Methods used to protect privacy

Abstract

A method includes: receiving a data item at each of a plurality of client devices, receiving a public key from a second computing system, encrypting the data item by using the public key to produce a single encrypted data item, engaging in an oblivious pseudo-random function protocol with a first computing system by using the single encrypted data item to generate a seed, generating an encrypted secret share by using a threshold secret sharing function under which the encrypted secret share cannot be decrypted until a threshold number of encrypted secret shares associated with the same single encrypted data item are received, and transmitting the encrypted secret share to the first computing system, and receiving a plurality of encrypted secret shares from a plurality of client devices at the first computing system, processing the plurality of encrypted secret shares to produce processed data, and transmitting the processed data to the second computing system.

Description

[0001] Cross-references to related patent applications

[0002] This application claims the benefit of and priority to U.S. Provisional Patent Application No. 62 / 830,266, filed on April 5, 2019, the entire disclosure of which is incorporated herein by reference. Background Art

[0003] Being able to determine aggregate information about data from client devices, such as how many devices interacted with a particular content item, can be helpful to an analytics system. However, there is often an interest in maintaining the privacy of personally identifiable information. For example, an entity may be interested in receiving information about how many devices a particular type of content reached, or how many devices interacted with the content in a particular way without receiving information that might identify the source of the information, such as an identifier associated with the device. Summary of the invention

[0004] One embodiment of the present disclosure is directed to a method, the method comprising: receiving a data item at each of a plurality of client devices, receiving a public key from a second computing system, encrypting the data item using the public key to produce a single encrypted data item, engaging in an oblivious pseudo-random function protocol with a first computing system using the single encrypted data item to produce a seed, generating an encrypted secret share using the seed and the single encrypted data item by utilizing a threshold secret sharing function, under which the encrypted secret share cannot be decrypted until a threshold number of encrypted secret shares associated with the same single encrypted data item are received, and transmitting the encrypted secret share to the first computing system. Another embodiment is directed to a method, the method comprising: receiving a plurality of encrypted secret shares from the plurality of client devices at the first computing system, processing the plurality of encrypted secret shares to produce processed data, and transmitting the processed data to a second computing system. The plurality of encrypted secret shares may be generated by a plurality of client devices according to the above embodiments and / or according to other techniques described herein. Another embodiment relates to a method, comprising: decrypting processed data at the second computing system to produce decrypted processed data, and generating a count of the plurality of secret shares that share a first characteristic by using the decrypted processed data without accessing personally identifiable information associated with the plurality of client devices. The processed data can be generated by the second computing system according to the above embodiments and / or according to other techniques described herein.

[0005] In some embodiments, the first computing system is further configured to shuffle the plurality of encrypted secret shares prior to processing the plurality of encrypted secret shares. In some embodiments, participating in the oblivious pseudo-random function protocol to generate the seed comprises using the single encrypted data item and a population identifier, wherein the population identifier is associated with two or more of the plurality of client devices. In some embodiments, the first computing system is part of the second computing system. In some embodiments, the first computing system resides within a protected environment of the second computing system, the protected environment preventing the second computing system from accessing the first computing system.

[0006] In some embodiments, each of the plurality of client devices participates in the oblivious pseudo-random function protocol with a third computing system by using the single encrypted data item to generate the seed. In some embodiments, the second computing system processes the plurality of encrypted secret shares to generate the processed data. In some embodiments, the plurality of client devices communicate with the first computing system by using a secure network, wherein the secure network is an onion network. In some embodiments, participating in the oblivious pseudo-random function protocol to generate the seed includes: using the single encrypted data item and a private identifier, wherein the private identifier uniquely identifies a client device among the plurality of client devices. In some embodiments, the first computing system is a distributed computing system.

[0007] Another embodiment of the present disclosure relates to one or more computing devices, including one or more memories having instructions stored thereon, and one or more processors, the processors being configured to execute the instructions to perform the methods of the embodiments set forth above or described herein. For example, another embodiment relates to a first computing system, the first computing system comprising: a memory having instructions stored thereon, and a processor, the processor being configured to execute the instructions to participate in an oblivious pseudo-random function protocol with a plurality of client devices by using a plurality of data items to generate a plurality of seeds, receive a plurality of encrypted secret shares and a plurality of verification shares from the plurality of client devices, authenticate the plurality of encrypted secret shares by using the plurality of verification shares, process the plurality of encrypted secret shares to generate processed data, and transmit the processed data to a second computing system.

[0008] In some embodiments, the first computing system is further configured to shuffle the plurality of encrypted secret shares prior to processing. In some embodiments, participating in the oblivious pseudo-random function protocol to generate the seed comprises encoding a population identifier into the seed, wherein the population identifier is associated with two or more of the plurality of client devices. In some embodiments, the first computing system is part of a second computing system. In some embodiments, the first computing system resides within a protected environment of the second computing system, the protected environment preventing the second computing system from accessing the first computing system. In some embodiments, the first computing system communicates with the plurality of client devices using a secure network, wherein the secure network is an onion network.

[0009] In some embodiments, participating in the oblivious pseudo-random function protocol to generate the seed includes: using a private identifier, wherein the private identifier uniquely identifies a client device among the plurality of client devices. In some embodiments, the first computing system is a distributed computing system. In some embodiments, processing the plurality of encrypted secret shares to generate the processed data includes: decrypting the encrypted secret shares by using a threshold encryption function protocol. In some embodiments, the first computing system further includes an application programming interface (API), wherein the first computing system transmits the processed data to the second computing system in response to an API query from the second computing system.

[0010] The various aspects and embodiments may be combined where appropriate. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 is a diagram showing various entities interacting over a network in accordance with an illustrative embodiment.

[0012] Figure 2 is a diagram illustrating data transmission and correlation using an encoded shuffle analysis (ESA) architecture according to an embodiment.

[0013] Figure 3 is a diagram showing the generation of a Figure 2 Flowchart of the method of interacting with data of the ESA architecture.

[0014] Figure 4 is a diagram showing the generation of a Figure 2 A flowchart of another method of interacting data with an ESA architecture.

[0015] Figure 5 is a diagram showing a method including a secret sharing scheme according to an illustrative embodiment Figure 2 Diagram of the ESA architecture.

[0016] Figure 6 is a diagram showing a method according to an illustrative embodiment. Figure 5 Flowchart of a secret sharing method of a secret sharing scheme.

[0017] Fig. 6A is a diagram showing an exemplary embodiment of the present invention. Figure 6 A flow chart of a method for generating a secret share by a secret sharing method.

[0018] Figure 7 is a diagram showing a method according to an illustrative embodiment. Figure 6 Graph of the threshold secret sharing polynomial for the secret sharing method.

[0019] Figure 8 is a diagram showing a method including a deterministic seed according to an illustrative embodiment. Figure 5 Graph of the secret sharing scheme.

[0020] Fig. 9 is a diagram showing a method of using a Figure 8 Flowchart of a method for generating a secret share using a deterministic seed for a secret sharing scheme.

[0021] Fig. 9A is a diagram showing a method of using a Figure 8 Flowchart of a method for generating a verifiable secret share using a deterministic seed for a secret sharing scheme.

[0022] Fig.10 FIG. 1 is a diagram showing a system including a third data processing system according to an illustrative embodiment. Figure 8 Graph of the secret sharing scheme.

[0023] Fig.11 is a diagram illustrating secure transmission and correlation of interactive data according to an illustrative embodiment.

[0024] Fig.12 is a diagram showing a method according to an illustrative embodiment. Fig.11 Flowchart of a system for secure transmission of interactive data and related methods.

[0025] Fig.13 is a diagram showing the use of a verifiable secret sharing scheme according to an illustrative embodiment. Fig.12 Flowchart of the method.

[0026] Fig.14 FIG. 1 is a diagram showing a method for verifying a verifiable secret share according to an illustrative embodiment. Fig.12 Flowchart of the method.

[0027] Fig.15FIG. 1 is a diagram showing a system including multiple data processing systems according to an illustrative embodiment. Figure 8 Graph of the secret sharing scheme.

[0028] Fig.16 is a flowchart of a process for protecting user privacy in accordance with an illustrative implementation.

[0029] Fig.17 is a flowchart of another process for protecting user privacy in accordance with an illustrative embodiment.

[0030] Fig.18 is a block diagram of a computing system in accordance with an illustrative embodiment. DETAILED DESCRIPTION

[0031] The following is a more detailed description of various concepts and implementations thereof related to methods, devices, and systems for relating online interactions to offline actions in a privacy-aware manner. As the described concepts are not limited to any particular implementation, the various concepts introduced above and discussed in more detail below may be implemented in any of a variety of ways.

[0032] In many domains, it may be necessary or desirable to determine aggregate measures of predefined actions or interactions with software or content by users. For example, in the field of digital therapeutics (healthcare interventions driven by software programs to prevent, manage, or treat medical disorders or diseases), it is often desirable to determine intervention compliance (i.e., the number of patients who successfully engage in the prescribed actions). In other domains, it may be desirable for providers of third-party content to determine the rate of interaction with that third-party content.

[0033] The systems and methods of the present disclosure generally relate to supplying information about online interactions related to online content generated by the content providers in a secure manner to content providers. More specifically, the systems and methods of the present disclosure relate to unique cryptographic and computer architecture methods for correlating data from different entities in a more secure manner. Typically, correlating data from different entities requires a computing system to access user-specific data. To avoid leaking personally identifiable information ("PII"), the identity of the user must be hidden and appropriately protected when reporting the data.

[0034] It is desirable to conduct certain analytical activities in a manner that protects PII from exposure. Therefore, there is a need for unique cryptographic and computer architecture methods to correlate data from different entities in a more secure manner. Aspects of the present disclosure provide improved cryptographic methods and computer architecture. The cryptographic methods and architecture can be used to correlate users' online interactions in a secure manner by providing increased security and also protecting user privacy.

[0035] In order to ensure the privacy and security of PII, the systems and methods of the present disclosure anonymize data to prevent entities (e.g., content providers, third parties, etc.) from receiving PII. Non-limiting example implementations are as follows: A second data processing system can generate a public key for asymmetric encryption. The client device can use the public key to encrypt the interaction data. The client device can participate in an oblivious pseudo-random function (OPRF) protocol with the first data processing system by using the encrypted interaction data to generate a seed. The client device can threshold encrypt the encrypted interaction data to generate a secret share. The first data processing system can receive multiple secret shares from multiple client devices. Once a threshold number of secret shares is received, the first data processing system can decrypt the secret share to restore the encrypted interaction data. The first data processing system can send the encrypted interaction data to the second data processing system, which can decrypt the encrypted interaction data by using a private key corresponding to the public key. Therefore, the second data processing system can facilitate the correlation of interaction data without revealing PII.

[0036] For example, an application (e.g., a web browser) on a computing device such as a personal computer, a smart mobile phone, or a tablet computer can navigate to a web page (or other online document) maintained by a content publisher. A content publisher can include content items generated by a content provider. A computing device can identify (i) an interaction with a content item, and / or (ii) an interaction with a content provider as a result of an interaction with a content item. The interaction can be associated with an identifier. The computing device can securely transmit an identifier and / or additional information about the validity of the online content when generating the interaction to a first data processing system (e.g., a privacy agent). The first data processing system can anonymize the information and transmit it to a second data processing system. The second data processing system can provide more detailed information about the interaction, including whether a purchase occurred, what item was purchased (if any), and the price of the item.

[0037] Now refer to Figure 1, a system 100 for securely correlating data from different entities is shown according to an illustrative embodiment. The system 100 includes a client device 10, a content publisher device 20, a content provider device 30, a first data processing system 300, and a second data processing system 400. In various embodiments, the components of the system 100 communicate via a network 60. The network 60 may include a computer network such as the Internet, a local area network, a wide area network, a metropolitan area network or other regional network, an intranet, a satellite network, other computer networks such as voice or data mobile phone communication networks, and combinations thereof, or any other type of electronic communication network. The network 60 may include or constitute a display network (e.g., a subset of available information resources on the Internet that are associated with content placement or search engine result systems, or that are eligible to include third-party content items as part of content item placement activities). In various embodiments, the network 60 facilitates secure communications between the components of the system 100. As non-limiting examples, the network 60 may implement transport layer security (TLS), secure socket layer (SSL), hypertext transfer protocol security (HTTPS), and / or any other secure communication protocol.

[0038] The client device 10 may be a personal computer, a mobile computing device, a smart phone, a tablet computer, or any other device to facilitate receiving, displaying, and interacting with online content (e.g., a web page). The client device 10 may include an application 200 for receiving and displaying online content and receiving user interactions with the online content. For example, the application 200 may be a web browser.

[0039] In various embodiments, the application 200 interacts with the content publisher device 20 and the content provider device 30 to receive online content. For example, the application 200 can receive information resources 22 from the content publisher device 20. In various embodiments, the content publisher device 20 is associated with the content publisher. The information resource 22 can be a web-based content item, such as a web page or other online document. The information resource 22 can include instructions (e.g., scripts, executable codes, etc.) that, when interpreted by the application 200, cause the application 200 to display a graphical user interface such as an interactive web page to the user. In various embodiments, the information resource 22 includes one or more content requesters 24. The content requester 24 can facilitate the inclusion of content other than the content provided by the content publisher device 20. For example, an online document can include a slot configured to display a marketing project (e.g., an advertisement). The content requester 24 can include the location of the requested content. In some embodiments, the content requester 24 is dynamic. For example, the content requester 24 can interact with one or more third parties to determine what content to include. As a specific example, the information resource 22 including the content requester 24 can be displayed on a mobile device. Content requester 24 may therefore request content that is specific to a mobile device (eg, having a different size, etc.).

[0040] The content provider device 30 can host content items 32. In various embodiments, the content provider device 30 is associated with a content provider. The content provider device 30 can be or include a third-party computing system. For example, the content provider device 30 can be a server associated with a retailer. The content item 32 can be a marketing project (e.g., an advertisement) associated with a third party. Additionally or alternatively, the content item 32 can include other content that will be configured to be included in the information resource 22. For example, the first content item 32 can be a "share button" configured to link to a social media platform, and the second content item 32 can be an RSS news feed configured to display news headlines.

[0041] The content item 32 may include an identifier 34. In various embodiments, the identifier 34 uniquely identifies each content item 32. In some embodiments, the identifier 34 is associated with a marketing campaign. For example, a user interested in sporting activities may receive content items 32 associated with sporting goods, and each content item 32 may share an identifier 34. In some embodiments, the application 200 stores the identifier 34 associated with the received information resource 22. Figures 2 to 4 The partitioning of identifier 34 is described in detail.

[0042] The application 200 is shown to include a private ID circuit 210, a group ID circuit 220, a content interaction circuit 230, and an encoding circuit 240. The private ID circuit 210 can facilitate the generation of a private ID. The private ID can uniquely identify a client device 10. Additionally or alternatively, the private ID can uniquely identify a user associated with the client device 10. As a specific example, a user can have a first client device 10 and a second client device 10. The first client device 10 and the second client device 10 can each have an application 200 installed thereon (e.g., the first client device 10 has a first installation of the application 200, and the second client device 10 has a second installation of the application 200). The private ID circuit 210 can generate a private ID for the first and second client devices 10. The private ID can be the same for both the first and second client devices 10, thereby uniquely identifying the user and the first and second client devices 10 as the client devices 10 of the user. In some embodiments, the interaction data shared by the client devices 10 includes a private ID. In various embodiments, the private ID circuit 210 interacts with one or more external systems / components to generate a private ID.

[0043] The group ID circuit 220 can facilitate the generation of a group ID. The group ID can uniquely identify a group of client devices 10. For example, the group ID can group client devices 10 by software version, device type, device configuration, or any other factor. Additionally or alternatively, the group ID can uniquely identify a user group. For example, the group ID can group users by geographic location, demographic information, interests, or any other factor. In some embodiments, the group ID circuit 220 can facilitate the generation of multiple group IDs. For example, the group ID circuit 220 can facilitate the generation of a first group ID for indicating that a user is in the Midwest, a second group ID for indicating that the user's client device 10 is a smart phone, and a third group ID for indicating that the user is over 18 years old. In some embodiments, the interactive data shared by the client device 10 includes one or more group IDs. In various embodiments, the group ID circuit 220 interacts with one or more external systems / components to generate a private ID.

[0044] The content interaction circuit 230 is configured to examine the user's interaction with the information resource 22 and / or the content item 32 and generate interaction data. For example, the application 200 may display a web page having a third-party content item 32 associated with an identifier 34 to the user. The content interaction circuit 230 may store the identifier 34. The user may then (e.g., using the application 200) visit different web pages associated with the third party and purchase the item. In response, the content interaction circuit 230 may generate interaction data. The interaction data may include the identifier 34 and / or information related to the purchased item. In various embodiments, the content interaction circuit 230 includes a private ID and / or one or more group IDs in the interaction data. The systems and methods of the present disclosure relate to the secure transmission of interaction data. For example, the application 200 may securely transmit the interaction data to the second data processing system 400 without revealing the source of the interaction data. Refer to the following Figures 2 to 4 Describe the content interaction circuit in detail.

[0045] The coding circuit 240 is configured to encode the interactive data. For example, the coding circuit 240 can encrypt the interactive data. Additionally or alternatively, the coding circuit 240 can perform various omission functions on the interactive data. For example, the coding circuit 240 can remove identifiers (e.g., IP addresses, etc.), segment the interactive data, add noise, or perform other functions to anonymize the interactive data. The coding circuit 240 may include a hash circuit 242, a first encryption circuit 244, and a second encryption circuit 246.

[0046] The hash circuit 242 may implement one or more hash functions on the input data to generate hash data. The hash circuit 242 may implement any hash function. As non-limiting examples, the hash circuit 242 may implement SHA-2, Scrypt, Balloon, and / or Argon2. In some embodiments, the hash circuit 242 facilitates multiple rounds of hashing. For example, the hash circuit 242 may perform a first SHA-2 hash on the data item to generate a hash data item, and may perform a second Scrypt hash on the hash data item to generate a double hash data item.

[0047] The first encryption circuit 244 can implement one or more encryption functions on the input data to generate encrypted data. In some embodiments, the first encryption circuit 244 implements an asymmetric encryption function. For example, the first encryption circuit 244 can implement the Rivest-Shamir-Adleman (RSA) cryptographic system. In various embodiments, the first encryption circuit 244 interacts with the hash circuit 242 to encrypt the input data. For example, the hash circuit 244 can generate a seed used by the first encryption circuit 244 to encrypt the input data. In some embodiments, the first encryption circuit 244 implements symmetric encryption. Additionally or alternatively, the first encryption circuit 244 can combine multiple encryption functions. For example, the first encryption circuit 244 can encrypt a symmetric encryption key asymmetrically, and then use the symmetric encryption key to symmetrically encrypt the input data.

[0048] The second encryption circuit 246 may implement one or more threshold encryption functions on the input data to generate threshold encrypted data. As non-limiting examples, the second encryption circuit 246 may implement a digital signature algorithm (DSA), an elliptic curve digital signature algorithm (ECDSA), and / or a Shamir secret sharing (SSS) algorithm. The second encryption circuit 246 may interact with one or more external systems to perform threshold encryption. For example, the second encryption circuit 246 may participate in an oblivious pseudo-random function (OPRF) protocol with the first data processing system 300 to generate a seed used by the second encryption circuit 246 to threshold encrypt the input data. Figures 5 to 13 The second encryption circuit 246 is described in detail.

[0049] The first data processing system 300 can facilitate the anonymization of interactive data. In various embodiments, the first data processing system 300 receives interactive data from the client device 10 and performs various functions on the interactive data to obscure the identity or source of the interactive data. In various embodiments, the first data processing system 300 receives data and anonymizes the data to generate different private data. Different private data (e.g., different private data sets) ensure that an observer cannot identify whether data from a specific individual is included in the data set. For example, a computing system can receive data from many individuals and publish aggregate information about the data. If an observer cannot identify whether any individual (e.g., those who provide data and those who do not provide data) provides data for generating the aggregate information, the aggregate information is different private. In various embodiments, the first data processing system 300 is a secure environment so that it does not allow access to non-anonymized data. The first data processing system 300 can be a server, a distributed processing cluster, a cloud processing system, or any other computing device. The first data processing system 300 may include or execute at least one computer program or at least one script. In some embodiments, the first data processing system 300 includes a combination of software and hardware, such as one or more processors configured to execute one or more scripts.

[0050] The first data processing system 300 is shown as including a processing circuit 310 having a processor 320 and a memory 330. The memory 330 may have instructions stored thereon that, when executed by the processor 320, cause the processing circuit 310 to perform various operations described herein. The operations described herein may be implemented using software, hardware, or a combination thereof. The processor 320 may include a microprocessor, an ASIC, an FPGA, etc., or a combination thereof. In many embodiments, the processor 320 may be a multi-core processor or a processor array. The processor 320 may implement or promote a secure environment. For example, the processor 320 may implement software protection extensions (SGX) to define private areas (e.g., secure enclaves) in the memory 330. The memory 330 may include, but is not limited to, electronic, optical, magnetic, or any other storage device capable of providing program instructions to the processor 320. The memory 330 may include a floppy disk, a CD-ROM, a DVD, a magnetic disk, a memory chip, a ROM, a RAM, an EEPROM, an EPROM, a flash memory, an optical medium, or any other suitable memory from which the processor 320 can read instructions. The instructions may include code from any suitable computer programming language, such as, but not limited to, C, C++, C#, Java, JavaScript, Perl, HTML, XML, Python, and Visual Basic.

[0051] The memory 330 may include an OPRF circuit 332, an anti-fraud circuit 334, a decryption circuit 336, and a shuffling circuit 338. The OPRF circuit 332 may implement OPRF. In various embodiments, the OPRF circuit 332 may be used as a random oracle. In some embodiments, the OPRF circuit 332 interacts with the application 200 to generate or facilitate cryptographic primitives. For example, the OPRF circuit 332 may interact with the application 200 to generate a seed used by the encoding circuit 240 to encode the interactive data. Figures 5 to 13 The OPRF circuit 332 is described in detail.

[0052] The fraud prevention circuit 334 can analyze the interaction data to identify and prevent fraudulent data. For example, a malicious user can use the client device 10 to submit forged interaction data, and the fraud prevention circuit 334 can analyze the forged interaction data to identify it as fraudulent data. In some embodiments, the fraud prevention circuit 334 facilitates digital signatures. As a non-limiting example, the fraud prevention circuit 334 can implement or facilitate a verifiable secret share (VSS) algorithm, an aggregate signature algorithm, a Rabin signature algorithm, and / or any other digital signature system. In some embodiments, the fraud prevention circuit 334 facilitates authentication and ensures the integrity of the interaction data. The fraud prevention circuit 334 will be referred to below. Figures 5 to 13 Describe in detail.

[0053] The decryption circuit 336 can receive the encrypted data and decrypt it to produce unencrypted data. In various embodiments, the decryption circuit 336 receives the encrypted data from the client device 10. The decryption circuit 336 can decrypt the threshold encrypted data. The threshold encryption can guarantee a minimum threshold cardinality, thereby ensuring that each data becomes part of a large amount of anonymized data. Additionally or alternatively, the decryption circuit 336 can decrypt symmetrically and / or asymmetrically encrypted data. For example, the decryption circuit 336 can asymmetrically decrypt the first encrypted data using a private key to recover the interactive shared key, and use the shared key to symmetrically decrypt the second encrypted data to recover the interactive data. In various embodiments, the decryption circuit 336 generates an encryption key. The encryption key can be shared with other components of the system 100 (e.g., the first encryption circuit 244, the second encryption circuit 246, etc.). Additionally or alternatively, the decryption circuit 336 can receive and / or include one or more secrets (e.g., keys, codes, etc.) to facilitate the decryption of data from different entities. In some embodiments, the decryption circuit 336 facilitates the robust recovery of adulterated encrypted data. For example, a malicious user may submit a forged or inappropriate secret share by using the client device 10, and the decryption circuitry 336 may use one or more recovery functions to recover the underlying data. As non-limiting examples, the decryption circuitry 336 may implement or facilitate error correction codes (ECC), finite field evaluation techniques, and / or any other recovery operations. In various embodiments, the decryption circuitry 336 interacts with the fraud prevention circuitry 334 to perform the recovery operation.

[0054] The shuffling circuit 338 can receive data and perform various obfuscation functions to generate anonymized data. As a non-limiting example, the shuffling circuit 338 can implement or facilitate the removal of implicit / indirect identifiers (e.g., arrival time, sequence, originating IP address, etc.), perform batch operations, introduce noise and / or perform any other anonymization operations. In various embodiments, the shuffling circuit 338 shuffles (e.g., rearranges, changes its order, etc.) the received data to generate shuffled data. For example, the shuffling circuit 338 can receive first data from a first source and second data from a second source, and the first and second data can be divided into five segments respectively, and the ten segments can be mixed together to generate shuffled data. In some embodiments, the shuffling circuit 338 implements a batch shuffling algorithm.

[0055] The second data processing system 400 can facilitate making data from different entities securely related. In various embodiments, the second data processing system 400 receives anonymized interaction data and generates aggregate information about the anonymized interaction data. Aggregate information can describe multiple or grouped online interactions (e.g., interactions with multiple content items). Additionally or alternatively, aggregate information can describe individual online interactions (e.g., single interactions with a single content item). Aggregate information can include a unique identifier (e.g., identifier 34, etc.). In some embodiments, the identifier identifies a marketing campaign. Additionally or alternatively, the identifier can uniquely identify each online interaction. In some implementations, aggregate information describes one or more interactions associated with content item 34. For example, aggregate information can include the time, date, and / or location of the online interaction. The interaction described by the anonymized interaction data can include viewing the content item (e.g., navigating to a web page where a content item is presented, and / or determining that the item or a portion of the item is presented in the viewport of the device on which the web page is viewed, etc.), selecting / clicking a content item, hovering the mouse over the content item, and / or other interactions with the content item 32. In various embodiments, the second data processing system 400 implements or facilitates cryptographic operations. For example, the second data processing system 400 can generate an asymmetric encryption public key. The second data processing system 400 can be a server, a distributed processing cluster, a cloud processing system, or any other computing device. The second data processing system 400 can include or execute at least one computer program or at least one script. In some embodiments, the second data processing system 400 includes a combination of software and hardware, such as one or more processors configured to execute one or more scripts.

[0056] The second data processing system 400 is shown to include a database 410 and a processing circuit 420. The database 410 can store the received anonymized interaction data. In some embodiments, the database 410 stores the identifier 34. For example, when providing the content item 32 to the client device 10, the content provider device 30 can send the identifier 34 and / or other information associated with the content item 32 to the second data processing system for storage in the database 410. The identifier 34 can be used for the correlation of the anonymized interaction data later. The database 410 may include one or more storage media. The storage medium may include, but is not limited to, magnetic storage, optical storage, flash memory and / or RAM. The second data processing system 400 may implement or promote various APIs to perform database functions (i.e., manage the data stored in the database 410). These APIs may be, but are not limited to, SQL, ODBC, JDBC and / or any other data storage and operation APIs.

[0057] Processing circuit 420 includes processor 430 and memory 440. Memory 440 may have instructions stored thereon, which, when executed by processor 430, cause processing circuit 420 to perform various operations described herein. The operations described herein may be implemented using software, hardware, or a combination thereof. Processor 430 may include a microprocessor, an ASIC, an FPGA, etc., or a combination thereof. In many embodiments, processor 430 may be a multi-core processor or a processor array. Processor 430 may implement or promote a secure environment. For example, processor 430 may implement software protection extensions (SGX) to define private areas (e.g., secure enclaves) in memory 440. Memory 440 may include, but is not limited to, electronic, optical, magnetic storage devices, or any other storage device capable of providing program instructions to processor 430. Memory 440 may include a floppy disk, a CD-ROM, a DVD, a magnetic disk, a memory chip, a ROM, a RAM, an EEPROM, an EPROM, a flash memory, an optical medium, or any other suitable memory from which processor 430 may read instructions. The instructions may include code from any suitable computer programming language, such as, but not limited to, C, C++, C#, Java, JavaScript, Perl, HTML, XML, Python, and Visual Basic.

[0058] The memory 440 may include an analysis circuit 442 and a decryption circuit 444. The analysis circuit 442 may receive the anonymized interaction data and generate aggregate information about the anonymized interaction data. In various embodiments, the analysis circuit 442 performs statistical operations on the received data to generate statistical measurements describing the received data. For example, the analysis circuit 442 may determine an interaction rate associated with a marketing campaign.

[0059] The decryption circuit 444 can receive encrypted data and decrypt it to generate unencrypted data. In various embodiments, the decryption circuit 444 receives encrypted data from the first data processing system 300. The decryption circuit 444 can decrypt asymmetrically encrypted data. Additionally or alternatively, the decryption circuit 444 can decrypt symmetric and / or threshold encrypted data. In various embodiments, the decryption circuit 444 generates an encryption key. The encryption key can be shared with other components of the system 100 (e.g., client device 10, first data processing system 300, etc.). Additionally or alternatively, the decryption circuit 444 can receive and / or include one or more secrets (e.g., keys, codes, etc.) to facilitate the decryption of data from different entities.

[0060] Now refer to Figures 2 to 4, shows an improved computer architecture for securely transmitting data from different entities and relating them according to an illustrative embodiment. In short, a content provider 30 can provide content items 32 to a user via a client device 10. Content items 32 can be specific to a specific user. A user can interact with content items 32. For example, a user showing a video can click on the video. It is desirable to measure user interactions with content items 32. For example, a content provider device 30 providing a video may wish to know how many users have clicked on the video. Additionally or alternatively, a user can interact with other content provided by a content provider device 30 as a result of the user's interaction with the content item 32. For example, a user showing a video can later visit a website maintained by a content provider device 30 to purchase an item highlighted in the video. In some embodiments, the interaction is an online session or is associated with an online session. Therefore, a system is needed to securely and anonymously measure the user's interaction with online content without revealing PII. The novel cryptography and computer architecture as described herein facilitate securely and anonymously measuring the user's interaction with online content without revealing PII.

[0061] For example, Figure 2 The system 110 is used to securely transmit and correlate data from different entities. In various embodiments, the system 110 implements an encoding shuffle analysis (ESA) architecture. The ESA architecture can facilitate anonymization of interactive data. For example, the client device 10 can interact with the content publisher device 20 and / or the content provider device 30 to generate interactive data. The client device 10 can encode the interactive data and securely transmit it to the first data processing system 300 for shuffling. The first data processing system 300 can shuffle the received data (e.g., perform various obfuscation operations on the received data) and securely transmit the shuffled data to the second data processing system 400. The second data processing system 400 can analyze the received data (e.g., perform various correlation operations on the received data) and generate aggregate information without revealing PII.

[0062] At step 502, the client device 10 receives the information resource 22 from the content publisher device 20. In some embodiments, the information resource is a web page. As a specific example, a user using a browser (e.g., application 200, etc.) can navigate to a web page (e.g., information resource 22, etc.) published by a search engine (e.g., content publisher, etc.). Additionally or alternatively, the information resource can be a third-party information resource. As a specific example, a user using a browser (e.g., application 200, etc.) can navigate to a third-party resource on which a content publisher has published a content item generated by a content provider. In various embodiments, the information resource 22 includes a content requester 24. The application 200 can determine the location of the content item 32 associated with the information resource 22 based on the content requester 24. For example, the content requester 24 can include a tag (e.g., URL address, parameterized string, content domain, etc.) for supplying the location of the content item 32. Additionally or alternatively, the content requester 24 can include a tag for indicating a third party to supply the content item 32. For example, the content requester 24 may include a tag for directing the application 200 to extract the content item 34 from the second data processing system 400, which dynamically generates the specific content item 34 based on the input data. At step 504, the application 200 sends a request for the content item 32 specified by the content requester 24 to the content provider device 30. As described above, in some embodiments, the content provider device 30 may be the second data processing system 400 or may be associated with it. At step 506, the content provider device 30 sends the requested content item 32 to the client device 10. In various embodiments, the content item 32 includes an identifier 34. In some embodiments, the content provider device 30 records the identifier 34 and the identifier of the client device 10. For example, the content provider device 30 may record that the identifier "20742280" is sent to the client device "2480802349".

[0063] The application 200 can display the received information resource 22 and / or content item 32. In some embodiments, the application 200 records the identifier 34. A user using the application 200 can interact with online content. For example, the user can interact with the received content item 32. Additionally or alternatively, the user can interact with other online content. For example, the user can interact with the online content associated with the received content item 32 and / or the content provider device 30. As a specific example, the user can receive the video content item 32 and then visit the website maintained by the content provider device 30 that provides the video content item 32 to purchase the product highlighted in the video content item 32. In response to the user interaction with the online content, the application 200 can generate interaction data. In various embodiments, the interaction data includes the identifier 34 of the content item 32 associated with the online content interacted by the user. Additionally or alternatively, the interaction data may include other information. For example, the interaction data may include data associated with the interaction, the client device 10 and / or the online content provider. As a specific example, for interaction data used to describe a purchase, the interaction data may describe a series of actions (eg, clicks) taken by the user that led to the purchase, as well as information about the purchase itself (eg, price, items purchased, etc.).

[0064] In various embodiments, the client device 10 encodes the interaction data. Encoding may include encrypting the interaction data. Additionally or alternatively, other encoding operations may be used. For example, the client device 10 may remove identifiers from the interaction data and / or decompose the interaction data into segments. At step 510, the client device 10 transmits the encoded interaction data to the first data processing system 300. In various embodiments, the client device 10 transmits the encoded interaction data securely. For example, the client device 10 may transmit the encoded interaction data using onion routing to obscure its IP address.

[0065] The first data processing system 300 can receive the encoded interaction data and perform various shuffling operations. For example, the first data processing system 300 can batch process the received encoded interaction data. In some embodiments, the first data processing system 300 implements a minimum threshold cardinality restriction on the received encoded transaction data. For example, the first data processing system 300 can discard data that does not meet the minimum threshold. As a specific example, unless the received encoded transaction data is received from at least one thousand different client devices 10, the first data processing system 300 can discard the received encoded transaction data. Additionally or alternatively, the shuffling operation can include removing implicit identifiers, shuffling (e.g., changing the order of data from different sources, mixing data from different sources, etc.) the received encoded interaction data, or any other anonymization operation.

[0066] At step 512, the first data processing system 300 transmits the shuffled interaction data to the second data processing system 400. The second data processing system 400 can receive the shuffled interaction data and perform various analysis operations to generate aggregate information. For example, the second data processing system 400 can perform statistical analysis to determine statistical measures (e.g., mean, median, mode, standard deviation, variance, etc.) associated with the basic interaction data and / or the basic online interaction. As a specific example, the second data processing system 400 can receive the shuffled interaction data associated with the first content item 32, and can determine the median value of any purchase generated due to the interaction with the first content item 32. It should be understood that although several exemplary embodiments of the analysis performed by the second data processing system 400 are described, any analysis operation is within the scope of the present disclosure. For example, the aggregate information can include the sum of interactions (e.g., transactions, clicks, calls, etc.), the sum of values ​​associated with each interaction (e.g., dollar amounts), and metadata. In various embodiments, the second data processing system 400 can perform decryption operations. For example, the second data processing system 400 may decrypt the interaction data encrypted by the client device 10 during the encoding process.

[0067] Now refer to Figure 3 , a method 500 for generating interaction data according to an embodiment is shown. In short, the application 200 generates interaction data in response to an interaction associated with a user. In various embodiments, the interaction is an online interaction. In various embodiments, the online interaction is associated with one or more content items 32. Additionally or alternatively, the interaction may be an offline interaction. At step 502, the application 200 receives an information resource 22 with a content requester 24 from a content publisher device 20. In various embodiments, the application 200 receives a plurality of information resources 22 and / or a plurality of content requesters 24. At step 504, the application 200 requests a content item 32 from a content provider device 30. In various embodiments, the application 200 requests a plurality of content items 32 from one or more content providers 30 (e.g., a first content item 32 from a first content provider device 30, and a second content item 32 from a second content provider device 30, etc.). In some embodiments, the application 200 interacts with an advertising network to request a content item 32 (e.g., the application 200 may dynamically provide a content item 32, etc.). For example, the content requester 24 may include a first query to the advertising network, and the application 200 may perform the first query to receive a second query to the content provider device 30 , and may perform a second query with the content provider device 30 to receive the content item 32 .

[0068] At step 506, application 200 receives content item 32 from content provider device 30. Application 200 can record identifier 34 associated with received content item 32. Additionally or alternatively, application 200 can record impression. This impression can include identifier 34 and / or address (e.g., URL) of content publisher device 20 and / or content provider device 30. At step 508, application 200 generates content interaction. In various embodiments, application 200 generates content interaction in response to user interaction with online content. For example, application 200 can generate content interaction in response to user watching video content item 32. In various embodiments, application 200 generates content interaction based on one or more rules. For example, application 200 can generate content interaction based on threshold level of user interaction. As a specific example, video content item 32 can be displayed in HTML iframe, and application 200 can require that the pixel of threshold number of described iframe is rendered and visible to described user before generating content interaction. In some implementations, the application 200 generates content interactions in response to user interactions associated with the content provider device 30. For example, a user may interact with a content item 32 associated with the content provider device 30 and then visit a website maintained by the content provider device 30, thereby triggering the application 200 to generate content interactions.

[0069] Content interactions may include content interaction data associated with a client device 10, a content publisher device 20, an information resource 22, a content provider device 30, a content item 32, an online interaction, and / or any other information related to online content interactions. For example, content interaction data may include a list of websites visited by a user before generating a content interaction. In various embodiments, the content interaction data includes an identifier 34. Additionally or alternatively, the content interaction data may include an interaction type. For example, the application 200 may determine and report that a content interaction is a view-through conversion (VTC) or a click-through conversion (CTC). In some embodiments, the application 200 implements an anonymization operation. For example, the application 200 may add noise to the content interaction data. As a specific example, the application 200 may generate random content interactions (e.g., content interactions that have never occurred, etc.) and / or random content interaction data for existing content interactions (e.g., random content interaction data for content interactions that did occur, etc.). Although in Figure 3 Not shown, but in various implementations, the application 200 transmits the content interaction data to the first data processing system 300 .

[0070] Now refer to Figure 4, a method 600 for generating interaction data according to another embodiment is shown. In some embodiments, method 600 is a detailed description of step 508 of method 500. At step 602, a user interacts with a content item 32 associated with a content provider device 30. For example, a user may interact with an advertisement for a toaster when on a social media website. In some embodiments, the interaction with the content item 32 includes viewing the content item 32. Additionally or alternatively, interacting with the content item 32 may include rendering the content item 32 by the application 200. At step 604, the application 200 records a flash event. The flash event may include an identifier 34. Additionally or alternatively, the flash event may include one or more additional identifiers. For example, the flash event may include a URL of a content publisher device 20 and / or a content provider device 30 associated with the content item 32. In some embodiments, the application 200 records the flash event in response to the content item 32 satisfying one or more visibility requirements. In various embodiments, the flash event is stored on the client device 10 by the application 200. In some implementations, the flash event is transmitted to a content provider device 30 associated with the content item 32 .

[0071] At step 606, the user interacts with the content provider device 30 associated with the content item 32. For example, the user may navigate to a website maintained by the content provider device 30. Additionally or alternatively, the user may interact with other online content provided by the content provider device 30. For example, the user may visit a third-party online store and purchase an item associated with the content provider device 30. In various embodiments, the application 200 matches the identifier of the content provider device 30 with the recorded identifier to determine that the user has interacted with the content provider device 30. As a specific example, the application 200 may record the URL of the content provider device 30, and then determine whether the future website that the user navigates to matches the recorded URL. In some embodiments, the content provider device 30 transmits an indication to the application 200 to determine that the user has interacted with the content provider device 30. As a specific example, the content provider device 30 may record the identifier of the client device 10, and then determine whether the identifier of the future website visitor matches the recorded identifier, and transmit an indication to the client device 10 based on the matching of these identifiers.

[0072] At step 608, the application 200 receives an interaction report request. In various embodiments, the application 200 receives the interaction report request from a source associated with the content provider device 30. For example, a website maintained by the content provider device 30 may transmit the interaction report request to the application 200. In various embodiments, the interaction report request is transmitted in response to the user's interaction with the online content. For example, the user may receive the content item 32 and later visit a website associated with the content provider device 30 for providing the content item 32, and the website may determine that the content item 32 provided by the content provider device 30 is provided to the user, and transmit the interaction report request to the client device 10 associated with the user. In various embodiments, the interaction report request includes information associated with the online interaction as described above.

[0073] At step 610, the application 200 transmits the interaction report. In various embodiments, the interaction report includes the identifier 34. The application 200 can transmit the interaction report to the content provider device 30. Additionally or alternatively, the application 200 can transmit the interaction report to other places. For example, the application 200 can transmit the interaction report to the location specified by the interaction report request. In some embodiments, the application 200 transmits the interaction report to the content publisher device 20. In some embodiments, the application 200 implements or facilitates an interface for requesting interaction reports. For example, an external entity can interact with the application 200 using an API. As a specific example, an external entity can query the application 200 to receive the interaction report.

[0074] Now refer to Figure 5-15 , shows an improved computer architecture for securely transmitting and correlating data from different entities using secret sharing according to various embodiments. In short, a secret sharing scheme can be implemented within the ESA architecture of the system 110. For example, the client device 10 can encrypt the interaction data by using the secret sharing scheme and transmit the generated secret share to the first data processing system 300. The first data processing system 300 can receive secret shares from multiple client devices 10 and decrypt the secret shares once a threshold number has been received. Secret shares that have not received the threshold number cannot be accessed (e.g., cannot be decrypted), thereby enforcing a minimum threshold cardinality restriction.

[0075] Now refer to Figure 5, a system 120 for implementing a secret sharing scheme to encrypt interaction data according to an exemplary embodiment is shown. In various embodiments, the secret sharing scheme is a Shamir secret sharing (SSS) algorithm. The SSS algorithm can be seeded. In some embodiments, the client device 10 generates a seed from the interaction data. For example, the client device 10 can perform a hash operation on the interaction data to deterministically generate a seed for the SSS algorithm. In various embodiments, the client device 10 and the first data processing system 300 collaboratively execute the SSS algorithm. For example, the client device 10 can implement an oblivious pseudo-random function (OPRF) using the first data processing system 300 to generate a seed for the SSS algorithm. In some embodiments, the system 120 implements a verifiable secret sharing (VSS) algorithm to encrypt the interaction data. For example, the system 120 can implement the SSS algorithm with homomorphic encryption. As a specific example, the system 120 can implement the Feldman verifiable secret sharing (FVSS) algorithm.

[0076] In various embodiments, the system 120 performs steps 502-506 as described above. At step 702, the second data processing system 400 sends the encryption key to the client device 10. In various embodiments, the encryption key is an asymmetric encryption public key. The client device 10 can asymmetrically encrypt the interaction data by using the received public key. Additionally or alternatively, the client device 10 can encrypt the interaction data by using a secret sharing scheme. In some embodiments, the client device 10 encrypts the asymmetrically encrypted interaction data by using a secret sharing scheme. For example, the client device 10 can first asymmetrically encrypt the interaction data by using the received public key to generate encrypted interaction data, and then encrypt the encrypted interaction data by using a secret sharing scheme to generate a secret share. In various embodiments, the client device 10 generates a tag to identify the secret share. The tag can be used during decryption.

[0077] At step 710, the client device 10 transmits the secret share to the first data processing system 300. In some embodiments, step 710 includes transmitting additional information. For example, the client device 10 may transmit a tag and / or verification data. The first data processing system 300 may receive secret shares from multiple client devices 10. In various embodiments, the first data processing system 300 waits until a threshold number of secret shares have been received before decrypting the secret shares. The first data processing system 300 may decrypt the secret shares to recover the asymmetrically encrypted interactive data. In some embodiments, the secret shares are decrypted in groups. For example, each secret share may be identified by a tag, and secret shares with similar tags may be decrypted together. In various embodiments, the first data processing system 300 may shuffle the asymmetrically encrypted interactive data, as described above.

[0078] At step 718, the first data processing system 300 transmits the shuffled asymmetrically encrypted interaction data to the second data processing system 400. The second data processing system 400 can asymmetrically decrypt the shuffled asymmetrically encrypted interaction data to recover the interaction data. In various embodiments, the second data processing system 400 analyzes the interaction data and generates aggregate information as described above.

[0079] Now refer to Figure 6 , a method 700 for performing secret sharing according to an embodiment is shown. In various embodiments, the system 120 performs the method 700. In various embodiments, the method 700 is implemented as part of the ESA architecture. For example, the encoding and / or shuffling components of the ESA architecture may include the method 700. In some implementations, the method 700 is independent (e.g., implemented separately from the ESA architecture). At step 702, the client device 10 receives a public key from the second data processing system 400. As described above, the public key can be an asymmetric encryption public key corresponding to an asymmetric encryption private key maintained by the second data processing system 400. At step 704, the client device 10 encrypts the data item by using the public key to produce a single encrypted data item. In various embodiments, the data item is the above reference Figure 3-4 At step 706, the client device 10 encrypts the single encrypted data item using a threshold encryption function to generate a secret share. In various embodiments, the threshold encryption function is the SSS algorithm described above. In some embodiments, step 706 is performed collaboratively by the client device 10 and the first data processing system 300.

[0080] At step 708, the client device 10 generates a tag from the single encrypted data item. In various embodiments, the tag identifies the secret share as part of a group. For example, the single encrypted data items encrypted using a threshold encryption function and a first seed may all share a first tag that identifies them as a group, while those data items encrypted using a second seed may all share a second tag. In various embodiments, each group identified by a tag corresponds to an identifier 34. For example, a marketing campaign may include multiple content items 32, each having an identifier 34 that identifies them as part of a marketing campaign. When an online interaction is generated in association with one of the content items 32 of the marketing campaign, the resulting secret share may include a tag that identifies the secret share as part of a group associated with the marketing campaign. At step 710, the client device 10 transmits the secret share and the tag to the first data processing system 300.

[0081] At step 712, the first data processing system 300 receives a plurality of secret shares and a plurality of tags. Each of the plurality of secret shares and tags may be received from a different client device 10. Additionally or alternatively, a single client device 10 may send many secret shares and accompanying tags. At step 714, the first data processing system 300 groups the plurality of secret shares by using the plurality of tags. For example, a first secret share having a first tag indicating a first group may be grouped together with a second secret share having a second tag indicating the first group, while a third secret share having a third tag indicating a second group may be grouped by itself.

[0082] At step 716, for each group, the first data processing system 300 decrypts the multiple secret shares to recover the single encrypted data item. In various embodiments, the first data processing system 300 decrypts the multiple secret shares by using polynomial interpolation. At step 718, the first data processing system 300 transmits the single encrypted data item to the second data processing system 400. In various embodiments, the single encrypted data item lacks PII when transmitted to the second data processing system 400.

[0083] At step 720, the second data processing system 400 receives the single encrypted data item. At step 722, the second data processing system 400 decrypts the single encrypted data by using the private key to recover the data item. In various embodiments, the decryption is an asymmetric decryption. In various embodiments, the private key is an asymmetric encryption private key corresponding to the asymmetric encryption public key above.

[0084] Now refer to Fig. 6A, step 706 of encrypting a single encrypted data item by using a threshold encryption function according to an embodiment is shown in detail. In various embodiments, the single encrypted data item is encrypted by using an SSS algorithm. However, it should be understood that other secret sharing schemes are also possible. In addition, it should be understood that although the client device 10 is described Fig. 6A , but any component of the system 120 may be involved in step 706 .

[0085] In short, the (k, n) SSS algorithm encrypts a secret S (e.g., interaction data) by generating n secret shares such that any subset of the k secret shares is sufficient to recover the secret S. To do this, a polynomial f(x) of order k-1 is constructed. For example, f(x) can take the following form:

[0086] f(x)=a0+a1x+a2x 2 +a3x 3 +…+a k-1 x k-1

[0087] Among them, a1,…,a k-1 is a randomly chosen positive integer such that a i <P, where P is a prime number such that the size of P is greater than the size of S, and where a0=S. f(x) is evaluated at n points to produce n secret shares (i, f(i)), where i is the evaluation point. To recover S, k secret shares (i, f(i)) are combined using polynomial interpolation to recover f(x), where the constant term a0 is the value of the secret S.

[0088] At step 730, the client device 10 generates a digital space. Additionally or alternatively, another component of the system 120 may generate or facilitate the generation of the digital space. For example, the first data processing system 300 may interact cooperatively with the client device 10 to generate the digital space. In some embodiments, the digital space is domain restricted. For example, the digital space may be a finite field F of size P, where P is a prime number such that P is greater than the size of S. In some embodiments, the digital space is randomly generated (e.g., a random digital space that satisfies domain restrictions is selected, etc.). In some embodiments, the digital space is predetermined.

[0089] At step 732, the client device 10 secretly selects polynomial coefficients a1, ..., a from the digital space k-1. In some embodiments, k is predetermined. Additionally or alternatively, k can be determined dynamically. For example, the client device 10 can determine k based on the type of data being encrypted. As a specific example, certain data can use k=10,000,000, while minimally revealing data can use k=100,000. In some embodiments, another component of the system 120 facilitates or implements the selection of polynomial coefficients. For example, the first data processing system 300 can interact cooperatively with the client device 10 to select polynomial coefficients.

[0090] At step 734, the client device 10 constructs a threshold secret sharing polynomial. In various embodiments, step 734 includes constructing f(x). For example, the client device 10 may combine the polynomial coefficients with a single encrypted data item to generate f(x). At step 736, the client device 10 evaluates the threshold secret sharing polynomial f(x) at an evaluation point to generate a secret. In various embodiments, the secret is f(i). In some embodiments, the evaluation point is random. Additionally or alternatively, the system 120 may dynamically determine the evaluation point. For example, each unique client device 10 may use a unique evaluation point determined by utilizing a pseudo-random function. At step 738, the client device 10 combines the secret and the evaluation point into a secret share. In various embodiments, the secret share is a tuple (i, f(i)). The tuple (i=0, f(0)) is not a valid secret share (e.g., the evaluation point is never equal to zero).

[0091] Now refer to Figure 7 , a diagram 800 showing a threshold secret sharing polynomial 806 according to an embodiment. Polynomial 806 may correspond to f(x). Polynomial 806 may exist in a field F defined by x domain 802 and y domain 804. In various embodiments, x domain 802 and / or y domain 804 are domain restricted. For example, x domain 802 and y domain 804 may be finite fields constructed by integers modulo P. As a specific example, x domain 802 and y domain 804 may be finite fields constructed by integers modulo P, where P=2 160 +7. Polynomial 806 may include a plurality of points 810-812. As described above, point 810 may be a secret S. In various embodiments, point 810 is a single encrypted data item. However, other secrets are possible. Point 812 may be the polynomial coefficients described above. During recovery of S, one or more points 812 may be received and combined using polynomial interpolation to recover polynomial 806. It should be appreciated that other recovery operations are possible.

[0092] Now refer to Figure 8, shows a system 130 for implementing a secret sharing scheme according to an embodiment, the secret sharing scheme including a deterministic seed to encrypt the interaction data. In various embodiments, the system 130 performs steps 502-506 as described above. The system 130 can implement the above-mentioned secret sharing scheme by including a deterministic seed. In short, a deterministic seed is a seed that is deterministically generated from source data (e.g., interaction data, etc.) and used as part of a secret sharing scheme.

[0093] Secret sharing schemes that include deterministic seeds provide many benefits over existing systems. In some embodiments, securely transmitting and correlating data includes coarsening the data by adding noise to the data. For example, the system can add random Gaussian noise to user data, intermediate values, or final outputs to make statistical inferences insensitive to user data (e.g., statistical inferences do not reveal PII). However, the addition of noise can cause the standard deviation of the data to increase, requiring a larger sample size to achieve statistically confident results. For example, in the best case, adding noise to user data may increase the magnitude of the standard deviation by the square root of the reported counts. As a specific example, if data from a billion users is analyzed, common signals from even up to one million users may be missed. Therefore, systems that rely on increasing noise are best suited to measuring frequent elements from peaked power-law distributions. However, the unique cryptography and computer architecture methodology described herein can facilitate the secure transmission and correlation of data without requiring a huge sample size while protecting PII. Specifically, the systems and methods described herein can securely transmit and correlate data about uncommon messages (e.g., high minimum entropy messages, etc.) without increasing noise, thereby requiring a smaller sample size than existing systems. Therefore, the systems and methods of the present disclosure can more easily measure low-incidence events. For example, collect analysis on rarely visited websites. In addition, the systems and methods of the present disclosure can promote fine analysis of data while protecting PII. For example, data with specific attributes (e.g., associated with rarely visited websites, etc.) can be marked before being securely transmitted. The marked data can then be analyzed as a group, thereby promoting a higher sensitivity to common signals related to specific attributes compared to the analysis of general data (e.g., a mixture of data with specific attributes and data without specific attributes). For example, a content publisher may want to know what APIs are used by mobile phones when visiting a website maintained by the content publisher. In addition, the website may have a much higher proportion of desktop visitors than mobile phone visitors. Therefore, because the mobile phone data has been eliminated by the desktop data, collecting and analyzing general data (e.g., data including desktop visitors and mobile phone visitors) may miss many APIs used by mobile phone visitors. However, the systems and methods of the present disclosure can mark the desktop data as desktop data and mark the mobile phone data as mobile phone data before securely transmitting and analyzing the data. Therefore, the mobile phone data can be analyzed additionally, thereby retaining statistical information about the usage of mobile phone APIs.

[0094] One embodiment may include a secret sharing scheme that includes a deterministic seed generated by using the interaction data. For example, the deterministic seed may be deterministically generated by using the interaction data, and the deterministic seed may be used as an input to the secret sharing scheme. In various embodiments, the deterministic seed may be generated by inputting the interaction data into a hash function.

[0095] Another embodiment may include a secret sharing scheme including a deterministic seed generated using an OPRF protocol. For example, a deterministic seed may be deterministically generated by using interaction data to participate in a pseudo-random function, and the deterministic seed may be used as an input to the secret sharing scheme. In various embodiments, the client device 10 participates in the OPRF protocol with the first data processing system 300. For example, the client device 10 may hash interaction data and send the hashed interaction data to the first data processing system 300. The first data processing system 300 may hash the received data and send it back to the client device 10 for input to the secret sharing scheme. In some embodiments, the deterministic seed is a master key generated by the first data processing system 300. In some embodiments, the hash function used is a slow hash function. For example, the Scrypt slow hash function may be used to generate the master key.

[0096] Another embodiment may include binding an identifier to the interaction data, and deterministically generating a deterministic seed based on the interaction data and the bound identifier. For example, as described above, a private ID and / or a group ID may be bound to the interaction data. Binding an identifier to the interaction data may facilitate enforcing a minimum threshold cardinality restriction. In various embodiments, the client device 10 determines the identifier and attaches the identifier to the interaction data. The client device 10 may hash the interaction data and the attached identifier to generate a seed that may be used as an input to a secret sharing scheme.

[0097] Another embodiment may include a verifiable secret sharing scheme that includes a deterministic seed generated by using the interaction data. For example, a deterministic seed can be deterministically generated by using the interaction data, and the deterministic seed can be used as an input to the secret sharing scheme. The secret share can then be verified (e.g., authenticated). As a specific example, the client device 10 can participate in an OPRF protocol with the first data processing system 300 to generate a deterministic seed. The client device 10 can use the deterministic seed as an input to the secret sharing scheme to generate a secret share. The first data processing system 300 can verify the secret shares to ensure their authenticity (e.g., they have not been tampered with, etc.).

[0098] Still refer to Figure 8, the client device 10 may generate interaction data. At step 702, the second data processing system 400 may transmit the asymmetric encryption public key to the client device 10. In various embodiments, the client device 10 may asymmetrically encrypt the interaction data using the public key to generate a single encrypted data. In various embodiments, the client device 10 generates a deterministic seed based on the interaction data. For example, the client device 10 may hash the interaction data to generate a deterministic seed. Additionally or alternatively, the client device 10 may interact collaboratively with the first data processing system 300 to generate a deterministic seed (e.g., step 902). For example, the client device 10 may participate in the OPRF protocol with the first data processing system 300 to generate a deterministic seed. The client device 10 may use the deterministic seed as an input to a secret sharing scheme to generate a secret share. Additionally or alternatively, the client device 10 may generate a deterministic seed based on a single encrypted data. In some embodiments, the client device 10 may generate a tag as described above. At step 710, the client device 10 transmits the secret share and / or tag to the first data processing system 300. The first data processing system 300 may perform various anonymization operations as described above to anonymize the received data. In various embodiments, the first data processing system decrypts the plurality of received secret shares by using polynomial interpolation, as described above. In some embodiments, the second data processing system 400 decrypts the plurality of received secret shares instead of the first data processing system 300. At step 718, the first data processing system 300 transmits the unencrypted data to the second data processing system 400, where the unencrypted data may be analyzed to generate aggregate information, as described above. In some embodiments, the first data processing system 300 transmits the plurality of secret shares to the second data processing system 400, and the second data processing system 400 decrypts the plurality of received secret shares.

[0099] Now refer to Fig. 9, a method 900 for implementing a secret sharing scheme to encrypt interaction data by using a deterministic seed according to an embodiment is shown. In various embodiments, the system 130 performs the method 900. In some embodiments, the ESA architecture described above includes the method 900. For example, the encoding and shuffling steps of the ESA architecture may include the method 900. At step 902, the client device 10 participates in a deterministic function to generate a deterministic seed. In various embodiments, the client device 10 uses a single encrypted data item to generate a deterministic seed, as described above. As a non-limiting example, the client device 10 may attach an identifier to a single encrypted data item generated by asymmetrically encrypting the interaction data, and hash the single encrypted data item and the attached identifier to generate a deterministic seed. At step 904, the client device 10 encrypts the single encrypted data item by using a threshold encryption function and a deterministic seed to generate a secret share. At step 906, the client device 10 generates a tag from the single encrypted data item and the deterministic seed. For example, the client device 10 may attach a deterministic seed to a single encrypted data item, and may hash the combination to generate a tag. Additionally or alternatively, the client device 10 may append an identifier (eg, a private ID, a group ID, etc.) to the single encrypted data item, and may hash the combination to produce a tag.

[0100] Now refer to Fig. 9A , shows step 902 of using the VSS algorithm according to an embodiment. In some embodiments, the VSS algorithm is a verifiable threshold signature algorithm. At step 920, the first data processing system 300 generates an intermediate key. The intermediate key can be an RSA public key. For example, the first data processing system 300 can generate a public key (N, e), where N is the product of two prime numbers p1, p2, and e is an RSA exponent. e can be selected so that And, e and The greatest common divisor of is 1, among which, At step 922 , the first data processing system 300 transmits the intermediate key to the client device 10 .

[0101] At step 924, the client device 10 receives the intermediate key. At step 926, the client device 10 calculates an intermediate value by using the intermediate key and the single encrypted data item. The intermediate value may be calculated as:

[0102] ρ=(r*G1(m)) e mod(N)

[0103] Wherein p is the intermediate value, r is a random value, G1() is a hash function, and m is a single encrypted data item. In various embodiments, r is selected from integers modulo N. At step 928, the client device 10 transmits the intermediate value p to the first data processing system 300.

[0104] At step 930, the first data processing system 300 receives the intermediate value p. At step 932, the first data processing system 300 uses the intermediate value p to calculate a test value. The test value may be calculated as:

[0105] γ=ρ d mod(N)

[0106] Where r is the test value and d is the RSA secret exponent. d can be calculated as:

[0107]

[0108] where d is chosen so that and In some implementations, d has a specified length (eg, 2048 bits). At step 934 , the first data processing system 300 transmits the test value r to the client device 10 .

[0109] At step 936, the client device 10 receives the test value r. At step 938, the client device 10 calculates a test seed from the test value r. The test seed may be calculated as:

[0110]

[0111] Wherein, τ is a test seed. At step 940, the client device 10 tests the test seed τ. Testing τ may include calculating If the test seed fails (e.g., τ≠G1(m)), the client device 10 does not set the test seed τ as a deterministic seed (e.g., step 942). If the test seed passes (e.g., τ=G1(m)), the client device 10 sets the test seed τ as a deterministic seed (e.g., step 944). In various embodiments, step 944 includes calculating θ=G2(τ), where θ is the deterministic seed and G2() is a hash function (e.g., the deterministic seed is the result of hashing τ).

[0112] Now refer to Fig.10, showing a system 140 according to an embodiment, the system implements a secret sharing scheme including a deterministic seed to encrypt interactive data by using a third data processing system 302. System 140 may be similar to those described herein (e.g., system 110, system 120, system 130, etc.), but may divide the ESA shuffle operation and deterministic seed generation between the first data processing system 300 and the third data processing system 302. For example, the client device 10 may participate in the OPRF protocol with the third data processing system 302, as described above. The client device 10 may transmit the secret share to the first data processing system 300, and the first data processing system 300 may perform the shuffle operation as described above before transmitting the shuffled data to the second data processing system 400 for analysis. By dividing the ESA shuffle operation and deterministic seed generation between the first data processing system 300 and the third data processing system 302, the system 140 limits the amount of information that each party (e.g., the first data processing system 300, the third data processing system 302) may know about the received data, thereby further protecting the PII. Additionally, the system 140 increases system redundancy and robustness by reducing discrete access to data to protect against malicious parties and / or victim parties (eg, the first data processing system 300 ).

[0113] At step 902, the client device 10 may participate in the OPRF protocol with the third data processing system 302. The third data processing system 302 may share the features of the first data processing system 300 described herein. In various embodiments, the third data processing system 302 is separate from the first data processing system 300 (e.g., neither the third data processing system 302 nor the first data processing system 300 can access each other or data related to each other, etc.). In some embodiments, the third data processing system 302 and the first data processing system 300 exist in the same system as an isolated environment. For example, the third data processing system 302 and the first data processing system 300 may be software protection extension secure enclaves within the memory of a server. The client device 10 may encrypt the interactive data and / or a single encrypted data item by using a seed generated in cooperation with the third data processing system 302 to generate a secret share. At step 710, the client device 710 transmits the secret share to the first data processing system 300. As described above, the first data processing system 300 may decrypt, shuffle, and transmit the received data to the second data processing system 400, which analyzes the transmitted data to generate an aggregate result.

[0114] Now refer to Figure 11-14 , illustrates a non-limiting exemplary embodiment of secure transmission of interactive data using the OPRF protocol and deterministic seeds. In short, Fig.11A system 150 is shown for securely communicating and correlating interaction data using the OPRF protocol and deterministic seeds. The system 150 can be similar to the systems described herein (eg, system 110, system 120, system 130, system 140, etc.). Fig.12 A method 1100 for securely transmitting and correlating interaction data as implemented by the system 150 is shown. Fig.13 A method 1200 for generating a verifiable secret share as implemented by the system 150 is shown. Fig.14 A method 1300 implemented by system 150 for authenticating and decrypting a verifiable secret share is shown.

[0115] Now refer to Figure 11-12 , steps 502-506 may be performed as described in detail above. In various embodiments, the content interaction circuit 230 generates interaction data. In addition, the private ID circuit 210 and / or the group ID circuit 220 may generate one or more private IDs and / or group IDs associated with the interaction data. At step 702, the second data processing system 400 may transmit an asymmetric encryption public key to the client device 10. In various embodiments, the decryption circuit 444 generates an asymmetric encryption public key. At step 704, the client device 10 encrypts the interaction data to generate a single encrypted data item. In various embodiments, the first encryption circuit 244 encrypts the interaction data. Additionally or alternatively, the first encryption circuit 244 and the hash circuit 242 may interact to encrypt the interaction data. For example, the encryption circuit 244 may generate a hash value used during encryption via the hash circuit 242. At step 1102, the client device 10 participates in the OPRF protocol with the first data processing system 300 to generate a deterministic seed. In various embodiments, the second encryption circuit 246 and the OPRF circuit 332 interact to perform the OPRF protocol. At step 1104, the client device 10 encrypts the single encrypted data item by using a deterministic seed to generate a secret share. In various embodiments, the second encryption circuit 246 encrypts the single encrypted data item by using a deterministic seed to generate a secret share. At step 1106, the client device 10 transmits the secret share to the first data processing system 300.

[0116] At step 1108, the first data processing system 300 receives a plurality of secret shares. In various embodiments, the first data processing system 300 receives a plurality of secret shares from a plurality of client devices 10. At step 1110, the first data processing system 300 processes the plurality of secret shares to generate processed data. In various embodiments, the decryption circuit 336 decrypts the plurality of secret shares to generate processed data. In various embodiments, the processed data is a single encrypted data item for which a threshold number of secret shares are received. At step 1112, the first data processing system 300 shuffles the processed data. In various embodiments, the shuffling circuit 338 shuffles the processed data. In various embodiments, the shuffling circuit 338 shuffles the processed data by rearranging the order of the processed data and / or mixing the processed data from different groups. At step 1114, the first data processing system 300 transmits the processed data to the second data processing system 400.

[0117] At step 1116, the second data processing system 400 receives the processed data. At step 1118, the second data processing system 400 decrypts the processed data by using the asymmetric encryption private key corresponding to the asymmetric encryption public key transmitted during step 702 to generate decrypted processed data. In various embodiments, the decryption circuit 444 decrypts the processed data. In various embodiments, the decrypted processed data includes interaction data for which a threshold number of secret shares are received. The decrypted processed data may lack PII. At step 1120, the second data processing system 400 generates aggregate information based on the decrypted processed data. In various embodiments, the analysis circuit 442 performs various analysis operations to generate aggregate information. In various embodiments, the aggregate information includes a count of the number of secret shares sharing the first feature. Additionally or alternatively, the aggregate information may include a sum of interactions (e.g., transactions, clicks, phone calls, etc.), a sum of values ​​associated with each interaction (e.g., dollar amounts), and / or metadata. In some embodiments, the aggregate information may be stored in the database 410.

[0118] Now refer to Fig.13, shows a method 1200 for generating a verifiable secret share as implemented by the system 150 according to an embodiment. At step 1202, the content interaction circuit 230 prepares a data item. In some embodiments, the data item is interaction data as described herein. In various embodiments, the interaction data is an identifier 34. Additionally or alternatively, the interaction data may include other identifiers, such as one or more private IDs generated by the private ID circuit 210, and / or one or more group IDs generated by the group ID circuit 220. In some embodiments, the interaction data includes additional information, such as an interaction type and / or one or more address locations (e.g., a target web page URL, a report URL, etc.). For example, the content interaction circuit 230 may prepare the data item by appending multiple group IDs generated by the group ID circuit 220 to the identifier 34.

[0119] At step 1204, the first encryption circuit 244 encrypts the data item using the asymmetric encryption public key generated by the decryption circuit 444 to produce a single encrypted data item. In various embodiments, the decryption circuit 444 encrypts the data item using the RSA cryptographic system. In various embodiments, the first encryption circuit 244 appends an address location to the single encrypted data item. For example, the first encryption circuit 244 can append a report URL to the single encrypted data item. In some embodiments, the report URL determines where the second data processing system 400 transmits the aggregate information. As a specific example, the content provider device 30 can specify a location via the report URL to receive aggregate information about the effectiveness of a marketing campaign.

[0120] At step 1206, the hash circuit 242 hashes the single encrypted data item to generate a shared key. In various embodiments, the hash circuit 242 hashes the single encrypted data item using a fast hash function such as SpookyHash. At step 1208, the second encryption circuit 246 generates a digital space using the shared key. For example, the digital space can be an integer modulo the shared key. At step 1210, the second encryption circuit 246 generates a threshold secret shared polynomial by using the single encrypted data item and coefficients selected from the digital space. For example, the coefficients can be a1, ..., a k-1 , as mentioned above Fig. 6A described.

[0121] At step 1212, hash circuit 242 hashes the single encrypted data item using the private ID generated by private ID circuit 210 to produce an evaluation point. In various embodiments, hash circuit 242 appends the private ID to the single encrypted data item prior to hashing, thereby making the evaluation point unique to client device 10. In various embodiments, the evaluation point is as described above with reference to Fig. 6A At step 1214, the second encryption circuit 246 evaluates the polynomial at the evaluation point to generate half of the first key. In various embodiments, half of the first key is as described above with reference to Fig. 6A At step 1216, the second encryption circuit 246 combines the half of the first key with the evaluation point to generate an encrypted secret share. In various embodiments, the encrypted secret share is as described above with reference to Fig. 6A At step 1218, the second encryption circuit 246 generates one or more verification shares c0, ..., c based on a shared key. k For example, a validation share could be generated as:

[0122]

[0123] Among them, c i is the coefficient a i At step 1220 , the client device 10 transmits the secret share, one or more verification shares, and the shared key to the first data processing system 300 .

[0124] Now refer to Fig.14 , shows a method 1300 of verifying and decrypting the secret share as implemented by the system 150 according to an embodiment. At step 1302, the fraud prevention circuit 334 verifies the secret share by comparing one or more verification shares with a shared key. Comparing one or more verification shares with a shared key may include calculating:

[0125]

[0126] Wherein t is the number of secret shares received by the first data processing system 300. In various embodiments, t is the number of secret shares corresponding to the group received by the first data processing system 300. For example, each secret share may be labeled with a group ID, and t may be the number of secret shares having the same group ID. If the fraud prevention circuit 334 confirms that The share is then not verified and is determined to be unauthentic (eg, incorrectly calculated, has been tampered with, etc.).

[0127] At step 1304, the decryption circuit 336 reconstructs a threshold secret sharing polynomial based on the received secret shares. For example, secret shares with similar labels (e.g., group IDs, etc.) can be combined by using polynomial interpolation to recover the threshold secret sharing polynomial. At step 1306, the decryption circuit 336 extracts a single encrypted data item from the reconstructed threshold secret sharing polynomial. In various embodiments, the single encrypted data item corresponds to a0 as described above. In various embodiments, the shuffling circuit 338 shuffles the single encrypted data item with other single encrypted data items. For example, the shuffling circuit 338 can mix multiple single encrypted data items from multiple different marketing campaigns. At step 1308, the first data processing system 300 transmits the single encrypted data item to the second data processing system 400.

[0128] Now refer to Fig.15 , a system 160 including a secret sharing scheme for preventing fraud and recovery according to an embodiment is shown. System 160 may be similar to those described herein (e.g., system 110, system 120, system 130, system 140, system 150, etc.). In various embodiments, system 160 includes a plurality of first data processing systems 304. For example, system 160 may include 100 first data processing systems 304. First data processing system 304 may be similar to first data processing system 300. In various embodiments, system 160 operates similarly to system 150 described above. Each of first data processing systems 304 may receive a secret share from client device 10, and decrypt the secret share to recover a single encrypted data item. In various embodiments, each of first data processing systems 304 may compare their respective recovered single encrypted data items. First data processing system 304 may establish a consensus on the true single encrypted data item, and may transmit the true single encrypted data item to second data processing system 400. Advantageously, by comparing individual encrypted data items recovered from many first data processing systems 304, system 160 is robust with respect to individually compromised first data processing systems 300. For example, if a first data processing system 300 improperly recovers an individual encrypted data item from a secret share, and / or if a first data processing system 300 is maliciously compromised, then the aggregate information generated by second data processing system 400 may be illegitimate. However, establishing consensus among many first data processing systems 304 ensures that a majority of first data processing systems 304 would have to improperly recover an individual encrypted data item and / or be maliciously compromised to affect the aggregate information, thereby increasing the robustness of the system and the authenticity of the aggregate information.

[0129] In various embodiments, the system 160 can facilitate other fraud prevention and / or robust recovery techniques. For example, the client device 10 and / or the first data processing system 300 can implement ECC. For example, the second encryption circuit 246 can construct the secret share as a Reed-Solomon code. By using the Reed-Solomon code, the decryption circuit 336 can correct up to an error (e.g., an inappropriately or maliciously generated secret share). Additionally or alternatively, the second encryption circuit 246 and / or the decryption circuit 336 may implement a finite field evaluation. As a specific example, the second encryption circuit 246 may deterministically calculate an evaluation point i such that 1<i<M, where M is a small number such that M≥t. For example, the hash circuit 242 may append a private ID to a group ID and hash the combination to generate i. During decryption and reconstruction of a threshold secret sharing polynomial, the decryption circuit 336 receives secret shares (i, f(i)), many of which have a common evaluation point i (e.g., a subset of the secret shares (i, f(i)) have (i1, f(i1)=s1), (i1, f(i1)=s2), …, (i1, f(i1)=s n ) form). The decryption circuit 336 may select a consensus f(i1) (e.g., f(i1), which is most common among the secret shares) for reconstruction by using polynomial interpolation. Finite field evaluation prevents improper or malicious calculation of the secret share. For example, a malicious client device 10 must compromise The majority of the different evaluation points i are used to suppress the decryption of the secret share.

[0130] Now refer to Fig.16 , shows a process 1600 for protecting user privacy according to an illustrative embodiment. The first data processing system 300 and the second data processing system 400 can be configured to perform the steps of the process 1600. In addition, any one or combination of the computing devices described herein can be configured to perform the process 1600.

[0131] Step 1610 includes: at each client device of the plurality of client devices 10, in response to each interaction with the content item, transmitting an identifier and a random value associated with the content item to a first computing system. The first computing system may be the same or similar to the first data processing system 300 described above. The first computing system stores the identifier and the random value associated with the identifier. The identifier identifies a content identifier associated with the content item.

[0132] Step 1620 includes, at each of the plurality of client devices 10, in response to a conversion action related to the content item, sending a random value to a second computing device. The second computing device may be similar to the second data processing system 400 described above. The client device 10 determines whether an interaction with the content item has occurred before the conversion action. In response to determining that an interaction with the content item has occurred before the conversion action, the client device 10 sends the last generated random value to the second data processing system 400. In response to determining that no previous interaction with the content item has occurred, the client device 10 transmits a different random value to the second data processing system 400.

[0133] Step 1630 includes performing a threshold cardinality protocol between the first data processing system 300 and the second data processing system 400 by using random values ​​transmitted to the first data processing system 300 and the second data processing system 400 by the plurality of client devices 10. In some embodiments, for each content identifier, the first data processing system 300 and the second data processing system 400 run the threshold cardinality protocol. The second data processing system 400 inputs all tokens it has collected. The first data processing system 300 only inputs tokens associated with the content identifier. The first data processing system 300 receives the intersection cardinality only when the intersection cardinality is above a predetermined threshold.

[0134] In some embodiments, a scrambling circuit is used to sort the two input sets from the first data processing system 300 and the second data processing system 400. The scrambling circuit processes a linear scan to count how many items are in the interaction.

[0135] In some embodiments, batching techniques are used to essentially split the two large collections into smaller bins, where equal values ​​are guaranteed to be assigned to corresponding bins. In some embodiments, hashing techniques (e.g., Cuckoo hashing) are used to fill each bin to a smaller size (e.g., logN size). Then, the intersection radix protocol is run on each bin, and arithmetic shares are output to each party (e.g., the first and second computing systems). Each party locally calculates the total number of its shares. Both parties run a two-party protocol that checks whether the total count exceeds a threshold. If the total count is above the threshold, the data item is released to the first computing system. When using cuckoo hashing, PIR-like techniques can be used for each bin.

[0136] Now refer to Fig.17 , shows a process 1700 for protecting user privacy according to an illustrative embodiment. The first data processing system 300 and the second data processing system 400 can be configured to perform the steps of the process 1700. In addition, any one or combination of the computing devices described herein can be configured to perform the process 1700.

[0137] At step 1710, in response to each interaction with one of the plurality of content items, each client device 10 receives from the first computing system a ciphertext used to encrypt a non-zero value at a slot of the ciphertext corresponding to an identifier associated with the content item and zero values ​​in other slots of the ciphertext. In various embodiments, the first computing system is or is similar to the first data processing system 300.

[0138] At step 1720, in response to the conversion action related to the content item, each client device 10 sends a ciphertext to the second computing device. In various embodiments, the second computing device is or is similar to the second data processing system 400. If interaction with the content item has occurred before the conversion action, the ciphertext to be sent is the last received ciphertext. If no previous interaction with the content item has occurred, the ciphertext to be sent will be encrypted with zero values ​​in all slots.

[0139] At step 1730 , the second data processing system 400 homomorphically adds all ciphertexts received from the client device 10 to generate a cumulative ciphertext, and calculates random shares for all of the plurality of content items.

[0140] At step 1740, the second data processing system 400 decrypts the random shares in the multi-slot ciphertext.

[0141] At step 1750, the second data processing system 400 subtracts the cumulative ciphertext from the multi-slot ciphertext and transmits the resulting ciphertext to the first computing system.

[0142] At step 1760 , the first data processing system 300 decrypts the resulting ciphertext to obtain shares from the resulting ciphertext associated with the plurality of content items.

[0143] Step 1770 includes performing a two-way computation between the first data processing system 300 and the second data processing system 400 for each of the plurality of content items to restore the count of conversion actions associated with the content item when the count is above a threshold amount.

[0144] Fig.18A depiction of a computing system 1400 is shown, which can be used, for example, to implement any of the illustrative systems described in the present disclosure (e.g., system 110, system 120, system 130, system 140, system 150, system 160, etc.). Computing system 1400 includes a bus 1405 or other communication component for communicating information, and a processor 1410 coupled to bus 1405 for processing information. Computing system 1400 also includes a main memory 1415, such as a random access memory ("RAM") or other dynamic storage device coupled to bus 1405 for storing information and instructions to be executed by processor 1410. Main memory 1415 can also be used to store location information, temporary variables, or other intermediate information during execution of instructions by processor 1410. Computing system 1400 can further include a read-only memory ("ROM") 1420 or other static storage device coupled to bus 1405 for storing static information and instructions for processor 1410. A storage device 1425 , such as a solid-state device, magnetic disk, or optical disk, is coupled to bus 1405 for persistent storage of information and instructions.

[0145] The computing system 1400 may be coupled to a display 1435, such as a liquid crystal display or an active matrix display, via the bus 1405 for displaying information to a user. An input device 1430, such as a keyboard including alphanumeric and other keys, may be coupled to the bus 1405 for communicating information and command selections to the processor 1410. In another embodiment, the input device 1430 has a touch screen display 1435. The input device 1430 may include a cursor control, such as a mouse, trackball, or cursor direction keys, for communicating direction information and command selections to the processor 1410 and for controlling cursor movement on the display 1435.

[0146] In some implementations, computing system 1400 may include a communications adapter 1440, such as a network adapter. Communications adapter 1440 may be coupled to bus 1405 and may be configured to enable communication with a computing or communications network 1445 and / or other computing systems. In various illustrative implementations, communications adapter 1440 may be used to implement any type of network configuration, such as wired (e.g., via Ethernet), wireless (e.g., via WiFi, Bluetooth, etc.), preconfigured, ad-hoc, LAN, WAN, etc.

[0147] According to various embodiments, the processes to accomplish the illustrative embodiments described herein may be implemented by the computing system 1400 in response to the processor 1410 executing an arrangement of instructions contained in the main memory 1415. These instructions may be read into the main memory 1415 from another computer-readable medium (e.g., the storage device 1425). The execution of the arrangement of instructions contained in the main memory 1415 causes the computing system 1400 to perform the illustrative processes described herein. One or more processors in a multi-processing arrangement may also be employed to execute the instructions contained in the main memory 1415. In alternative embodiments, hard-wired circuitry may be used in place of, or in combination with, software instructions to implement the illustrative embodiments. Thus, the embodiments are not limited to any specific combination of hardware circuitry and software.

[0148] Despite Fig.18 An example processing system has been described in . Other types of digital electronic circuits or computer software, firmware or hardware (including the structures disclosed in this specification and their equivalent structures, or a combination of one or more thereof) may be used to perform the implementation and functional operations of the subject matter described in this specification.

[0149] On the basis of the above description, a control can be provided to the user, which allows the user to make a choice about whether and when the system, program or feature described herein can collect user information (e.g., information about the user's social network, social behavior or activity, occupation, user's preference, or user's current location), and whether the user sends content or communication from the server. In addition, before storing or using certain data, it can be processed in one or more ways to delete personally identifiable information. For example, the identity of the user can be processed so that personally identifiable information cannot be determined for the user, or the user's geographical location (such as city, ZIP code, or state level) can be summarized when obtaining location information so that the user's specific location cannot be determined. Therefore, the user can control what information is collected about the user, how to use the information, and what information is provided to the user. In the case where the system described herein collects personal information about the user or the application installed on the user's device or utilizes personal information, the user is provided with an opportunity to control whether the program or feature collects user information (e.g., information about the user's social network, social behavior or activity, occupation, user's preference, or user's current location). Additionally or alternatively, before storing or using certain data, it can be processed in one or more ways to delete personal information.

[0150] The systems and methods of the present disclosure provide many benefits over existing systems. To avoid revealing PII, and in light of the increased awareness of user privacy, strict privacy guarantees are being developed. For example, differential privacy, a widely accepted standard requires that aggregated interaction metrics do not have to reveal whether information about specific individuals is included when calculating interaction rates. However, current different private aggregate interaction measurement techniques require large data sets and have limited output granularity. Therefore, there is a need for a privacy-preserving method of measuring aggregate interactions that can provide detailed output with a reasonably sized input data set.

[0151] One solution utilizes a third-party assistant. The client browser may derive a seed from the measurement tag by executing the OPRF protocol with the third-party assistant. The client browser may apply two layers of encryption to the measurement tag. The second layer of encryption may be a threshold encryption based on the derived seed. The client browser may batch encrypt the measurement tags and send them to the third-party assistant. The third-party assistant may remove the second layer of encryption by threshold decrypting the encrypted measurement tags. The third-party assistant may shuffle a single encrypted measurement tag and forward it to the analyzer. The analyzer may remove the first layer of encryption and recover the measurement tag.

[0152] In some embodiments, the client browser appends a crowd identifier to the measurement tag. The crowd identifier can enable the system to generate aggregate interaction measurements for unique (and therefore identifiable) measurement tags without requiring a large data set while maintaining strict privacy guarantees. The crowd identifier can describe geographic location, device type, and / or any other category of difference. The crowd identifier can be used to derive seeds via OPRF. Therefore, a third-party assistant can only threshold decrypt unique measurement tags with a threshold number of occurrences. The threshold number of occurrences can ensure strict privacy protection of PII.

[0153] In some embodiments, the content provider generates an interaction token by using a private key. The interaction token can be used to prevent fraud by verifying the legitimacy of the measurement tag. The system can verify the interaction token by using the public key of the content provider. The client browser can only report the measurement tag associated with the verified interaction token. In addition, each measurement tag can only be used once. Therefore, the system prevents fraud based on illegal measurement tags.

[0154] The embodiments of the subject matter and operations described in this specification can be performed by using digital electronic circuits, or in computer software embodied in tangible media, firmware or hardware including the structure disclosed in this specification and its equivalent structure, or a combination of one or more thereof. The embodiments of the subject matter described in this specification can be implemented as one or more computer programs, that is, one or more components of computer program instructions, which are encoded on one or more computer storage media to be executed by a data processing device or control the operation of the data processing device. Alternatively or additionally, program instructions can be encoded on an artificially generated propagation signal (e.g., a machine-generated electrical, optical or electromagnetic signal), which is generated to encode information for transmission to a suitable receiver device for execution by a data processing device. The computer storage medium can be or be included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more thereof. In addition, although the computer storage medium is not a propagation signal, the computer storage medium may include a source or destination of computer program instructions encoded with an artificially generated propagation signal. The computer storage medium may also be one or more separate physical components or media (e.g., multiple CDs, disks or other storage devices) or contained therein. Therefore, computer storage media are tangible and non-transitory.

[0155] The operations described in this specification may be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0156] The term "data processing apparatus" or "computing device" encompasses all types of apparatus, devices and machines for processing data, including, for example, one or more of the aforementioned programmable processors, computers, systems on chips, or combinations thereof. The apparatus may include dedicated logic circuits, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). In addition to hardware, the apparatus may also include code that creates an execution environment for the computer program in question, such as code that constitutes processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or a combination of one or more thereof. The apparatus and execution environment may implement a variety of different computing model infrastructures, such as web services, distributed computing, and grid computing infrastructures.

[0157] A computer program (also referred to as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program may be stored in a portion of a file that stores other programs or data (e.g., one or more scripts stored in a markup language document), a single file dedicated to the program in question, or multiple coordination files (e.g., files storing one or more modules, subroutines, or partial codes). A computer program may be deployed to execute on a computer or multiple computers located at one site or distributed across multiple sites and interconnected by a communication network.

[0158] The processes and logic flows described in this specification may be performed by one or more programmable processors executing one or more computer programs to perform actions by operating on input data and generating outputs. The processes and logic flows may also be performed by dedicated logic circuits, and the apparatus may also be implemented as dedicated logic circuits, such as FPGAs (field programmable gate arrays) or ASICs (application-specific integrated circuits). The circuits utilized herein may be implemented using hardware circuits (e.g., FPGAs, ASICs, etc.), software (instructions stored on one or more computer-readable storage media and executable by one or more processors), or any combination thereof.

[0159] For example, processors suitable for executing computer programs include general and special microprocessors, and any one or more processors of any kind of digital computer. Typically, the processor will receive instructions and data from a read-only memory or a random access memory or both. The basic elements of a computer include a processor for performing actions according to instructions and one or more storage devices for storing instructions and data. Typically, a computer will also include one or more large-capacity storage devices (e.g., magnetic disks, magneto-optical disks, or optical disks) for storing data, or operably coupled to a large-capacity storage device to receive data from it or transmit data to it, or both. However, a computer does not necessarily have such devices. In addition, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), to name a few. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as: semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.

[0160] To provide for interaction with a user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device, such as a CRT (cathode ray tube), plasma, or LCD (liquid crystal display) monitor, for displaying information to the user, and a keyboard and pointing device, such as a mouse and trackball, through which the user can provide input to the computer. Other types of devices can also be used to provide for interaction with a user; for example, feedback provided to the user can include any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. In addition, the computer can interact with the user by sending documents to and receiving documents from a device used by the user; for example, by sending a web page to a web browser on a user's client device in response to a request received from the web browser.

[0161] Implementations of the subject matter described in this specification may be performed in a computing system that includes a back-end component (e.g., as a data server) or includes a middleware component (e.g., an application server) or includes a front-end component (e.g., a client computer with a graphical user interface or a web browser through which a user can interact with implementations of the subject matter described in this specification), or a combination of one or more such back-end, middleware, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include local area networks ("LANs") and wide area networks ("WANs"), internetworks (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks).

[0162] A computing system may include a client and a server. The client and the server are usually remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on respective computers and having a client-server relationship with each other. In some embodiments, the server transmits data (e.g., an HTML page) to a client device (e.g., for the purpose of displaying data to a user interacting with the client device and receiving user input therefrom). Data generated at the client device (e.g., the result of a user interaction) can be received from the client device at the server.

[0163] In some illustrative embodiments, the features disclosed herein can be implemented on a smart TV module (or a connected TV module, a hybrid TV module, etc.), which may include a processing module configured to integrate an Internet connection with a more traditional TV program source (e.g., received via cable, satellite, wireless or other signals). The smart TV module may be physically incorporated into a TV set, or may include other devices, such as a set-top box, a blue-ray or other digital media player, a game console, a hotel TV system, and other supporting equipment. The smart TV module may be configured to allow viewers to search and find videos, movies, photos, and other content on the web, on local cable TV channels, on satellite TV channels, or stored on a local hard drive. A set-top box (STB) or a set-top unit (STU) may include an information appliance device, which may include a tuner and be connected to a TV set and an external signal source, tune the signal to content, and then display the content on a TV screen or other display device. The smart TV module may be configured to provide a home screen or top-most screen, which includes icons for multiple different applications, such as a web browser and multiple streaming services, connected cable or satellite media sources, other Web channels, and the like. The Smart TV module may be further configured to provide an electronic program guide to the user. A companion application to the Smart TV module may operate on the mobile computing device to provide the user with additional information about available programming, to allow the user to control the Smart TV module, etc. In alternative embodiments, the features may be implemented on a laptop or other personal computer, a smart mobile phone, other mobile phones, a palmtop, a tablet computer, or other computing device.

[0164] Although this specification contains many specific implementation details, these should not be interpreted as limitations on any invention or the scope of protection that can be claimed, but should be interpreted as descriptions of features specific to specific embodiments of the systems and methods described herein. Certain features described in the context of separate embodiments in this specification may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented separately or in multiple embodiments in any suitable sub-combination. Moreover, although the features may be described above as working in certain combinations, and even initially claimed to be protected as such, in some cases, one or more features in the claimed combination may be cut out from the combination, and the claimed combination may be for a sub-combination or a variant of the sub-combination. In addition, the features described with respect to a specific title may be used relative to and / or in combination with the illustrative embodiments described under other titles. The title (if provided) is included only for readability purposes and should not be interpreted as limiting any functionality provided for such titles.

[0165] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that such operations be performed in the particular order shown or in a continuous order, or that all illustrated operations be performed to achieve the desired results. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products embodied on tangible media.

[0166] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired results. Additionally, the processes depicted in the accompanying drawings do not necessarily require the particular order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing may be advantageous.

Claims

1. A method for processing a plurality of data items, comprising: At each client device of the plurality of client devices: receiving a data item; receiving a public key from a second computing system; encrypting the data item using the public key to produce a single encrypted data item; using the single encrypted data item to engage in an oblivious pseudo-random function protocol with a first computing system to generate a seed; generating an encrypted secret share using the seed and the single encrypted data item by using a threshold secret sharing function under which the encrypted secret share cannot be decrypted until a threshold number of encrypted secret shares associated with the same single encrypted data item are received; and transmitting the encrypted secret share to the first computing system; At the first computing system: receiving a plurality of encrypted secret shares from the plurality of client devices; processing the plurality of encrypted secret shares to produce processed data, wherein processing the plurality of encrypted secret shares to produce processed data comprises upon receiving the threshold number of encrypted secret shares associated with the same single encrypted data item, decrypting the plurality of encrypted secret shares to recover the same single encrypted data item; transmitting the processed data to the second computing system; and At the second computing system: decrypting the processed data to produce decrypted processed data; and A count of the plurality of encrypted secret shares that share a first characteristic is generated using the decrypted processed data without accessing personally identifiable information associated with the plurality of client devices.

2. The method according to claim 1, wherein: The first computing system is further configured to: Prior to processing the plurality of encrypted secret shares, the plurality of encrypted secret shares are shuffled.

3. The method according to claim 1, wherein: Participating in the oblivious pseudo-random function protocol to generate the seed includes using the single encrypted data item and a population identifier, wherein the population identifier is associated with two or more client devices of the plurality of client devices.

4. The method according to claim 1, wherein: The first computing system is a part of the second computing system.

5. The method according to claim 4, wherein: The first computing system exists within a protected environment of the second computing system, the protected environment preventing the second computing system from accessing the first computing system.

6. The method according to claim 1, wherein: Each client device of the plurality of client devices uses the single encrypted data item to participate in the oblivious pseudo-random function protocol with a third computing system to generate the seed.

7. The method according to claim 1, wherein: Instead of the first computing system processing the plurality of encrypted secret shares to produce processed data, the plurality of encrypted secret shares are transmitted by the first computing system to the second computing system, and the second computing system processes the plurality of encrypted secret shares to produce the processed data.

8. The method according to claim 1, wherein: The plurality of client devices communicate with the first computing system using a secure network, wherein the secure network is an onion network.

9. The method according to claim 1, wherein: Participating in the oblivious pseudo-random function protocol to generate the seed includes using the single encrypted data item and a private identifier, wherein the private identifier uniquely identifies a client device among the plurality of client devices.

10. The method according to claim 1, wherein: The first computing system is a distributed computing system.

11. A first computing system for processing a plurality of data items, comprising: a memory having instructions stored thereon, and a processor configured to execute the instructions to: using the plurality of data items to engage in an oblivious pseudo-random function protocol with the plurality of client devices to generate a plurality of seeds; receiving a plurality of encrypted secret shares and a plurality of verification shares from the plurality of client devices, wherein the encrypted secret shares are generated by the client devices using a seed and a single encrypted data item and by using a threshold secret sharing function, and the single encrypted data item is generated by the client devices by encrypting a data item received by the client devices using a public key received from a second computing system; authenticating the plurality of encrypted secret shares using the plurality of verification shares; processing the plurality of encrypted secret shares to produce processed data, wherein the processing comprises upon receiving a threshold number of encrypted secret shares associated with a single encrypted data item used to generate the plurality of encrypted secret shares, decrypting the plurality of encrypted secret shares to recover the single encrypted data item; and The processed data is transmitted to the second computing system so that the second computing system decrypts the processed data to produce decrypted processed data, and generates a count of the plurality of encrypted secret shares that share a first characteristic by using the decrypted processed data without accessing personally identifiable information associated with the plurality of client devices.

12. The first computing system of claim 11, wherein: The processor is further configured to execute the instructions to shuffle the plurality of encrypted secret shares prior to processing.

13. The first computing system of claim 11, wherein: Participating in the oblivious pseudo-random function protocol to generate a plurality of seeds includes encoding a population identifier into each of the plurality of seeds, wherein the population identifier is associated with two or more of the plurality of client devices.

14. The first computing system of claim 11, wherein: The first computing system is a part of the second computing system.

15. The first computing system of claim 14, wherein: The first computing system exists within a protected environment of the second computing system, the protected environment preventing the second computing system from accessing the first computing system.

16. The first computing system of claim 11, wherein: The first computing system communicates with the plurality of client devices using a secure network, wherein the secure network is an onion network.

17. The first computing system of claim 11, wherein: Participating in the oblivious pseudo-random function protocol to generate the plurality of seeds includes using a private identifier, wherein the private identifier uniquely identifies a client device among the plurality of client devices.

18. The first computing system of claim 11, wherein: The first computing system is a distributed computing system.

19. The first computing system of claim 11, wherein: The plurality of encrypted secret shares are decrypted using a threshold encryption function protocol.

20. The first computing system of claim 11, further comprising an application programming interface (API), wherein: The first computing system transmits the processed data to the second computing system in response to an API query from the second computing system.

Images