IP Library › Granted Patent US 12,563,066
Granted Patent B2
US 12,563,066 · App. 18/285,865 · Granted Feb 24, 2026

Matching device, matching method, and matching program

Inventor: Takuya Watanabe (Musashino, JP)
Assignee: NTT, Inc.
H04L63/1425H04L63/20
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,563,066
App. No.
18/285,865
Granted
Feb 24, 2026
Kind
B2
Abstract

A matching device includes processing circuitry configured to generate, for each IP address range in a list indicating reference IP address ranges, a record indicating a start IP address and a record indicating an end IP address in the IP address range, combine the record indicating a start IP address and the record indicating an end IP address of each of the reference IP address ranges and a record indicating an IP address to be matched, sort a combined record group using an IP address of the record as a primary key and information indicating whether the record is a record of the IP address to be matched, a record indicating the start IP address, or a record of the end IP address as a secondary key, and determine that the IP address to be matched matches an IP address range.

Claims (49)

1 . A matching device comprising:

processing circuitry configured to:

generate, for each reference IP address range in a list indicating reference IP address ranges, a record indicating a start reference IP address and a record indicating an end reference IP address in the reference IP address range;

combine (1) the record indicating the start reference IP address and the record indicating the end reference IP address of each of the reference IP address ranges and (2) a record indicating an IP address to be matched to form a combined record group;

sort records of the combined record group using (1) an IP address of the records as a primary key and (2) indication information of the records as a second key, the indication information indicating which from among the record indicating the IP address to be matched, the record indicating the start reference IP address, and the record indicating the end reference IP address each of the records is;

perform a determination including:

determining that the IP address to be matched matches one of the reference IP address ranges in a case where, in the sorted combined record group, there is the record indicating the IP address to be matched between the record indicating the start reference IP address of the one of the reference IP address ranges and the record indicating the end reference IP address of the one of the reference IP address ranges, and

determining that the IP address to be matched does not match one of the reference IP address ranges in a case where, in the sorted combined record group, there is not the record indicating the IP address to be matched between the record indicating the start reference IP address of the one of the reference IP address ranges and the record indicating the end reference IP address of the one of the reference IP address ranges; and

output a result of the determination.

2 . The matching device according to claim 1 , wherein the processing circuitry is further configured to:

sort the records of the combined record group in ascending order using the IP address of each of the records as the primary key, and

based on the secondary key, sort the records of the combined record group in order of the record indicating the start reference IP address, the record indicating the IP address to be matched, and the record indicating the end reference IP address.

3 . The matching device according to claim 1 , wherein the processing circuitry is further configured to, when determining that the IP address to be matched matches any one of the reference IP address ranges, output a determination result indicating that there is a possibility that an access from the IP address to be matched is a malicious access.

4 . The matching device according to claim 1 , wherein the processing circuitry is further configured to, when determining that the IP address to be matched matches any one of the reference IP address ranges, output attribute information of each of the reference IP address ranges matching the IP address to be matched.

5 . A matching method executed by a matching device, the matching method comprising:

generating for each reference IP address range in a list indicating reference IP address ranges, a record indicating a start reference IP address and a record indicating an end reference IP address in the reference IP address range;

combining (1) the record indicating the start reference IP address and the record indicating the end reference IP address of each of the reference IP address ranges and (2) a record indicating an IP address to be matched to form a combined record group;

sorting records of the combined record group using (1) an IP address of the records as a primary key and (2) indication information of the records as a second key, the indication information indicating which from among the record indicating the IP address to be matched, the record indicating the start reference IP address, and the record indicating the end reference IP address each of the records is;

performing a determination including:

determining that the IP address to be matched matches one of the reference IP address ranges in a case where, in the sorted combined record group, there is the record indicating the IP address to be matched between the record indicating the start reference IP address of the one of the reference IP address ranges and the record indicating the end reference IP address of the one of the reference IP address ranges, and

determining that the IP address to be matched does not match one of the reference IP address ranges in a case where, in the sorted combined record group, there is not the record indicating the IP address to be matched between the record indicating the start reference IP address of the one of the reference IP address ranges and the record indicating the end reference IP address of the one of the reference IP address ranges; and

outputting a result of the determination.

6 . A non-transitory computer-readable recording medium storing therein a matching program that causes a computer to execute a process comprising:

generating for each reference IP address range in a list indicating reference IP address ranges, a record indicating a start reference IP address and a record indicating an end reference IP address in the reference IP address range;

combining (1) the record indicating the start reference IP address and the record indicating the end reference IP address of each of the reference IP address ranges and (2) a record indicating an IP address to be matched to form a combined record group;

sorting records of the combined record group using (1) an IP address of the records as a primary key and (2) indication information of the records as a second key, the indication information indicating which from among the record indicating the IP address to be matched, the record indicating the start reference IP address, and the record indicating the end reference IP address each of the records is;

performing a determination including:

determining that the IP address to be matched matches one of the reference IP address ranges in a case where, in the sorted combined record group, there is the record indicating the IP address to be matched between the record indicating the start reference IP address of the one of the reference IP address ranges and the record indicating the end reference IP address of the one of the reference IP address ranges, and

determining that the IP address to be matched does not match one of the reference IP address ranges in a case where, in the sorted combined record group, there is not the record indicating the IP address to be matched between the record indicating the start reference IP address of the one of the reference IP address ranges and the record indicating the end reference IP address of the one of the reference IP address ranges; and

outputting a result of the determination.

7 . The matching device according to claim 1 , wherein the processing circuitry is further configured to:

when the record indicating the start reference IP address is encountered during processing of the sorted combined record group, set a flag associated with an index of the record indicating the start reference IP address, and

when the record indicating the end reference IP address is encountered during the processing of the sorted combined record group, eliminate a flag associated with an index of the record indicating the end reference IP address.

8 . The matching device according to claim 1 , wherein the list indicating reference IP address ranges includes IP addresses of proxy servers.

9 . The matching device according to claim 1 , wherein the list indicating reference IP address ranges includes malicious IP addresses.

10 . The matching device according to claim 1 , wherein the processing circuitry is further configured to convert the IP address of each of the records of the combined record group to an integer value.

11 . The matching device according to claim 10 , wherein the processing circuitry is further configured to sort the records of the combined record group using the integer values for sorting by the primary key.

12 . The matching device according to claim 1 , wherein the processing circuitry is further configured to use a Timsort algorithm.

13 . The matching device according to claim 1 , wherein the list indicating reference IP address ranges includes multiple nested reference IP address ranges.

14 . The matching device according to claim 1 , wherein the list indicating reference IP address ranges includes multiple reference IP address ranges that partially overlap.

15 . The matching device according to claim 1 , wherein the record indicating an IP address to be matched is acquired from an access log.

16 . The matching device according to claim 1 , wherein

the indication information indicating that a record is the record indicating the start reference IP address is BEGIN,

the indication information indicating that a record is the record indicating the IP address to be matched is TARGET, and

the indication information indicating that a record is the record indicating the end reference IP address is END.

17 . The matching device according to claim 16 , wherein the processing circuitry is configured to sort in the order of BEGIN, then TARGET, then END for records having a same IP address as the primary key.

18 . The matching device according to claim 1 , wherein the processing circuitry is further configured to:

assign a same index to the record indicating the start reference IP address and the record indicating the end reference IP address of each of the reference IP address ranges, and

determine that the IP address to be matched matches the one of the reference IP address ranges when there is the record indicating the IP address to be matched between the record indicating the start reference IP address of the one of the reference IP address ranges and the record indicating the end reference IP address of the one of the reference IP address ranges having the same index.

Assignments (2)
CHANGE OF NAME Recorded Aug 20, 2025
From: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
To: NTT, INC.
Reel/Frame 072556/0180 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 6, 2023
From: WATANABE, TAKUYA
To: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Reel/Frame 065143/0266 →
Continuity (1)
Related Publication 20240187435A1 · Jun 6, 2024
References Cited (7)
US 10771497B1 · Xie · 2020 [cited by examiner]
US 20060197981A1 · Honma · 2006 [cited by examiner]
US 20210218655A1 · Zheng · 2021 [cited by examiner]
US 20240007436A1 · Waters · 2024 [cited by examiner]
Yazdani et al., “Fast and Scalable schemes for the IP address Lookup Problem”, High Performance Switching and Routing, 2000, pp. 83-92. [cited by applicant]
Yim et al., “Efficient Binary Search for IP Address Lookup”, IEEE Communications Letters, vol. 9, Issue: 7, Jul. 2005, pp. 652-654. [cited by applicant]
Mun et al., “New Approach for Efficient IP Address Lookup Using a Bloom Filter in Trie-Based Algorithms”, IEEE Transactions on Computers, vol. 65, Issue: 5, May 2016, pp. 1558-1565. [cited by applicant]