Parameterized bloom filters

• US 5,701,464 A
• Filed: 09/15/1995
• Issued: 12/23/1997
• Est. Priority Date: 09/15/1995
• Status: Expired due to Term

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Aucsmith, David W.
• Primary Examiner(s): Black, Thomas G.
• Assistant Examiner(s): Choules, Jack M.
• Application Number:
  US08/528,912
• Time in Patent Office: 830 Days
• Field of Search: 395/601, 395/602, 395/603, 395/606, 395/610
• US Class Current: 1/1
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing

Abstract

A method and apparatus for determining validity of a key. A bloom filter is updated in a first computer system (e.g. a client system) at periodic intervals by providing the system'"'"'s requirements of the bloom filter to a second computer system (e.g. a server system). These requirements may include: a number of bits which are included in the bloom vectors; a number of the coefficients for hash functions of the bloom filter; or an error value indicating the possibility of error of the bloom filter. The second computer system has access to an invalidity database which includes all invalid keys and can generate a matrix of bloom vectors and coefficients for different client requirements. Responsive to the provision of the first system'"'"'s requirements, it receives bloom vectors and coefficients which comprise the bloom filter. The system can then accept a key and apply the bloom filter to the key to determine if the key is present in the invalidity database. Invalidity of the key can be confirmed if the bloom filter indicates that the key is present in the invalidity database by transmitting the key to the second computer system to determine the presence of the key in the invalidity database. In this way, communications bandwidth is conserved because no communication between the first computer system and the second computer system need take place if the bloom filter indicates that the key is not present in the invalidity database.

Claims

1. A method in a first computer system of determining validity of a key comprising:

a. updating a bloom filter at periodic intervals by;

i. providing said first computer system'"'"'s requirements of said bloom filter to a second computer system, said second computer system having access to an invalidity database which includes all invalid keys; and

ii. receiving bloom vectors and coefficients which comprise said bloom filter from said second computer system;

b. accepting said key; and

c. applying said bloom filter to said key to determine if said key is present in said invalidity database.

2. The method of claim 1 further comprising the step of confirming invalidity of said key if said bloom filter indicates that said key is present in said invalidity database by transmitting said key to said second computer system to determine the presence of said key in said invalidity database and receiving a result signal from said second computer system indicating whether said key is present in said invalidity database.

3. The method of claim 1 wherein said step of updating said bloom filter further includes the step of receiving a prime key associated with said bloom vectors and said coefficients.

4. The method of claim 1 wherein said step of applying said bloom filter includes hashing said key with said coefficients and said prime key to generate a test value and comparing said test value with said bloom vectors.

5. The method of claim 1 wherein said step of providing said first computer system'"'"'s requirements includes providing a number of bits which are included in said bloom vectors.

6. The method of claim 1 wherein said step of providing said first computer system'"'"'s requirements includes providing a number of said coefficients.

7. The method of claim 1 wherein said step of providing said first computer system'"'"'s requirements includes providing an error value indicating the possibility of error of said bloom filter.

8. An apparatus in a first computer system for determining validity of a key comprising:

a. a first circuit for updating a bloom filter at periodic intervals by;

i. providing said first computer system'"'"'s requirements of said bloom filter to a second computer system, said second computer system having access to an invalidity database which includes all invalid keys; and

ii. receiving bloom vectors and coefficients which comprise said bloom filter from said second computer system;

b. a second circuit for accepting said key; and

c. a third circuit for applying said bloom filter to said key to determine if said key is present in said invalidity database.

9. The apparatus of claim 8 further comprising a fourth circuit for confirming invalidity of said key if said bloom filter indicates that said key is present in said invalidity database by transmitting said key to said second computer system to determine the presence of said key in said invalidity database and receiving a result signal from said second computer system indicating whether said key is present in said invalidity database.

10. The apparatus of claim 8 wherein said updating said bloom filter further includes the step of receiving a prime key associated with said bloom vectors and said coefficients.

11. The apparatus of claim 8 wherein said applying of said bloom filter includes hashing said key with said coefficients and said prime key to generate a test value and comparing said test value with said bloom vectors.

12. The apparatus of claim 8 wherein said providing of said first computer system'"'"'s requirements includes providing a number of bits which are included in said bloom vectors.

13. The apparatus of claim 8 wherein said providing of said first computer system'"'"'s requirements includes providing a number of said coefficients.

14. The apparatus of claim 8 wherein said providing of said first computer system'"'"'s requirements includes providing an error value indicating the possibility of error of said bloom filter.

15. A method in a client of determining database membership of a key stored in a server comprising the following steps:

a. accepting said key;

b. determining whether a bloom filter stored in said client is current, and if not, performing the following steps;

i. providing parameters of said bloom filter to said server according to requirements of said client and requesting said bloom filter from said server;

ii. receiving a bloom vector which comprises said bloom filter; and

iii. receiving coefficients which comprise said bloom filter;

c. determining whether said bloom filter of said key matches said bloom vector;

d. if said bloom filter of said key does not match said bloom vector then indicating that said key is not a member of said database.

16. The method of claim 15 wherein said parameters include a number of bits in said bloom vector.

17. The method of claim 15 wherein said parameters include a number of coefficients which comprise said bloom filter.

18. The method of claim 15 wherein said parameters include a value indicating the likelihood that said bloom filter will falsely indicate that said key is a member of said database.

19. The method of claim 15 wherein said step of determining whether said bloom filter of said key matches said bloom vector includes hashing said coefficients comprising said bloom filter with said key, and determining whether a result of said hash equals said bloom vector.

20. The method of claim 15 further comprising the step of requesting that said server perform a lookup in said database to determine if said key is a member in the event that said bloom filter of said key matches said bloom vector.

21. The method of claim 15 where said step of providing parameters of said bloom filter to said server includes receiving from said server a range of parameters which said server can provide, and responsive thereto, said client providing certain of said parameters to said server.

22. A validity detection system comprising:

a. a key input circuit for accepting a key;

b. a bloom filter coupled to said key input circuit for determining validity of said key, said bloom filter generating a valid signal if said key is not present in an invalidity database, said bloom filter generating an invalid signal if said key may be present in said invalidity database;

c. a key invalidity confirmation circuit coupled to said bloom filter for confirming invalidity of said key if said bloom filter generates said invalid signal, said key invalidity confirmation circuit including;

i. a key transmission circuit for transmitting said key to a server having said invalidity database;

ii. a reception circuit for receiving a result signal indicating whether said key is present in said invalidity database;

d. a bloom filter update circuit coupled to said bloom filter which is operative at periodic intervals for updating said bloom filter, said bloom filter update circuit including;

i. a parameter provision circuit for providing client requirements of said bloom filter to said server;

ii. a bloom vector reception circuit for receiving bloom vectors which comprise said bloom filter;

iii. a coefficient reception circuit for receiving coefficients which comprise said bloom filter; and

iv. a bloom filter request circuit for requesting said bloom vectors and said coefficients from said server according to said client requirements.

23. The apparatus of claim 22 wherein said server includes:

a. said invalidity database which includes all invalid keys for said invalidity detection system;

b. a bloom vector calculation circuit for calculating said bloom vectors and said coefficients according to different values of said parameters;

c. a bloom filter matrix for storing said bloom vectors and said coefficients arranged in said matrix by said parameters; and

d. a bloom filter provision circuit for accessing said coefficients and said bloom vectors in said bloom filter matrix by client-specified parameters, and responsive thereto, providing said coefficients and said bloom vectors to said client.

24. The apparatus of claim 22 further comprising:

a. a current filter detection circuit for determining whether said bloom filter is current; and

b. an activation circuit for activating said bloom filter request circuit responsive to said current filter detection circuit for determining that said bloom filter is not current.

25. The apparatus of claim 22 wherein said bloom filter includes:

a. a hash computation circuit for hashing said key with said coefficients in order to determine a test value; and

b. a bloom vector determination circuit coupled to said hash computation circuit for comparing said test value against said bloom vectors; and

c. an invalid signal generation circuit coupled to said bloom vector determination circuit for activation of said invalid signal if said test value equals a first bloom vector of said bloom vectors.

26. The apparatus of claim 25 wherein said hash computation circuit includes:

a. a product circuit for multiplying said key and a first coefficient of said coefficients to produce a product; and

b. a modulo circuit coupled to said product circuit for performing a modulo of said product and a key coefficient in order to produce said test value.