of assets; generating the Bloom filter whitelist based on the first assets; receiving reports from a plurality of second transactions that the second assets are verified second type of assets; and generating the Bloom filter blacklist based on the second assets.

3 . The method of claim 2 , further comprising: before the receiving the request, selecting the set of predefined hash functions, wherein the Bloom filter whitelist and the Bloom filter blacklist are each generated using the set of predefined hash functions.

4 . The method of claim 3 , wherein:
the generating the Bloom filter whitelist comprises using the set of predefined hash functions to generate a first binary vector as the Bloom filter whitelist; and the generating the Bloom filter blacklist comprises using the set of predefined hash functions to generate a second binary vector as the Bloom filter blacklist.

5 . The method of claim 4 , wherein the selecting the set of predefined hash functions comprises selecting hash functions that:
map each of the first assets to multiple bits of the first binary vector in a substantially uniform distribution; or map each of the second assets to multiple bits of the second binary vector in a substantially uniform distribution.

6 . The method of claim 4 , wherein the generating the first binary vector comprises:
initializing each bit of the first binary vector with a 0; and setting a subset of the bits of the first binary vector with a 1 based on a hash function mapping with the verified first type of assets.

7 . The method of claim 4 , wherein the generating the second binary vector comprises:
initializing each bit of the second binary vector with a 0; and setting a subset of the bits of the second binary vector with a 1 based on a hash function mapping with the verified second type of assets.

8 . The method of claim 1 , wherein the determining whether the specific asset is a first type of asset comprises: determining that the specific asset is a first type of asset in response to the plurality of first binary results containing all 1s and the plurality of second binary results containing at least one 0.

9 . The method of claim 8 , further comprising: facilitating the transaction in response to the determining that the specific asset is a first type of asset.

10 . The method of claim 1 , wherein the determining whether the specific asset is a first type of asset comprises: determining that the specific asset is a second type of asset in response to the plurality of second binary results containing all 1s.

11 . The method of claim 10 , further comprising: denying the transaction in response to the determining that the specific asset is a second type of asset.

12 . The method of claim 1 , wherein the determining whether the specific asset is a first type of asset comprises: determining that the specific asset is an unknown asset in response to the plurality of first binary results containing at least one 0 and the plurality of second binary results containing at least one 0.

13 . The method of claim 12 , further comprising: conducting a risk assessment of the specific asset in response to the determining that the specific asset is an unknown asset.

14 . The method of claim 1 , wherein:
the transaction comprises a transaction to purchase a good or a service or a request to modify one or more resources of an electronic database; and the specific asset comprises an Internet Protocol (IP) address, a device identifier, an email address, a phone number, or a payment instrument.

15 . A system, comprising:
a non-transitory memory; and one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
receiving, from an entity, a request to engage in a computer operation that involves a particular asset that includes an Internet Protocol (IP) address, a device identifier, an email address, a phone number, or a payment instrument;
mapping, via a plurality of predefined hash functions, the particular asset to a Bloom filter whitelist, wherein the Bloom filter whitelist includes a plurality of components that have been mapped by the plurality of predefined hash functions to a plurality of first assets that have been previously verified as being trustworthy or safe;
obtaining a first result based on mapping the particular asset to the Bloom filter whitelist;
mapping, via the plurality of predefined hash functions, the particular asset to a Bloom filter blacklist, wherein the Bloom filter blacklist includes a plurality of components that have been mapped by the plurality of predefined hash functions to a plurality of second assets that have been previously confirmed as being untrustworthy or unsafe;
obtaining a second result based on mapping the particular asset to the Bloom filter blacklist; and
determining whether the request should be granted based on the first result and the second result.

16 . The system of claim 15 , wherein the operations further comprise:
determining, based on a transaction, whether a further asset used in the transaction belongs to the plurality of first assets or to the plurality of second assets; updating, in response to a determination that the further asset belongs to the plurality of first assets, the Bloom filter whitelist by mapping the further asset to a subset of the components of the Bloom filter whitelist via the plurality of predefined hash functions; or updating, in response to a determination that the further asset belongs to the plurality of second assets, the Bloom filter blacklist by mapping the further asset to a subset of the components of the Bloom filter blacklist via the plurality of predefined hash functions.

17 . The system of claim 15 , wherein the operations further comprise, before the receiving the request: configuring the plurality of predefined hash functions based on one or more parameters that include collision avoidance or distribution uniformity.

18 . The system of claim 15 , wherein:
the Bloom filter whitelist includes a first binary vector containing

Assignees

• Paypal Inc

Inventors

• Lin Ying

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title