IP Address Map Filtering for Blacklist Lookup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional IP blacklist filtering methods are inefficient due to large search times, high hardware requirements, and low precision, especially when dealing with a vast number of malicious sites and constantly changing IP addresses, which can degrade network performance and operations.
Innovation Solution
An IP address map is used to store set membership values for every possible IP address, allowing for fast and deterministic filtering by accessing a single memory location, eliminating the need for extensive searching and enabling efficient handling of large blacklists without affecting network speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IP blacklist filtering methods are used to filter data packets, then malicious traffic can be blocked, but network response time increases and performance degrades due to large search times
Solution Approach 1:
The patent pre-computes and stores filter values for all possible IP addresses in a lookup table before filtering operations are needed. This preliminary action allows the system to bypass time-consuming search operations during actual packet filtering, directly resolving the contradiction between blocking malicious traffic and maintaining fast response times
Solution Approach 2:
The patent creates a compact representation (copy) of the blacklist data in a specialized lookup table format that enables constant-time access. Instead of storing and searching the full blacklist, the system uses a compressed filter value structure that can be queried in O(1) time, eliminating the search time penalty while maintaining filtering accuracy
2Reliability
If traditional IP blacklist filtering methods are used with large blacklists, then comprehensive malicious site coverage is achieved, but hardware requirements increase
Solution Approach 1:
The patent creates a compressed bitvector representation of the blacklist that dramatically reduces the storage requirements compared to traditional methods. By encoding blacklist membership information in a compact bitmap format with additional filter values, the system achieves comprehensive coverage while minimizing memory and hardware resources needed
Solution Approach 2:
The patent transforms the blacklist data into a different parameter representation format - converting from a list of IP addresses to a structured lookup table with filter values and bitvectors. This parameter transformation enables more efficient storage and access patterns, reducing hardware requirements while maintaining comprehensive malicious site coverage
3Ease of operation
If traditional IP blacklist filtering methods are used, then filtering functionality is provided, but precision is low due to inability to handle constantly changing IP addresses efficiently
Solution Approach 1:
The patent designs the lookup table structure to dynamically adapt to changing blacklist content. New IP addresses can be added to the blacklist by simply updating the corresponding filter values and bitvector entries in constant time, without requiring reprocessing of existing data. This dynamic structure maintains high precision matching while efficiently handling constantly changing IP addresses
Data Source
AI summary
An IP address of a received data packet is determined. An IP address map that stores set membership values indicative of whether an IP address is a member of a set of IP addresses, for every possible IP address within an IP address space of the IP address, is accessed to determine set membership for the IP address of the data packet. A further action to be performed on the packet is determined based on the set membership that is determined for the IP address of the data packet. Embodiments could be applied to source IP address filtering, destination IP address filtering, or both. Blacklist and whitelist embodiments, and associated further actions that could be applied to packets in such embodiments, are contemplated.