Secure management of data distribution restrictions

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, are provided for allowing suitable digital components to be automatically selected and served to client devices. A method can include generating a universal identifier for a digital component presented in an application. The application updates a set of universal identifiers that have been created for digital components presented by the application over a specified time period. The application identifies a digital component and a corresponding universal identifier that is blocked, and generates a probabilistic data structure representing the set of blocked universal identifiers. The application creates multiple shares of the probabilistic data structure and sends different shares to different servers. The application receives individual responses generated by each of the different servers based on the multiple shares, and identifies a digital component to be presented in the application based on a combination of the individual responses.

Description

Technical Field

[0001] This specification relates to methods and systems for data processing and data security. Background Technology

[0002] Client devices can use applications (e.g., web browsers, native applications) to access content platforms (e.g., search platforms, social media platforms, or other platforms hosting content). Content platforms can display digital components (discrete units of digital content or information, such as video clips, audio clips, multimedia clips, images, text, or other units of content) that can be provided by one or more content sources / platforms within an application launched on the client device. Some systems limit the distribution of data (such as digital components) for various reasons, such as saving processing resources. However, the technologies that implement these restrictions may lead to data security issues. Summary of the Invention

[0003] In general, an innovative aspect of the subject matter described in this specification can be embodied in the method, which includes the following operations: generating a generic identifier by an application for digital components presented in the application, the generic identifier being an encrypted version of a combination of (i) a campaign identifier for providing the content source of the digital component and (ii) a domain of the content source; updating a set of generic identifiers already created by the application for digital components presented by the application for a specified time period based on the generated generic identifier; identifying a set of blocked generic identifiers corresponding to generic identifiers that have been (i) generated by the application and (ii) blocked from being used to present future digital components in the application; generating a probabilistic data structure representing the set of blocked generic identifiers by the application; creating multiple shares of the probabilistic data structure by the application; sending different shares of the multiple shares to different servers by the application; receiving individual responses generated by each of the different servers based on the different shares sent to the different servers; and identifying the digital component to be presented in the application by the application and based on a combination of the individual responses.

[0004] Other embodiments of this aspect include corresponding apparatus, systems, and computer programs configured to perform aspects of methods encoded on computer storage devices. These and other embodiments may each optionally include one or more of the following features.

[0005] In some aspects, interaction with a mute element corresponding to a given digital component presented in the application is detected, and in response to the detection of interaction with the mute element in the most recent time frame, the set of blocked generic identifiers is updated to include the generic identifier of the given digital component.

[0006] In some aspects, updating the set of generic identifiers includes incrementing a presentation counter that indicates the presentation frequency of a digital component having a particular generic identifier in response to the application presenting a digital component associated with that particular generic identifier. In some aspects, updating the set of generic identifiers includes adding the particular generic identifier to the set of blocked generic identifiers when the presentation counter exceeds a specified value.

[0007] In some aspects, the probabilistic data structure includes a probabilistic data structure that generates a set of (i) blocked generic identifiers and (ii) a set of user group identifiers corresponding to user groups assigned to the application. In some aspects, the probabilistic data structure also includes a pseudo-random function parameterized by two or more random variables, and wherein the probabilistic data structure is a cuckoo filter.

[0008] In some respects, entities that provide digital components can generate generic identifiers for the digital components.

[0009] Specific embodiments of the subject matter described in this specification may be implemented to achieve one or more of the following advantages. Access to certain types of data can be restricted, blocked, or protected by using a secure multi-party computation (MPC) process, which may be performed by two or more MPC servers operating from different parties, to determine when and / or what digital components are distributed to a client device. For example, an MPC server may make a determination by processing different secret shares of data (e.g., different or disjoint subsets of the dataset) provided to different MPC servers in the MPC server group, to ensure that any MPC server or any other party that has access to data represented by one of the secret shares cannot access the complete dataset in plaintext.

[0010] For example, by using probabilistic data structures, such as the cuckoo filter, the amount of data and processing resources required to make decisions can be reduced. A probabilistic data structure can simultaneously represent the group (e.g., interest group) to which the user of the client device requesting the data (e.g., the digital component) belongs, without revealing sensitive user data. Using probabilistic data structures in this way protects user privacy and reduces the size of the information provided to the MPC cluster. This reduction in data size decreases the amount of bandwidth consumed in transmitting information, reduces the latency of transmitting information, and reduces the amount of processing power required to transmit information and the associated battery power of battery-powered devices (e.g., mobile devices).

[0011] As mentioned above, the use of probabilistic data structures can also reduce the amount of processing resources (e.g., memory, CPU cycles, or cloud computing resources) required to determine whether a user on a client device is eligible to receive a particular type of data by performing analysis with fewer than five lookup operations (e.g., in some cases no more than two lookup operations), where existing technologies might require hundreds of lookups to achieve the same result. More specifically, using probabilistic data structures ensures that the information that needs to be identified to provide a particular dataset (e.g., digital components) to a particular client device will only be found in a specified number (e.g., two or three) locations within the probabilistic data structure, making only these two locations need to be checked by the computing device. This obviously improves the efficiency of the computing system itself and can save resources such as battery life, power consumption, and required device cooling. It can also result in the ability to obtain results much faster than systems that require hundreds of lookup operations, compared to performing fewer than five lookup operations.

[0012] The MPC cluster can send a secret share identifying the result of the selected digital component chosen by the MPC cluster using a secure MPC process. By sending only the secret share of the result of the selected digital component, rather than sending information about all or a large set of digital components, the bandwidth, latency, processing power, and battery power consumed when sending and receiving results are similarly reduced. This also reduces the potential leakage of confidential information of the content platform submitting the selection values ​​of digital components to the MPC cluster by limiting the number of digital components that provide information to the client device. Therefore, this disclosure allows for the automatic selection of appropriate digital components and their provision to the client device, while taking into account blocked digital components associated with the client device. This is achieved by improving the security of user data transmitted over the network and efficiently utilizing processor and bandwidth resources.

[0013] Details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the following description. Further features, aspects, and advantages of this subject matter will become apparent from the description, drawings, and claims. Attached Figure Description

[0014] Figure 1 This is a block diagram of an example environment in which digital components are distributed.

[0015] Figure 2 This is a swimlane diagram of an example process for selecting digital components to be distributed to client devices.

[0016] Figure 3 This is a flowchart of an example process for distributing digital components to client devices.

[0017] Figure 4 It is a block diagram of an example computer system that can be used to perform the described operations. Detailed Implementation

[0018] This document discloses methods, systems, apparatus, and computer-readable media for implementing techniques to restrict access to specific types of data. In some cases, the techniques discussed herein can be used to manage, restrict, limit, or prevent the distribution of data to a client device (or a user of that client device) that has already been provided with data a predetermined number of times. For example, the display of digital components that have previously been displayed on a client device can be blocked or otherwise restricted, or the display to a user of that client device (e.g., on various different client devices) can be blocked or otherwise restricted a predetermined number of times. These techniques also enable users of client devices to block certain types of data (e.g., certain types of digital components) from being delivered to or presented on the client device. This prevents the waste of resources that would otherwise be consumed by delivering outdated or unwanted data to client devices. The techniques discussed herein are described with reference to the distribution of digital components to client devices; however, these techniques can also be applied to the management of any data, enabling the restriction or protection of access to any data.

[0019] Typically, users connected to the internet via client devices can be served with digital components. In this case, the digital component server can control access to the digital component based on third-party cookies (e.g., cookies from a domain different from the domain of the webpage the user is currently viewing) and activity data such as the user's online activity and browsing history. For example, the digital component server can use information contained in cookies (e.g., third-party cookies that collect data across multiple domains / websites) to serve digital components based on previous websites visited by the user on the client device. However, in browsers that block the use of third-party cookies, browsing information typically collected across multiple websites is no longer available. Therefore, any functionality that relies on information collected by third-party cookies (e.g., cookies from a domain different from the domain of the webpage the user is currently viewing (such as a valid top-level domain (eTLD+1))), such as managing the distribution of data to client devices, is no longer available.

[0020] The techniques described herein enable data access management independently of third-party cookies or other device / browser identifiers, allowing them to be used to control access to (e.g., distribution) data (such as digital components) on client devices, even if the use of third-party cookies has been blocked (e.g., by a browser installed on the client device). These techniques can also be implemented such that the complete dataset used to control access to data provided by a server resides entirely (or mostly) on the client device, while only a portion of the complete dataset (e.g., a completely different or disjoint subset) is provided to a remote server. This prevents the complete dataset, upon which access control decisions are made, from being accessed by any remote server that contributes to the techniques discussed herein.

[0021] As further described in this specification, an application executing on a client device generates a generic identifier that identifies a data source previously provided to the client device. For example, in the context of digital components, the generic identifier can uniquely represent the entity providing the digital component and / or the specific group of digital components (e.g., a campaign) that triggers the sending of the digital component to the client device. A generic identifier corresponding to each digital component can be delivered to the client device along with each digital component, allowing the client device to track how frequently digital components are delivered to the client device from a specific entity and / or group of digital components. In a more general managed data access implementation, similar techniques can be used to enable the client device to track how frequently data provided by certain entities and / or contained in certain databases, indexes, or folders is sent to (or downloaded by) the client device.

[0022] As discussed in more detail below, generic identifiers can be used by client-side applications to track which digital components (or other types of data) are allowed to be presented (or accessed) or should be blocked from being presented (or accessed) based on the frequency with which digital components corresponding to a specific generic identifier are delivered to and / or presented by the client device. Additionally, the use of generic identifiers enables client devices to manage the blocking of delivery of certain types of digital components (or other data) from specified sources, as requested by a user of the client device. In some cases, the client device may maintain a set (e.g., a list) of blocked generic identifiers that specifies digital components with a generic identifier matching one of the blocked generic identifiers that are blocked from being delivered to or presented by the client device. Although the techniques and methods used in this document use generic identifiers as a means of identifying digital components and activities, it should be noted that these methods and techniques can be extended to other forms of identification. For example, labels or tags associated with digital components or activities can be used to identify them. For instance, if a user of the client device wants to block all digital components related to soda beverages, the term "soda beverage" can be used to identify all digital components related to soda beverages. In this context, the term "soda beverage" can be a classification term used in association with digital components related to soda beverages, or a term used on the Internet to identify such digital components.

[0023] These technologies also enable client-side applications to track the number of times different digital components are presented on a client device and restrict the presentation of certain digital components with generic identifiers that have been identified by the application at least a predetermined number of times within a specified time period. In other words, once a generic identifier has been encountered a predetermined number of times in a time frame, the client-side application can further prevent data (e.g., digital components) with that generic identifier from being sent to or presented on the client device, at least temporarily, by adding the generic identifier to the set of blocked generic identifiers. To restrict the subsequent delivery of data (such as digital components) to the client device, the client device generates a probabilistic data structure using the set of blocked generic identifiers and shares this probabilistic data structure with one or more remote servers (e.g., two or more MPC servers) that can use this probabilistic data structure in the process of selecting the data (e.g., digital components) to be delivered to the client device.

[0024] In some aspects, digital component servers can deploy secure multi-party computation (MPC) systems comprising two or more computation servers to perform secure MPC processes to select digital components based on probabilistic data structures, where no single MPC server can access the information in plaintext. These techniques enable client devices to generate probabilistic data structures in secret shares and send them to each server in the MPC system, thereby maintaining user privacy and anonymity. (Reference) Figure 1-4 These techniques and methods will be explained further.

[0025] Figure 1 This is a block diagram of an example environment 100 in which digital components are distributed for presentation along with electronic documents. Example environment 100 includes a network 102, such as a local area network (LAN), a wide area network (WAN), the Internet, or a combination thereof. Network 102 connects a content server 104, client devices 106, a digital component server 108, and a digital component distribution system 110 (also known as a component distribution system, CDS).

[0026] Client device 106 is an electronic device capable of requesting and receiving resources via network 102. Example client devices 106 include personal computers, mobile communication devices, wearable devices, personal digital assistants (PDAs), gaming systems, virtual reality systems, streaming media devices, and other devices capable of sending and receiving data via network 102. Client device 106 typically includes applications 107, such as web browsers, to facilitate sending and receiving data via network 102; however, local applications executed by client device 106 may also facilitate sending and receiving data via network 102. Client device 106, particularly a PDA, may include hardware and / or software capable of voice interaction with client device 106. For example, client device 106 may include a microphone through which a user can submit audio (e.g., voice) input, such as commands, search queries, browsing instructions, smart home instructions, and / or other information. Additionally, client device 106 may include a speaker through which audio (e.g., voice) output can be provided to the user. A personal digital assistant can be implemented in any client device 106, examples of which include wearable devices, smart speakers, home appliances, automobiles, tablets, or other client devices 106.

[0027] An electronic document is data that presents a set of content on client device 106. Examples of electronic documents include web pages, word processing documents, portable document format (PDF) documents, images, videos, search results pages, video games, virtual (or augmented) reality environments, and feed sources. Native applications (e.g., "apps"), such as those installed on mobile, tablet, or desktop computing devices, are also examples of electronic documents. Electronic documents may be provided to client device 106 by content server 104. For example, content server 104 may include a server hosting a publisher's website. In this example, client device 106 may initiate a request for a given publisher's web page, and content server 104 hosting the given publisher's web page may respond to the request by sending machine-executable instructions that initiate the rendering of the given web page at client device 106.

[0028] In another example, content server 104 may include an application server from which client device 106 can download applications. In this example, client device 106 may download the files required to install the application on client device 106 and then execute the downloaded application locally. The downloaded application may be configured to present a combination of local content as part of the application itself and one or more digital components (e.g., content created / distributed by a third party) obtained from digital component server 108 and inserted into the application when it is executed at client device 106.

[0029] Electronic documents can include a variety of content. For example, an electronic document may include static content (e.g., text or other specified content) that is inherent in the electronic document itself and / or does not change over time. Electronic documents may also include dynamic content that may change over time or upon request. For example, the publisher of a given electronic document may maintain a data source used to populate portions of the electronic document. In this example, a given electronic document may include tags or scripts that, when the given electronic document is processed (e.g., rendered or executed) by client device 106, cause client device 106 to request content from the data source. Client device 106 integrates the content obtained from the data source into the given electronic document to create a composite electronic document that includes the content obtained from the data source.

[0030] In some cases, a given electronic document may include a digital component tag or digital component script referencing the digital component distribution system 110. In these cases, when the client device 106 processes the given electronic document, the client device 106 executes the digital component tag or digital component script. Execution of the digital component tag or digital component script configures the client device 106 to generate a request 112 for a digital component (referred to as a "component request"), which is sent to the digital component distribution system 110 via network 102. For example, the digital component tag or digital component script may enable the client device 106 to generate a packetized data request that includes header and payload data. The digital component request 112 may include event data specifying characteristics such as the name (or network location) of the server from which the requested media is located, the name (or network location) of the requesting device (e.g., client device 106), and / or information that the digital component distribution system 110 can use to select one or more digital components offered in response to the request. The component request 112 is sent by the client device 106 to the server of the digital component distribution system 110 via network 102 (e.g., a telecommunications network).

[0031] Digital component request 112 may include event data specifying other event characteristics, such as location characteristics of the requested electronic document and the electronic document in which the digital component can be presented. For example, event data may be provided to digital component distribution system 110 specifying a reference (e.g., a Uniform Resource Locator, URL) to an electronic document (e.g., a webpage or application) in which the digital component will be presented, the available locations of the electronic document in which the digital component can be presented, the size of the available locations, and / or the media types eligible for presentation at those locations. Similarly, event data specifying keywords (“document keywords”) associated with an electronic document or entities (e.g., people, places, or things) referenced by the electronic document may also be included in component request 112 (e.g., as payload data) and provided to digital component distribution system 110 to identify digital components eligible for presentation with the electronic document. Event data may also include search queries submitted from client device 106 to obtain a search results page and / or specify search results and / or data containing text, auditory, or other visual content included in the search results.

[0032] Component request 112 may also include event data related to other information, such as information already provided by the user of client device 106, geographic information indicating the state or region from which the component request was submitted, or other information providing context of the environment in which the digital component will be displayed (e.g., the time of day of the component request, the day of the week of the component request, the type of device in which the digital component will be displayed, such as a mobile device or a tablet device). Component request 112 may be sent, for example, via a packetized network, and component request 112 itself may be formatted as packetized data with a header and payload data. The header may specify the destination of the packet, and the payload data may include any of the information discussed above.

[0033] A digital component distribution system 110, including one or more digital component distribution servers, selects a digital component to be presented along with a given electronic document in response to receiving a component request 112 and / or using information included in the component request 112. In some implementations, the digital component is selected in less than one second to avoid errors that may be caused by delayed selection of the digital component. For example, a delay in providing the digital component in response to component request 112 may cause a page load error at client device 106, or cause portions of the electronic document to remain unfilled, even after other portions of the electronic document have been presented at client device 106. Furthermore, as the delay in providing the digital component to client device 106 increases, the electronic document is more likely to no longer be presented at client device 106 when the digital component is delivered, thus negatively impacting the user experience of the electronic document and wasting system bandwidth and other resources. Additionally, for example, if the electronic document is no longer presented on client device 106 when the digital component is provided, the delay in providing the digital component may cause the delivery of the digital component to fail.

[0034] To facilitate the search of electronic documents, environment 100 may include a search system 150 that identifies electronic documents by crawling and indexing them (e.g., indexing based on crawled content). Data about electronic documents may be indexed based on the electronic documents associated with them. Indexed and optionally cached copies of the electronic documents are stored in search index 152 (e.g., multiple hardware storage devices). The data associated with the electronic documents are data representing the content included in the electronic documents and / or the metadata of the electronic documents.

[0035] Client device 106 can submit a search query to search system 150 via network 102. In response, search system 150 accesses search index 152 to identify electronic documents related to the search query. Search system 150 identifies the electronic documents in the form of search results and returns the search results to client device 106 in a search results page. Search results are data generated by search system 150 that identifies electronic documents that respond to a specific search query (e.g., are relevant) and includes active links (e.g., hypertext links) that cause the client device to request data from a specified location in response to user interaction with the search results. Example search results may include a webpage title, a text snippet or portion of an image extracted from a webpage, and the URL of the webpage. Another example search result may include the title of a downloadable application, a text snippet describing the downloadable application, an image depicting the user interface of the downloadable application, and / or a URL indicating the location where the application can be downloaded to client device 106. Another example search result may include the title of a streaming media, a text snippet describing the streaming media, an image depicting the streaming media content, and / or a URL indicating the location where the streaming media can be downloaded to client device 106. Like other electronic documents, search results pages may include one or more slots where digital components (such as advertisements, video clips, audio clips, images, or other digital components) can be presented.

[0036] In some implementations, the digital component distribution system 110 is implemented within a distributed computing system that includes, for example, servers and a collection 114 of interconnected computing devices that identify and distribute digital components in response to a component request 112. The collection 114 of computing devices operates together to identify a set of digital components eligible to be presented in an electronic document from a corpus of millions of available digital components.

[0037] In some implementations, the digital component distribution system 110 implements various techniques for selecting and distributing digital components. For example, a digital component may include corresponding distribution parameters that facilitate (e.g., constrain or limit) the selection / distribution / transmission of the corresponding digital component. For example, distribution parameters may facilitate the transmission of a digital component by requiring the component to request at least one criterion that matches (e.g., precisely matches or matches at a pre-specified level of similarity) one of the distribution parameters of the digital component.

[0038] In another example, distribution parameters for a particular digital component may include distribution keywords that must match (e.g., terms specified in an electronic document, document keywords, or component request 112) for the digital component to be eligible for presentation. Distribution parameters may also require component request 112 to include information specifying a particular geographic region (e.g., country or state) and / or information specifying that component request 112 originates from a particular type of client device 106 (e.g., mobile device or tablet device) for the component item to be eligible for presentation. Distribution parameters may also specify qualification values ​​(e.g., grades, scores, or some other specified value) for evaluating the eligibility of component items for selection / distribution / transmission (e.g., among other available digital components), as discussed in more detail below. In some cases, qualification values ​​may be based on the amount submitted when a particular event is attributed to a digital component item (e.g., the presentation of the digital component).

[0039] The identification of eligible digital components can be segmented into multiple tasks 117a-117c, and these tasks can then be distributed among computing devices in a set of multiple computing devices 114. For example, different computing devices 114 in the set 114 can each analyze different digital components to identify various digital components having distribution parameters that match the information included in the component request 112. In some implementations, each given computing device 114 in the set 114 can analyze different data dimensions (or sets of dimensions) and pass (e.g., transmit) the results of the analysis (Res 1-Res 3) 118a-118c back to the digital component distribution system 110. For example, the results 118a-118c provided by each of the computing devices 114 in the set 114 can identify a subset of digital component items eligible for distribution in response to the component request and / or a subset of digital components having specific distribution parameters. The identification of subsets of digital components may include, for example, comparing event data with distribution parameters and identifying a subset of digital components having distribution parameters that match at least some features of the event data.

[0040] The digital component distribution system 110 aggregates results 118a-118c received from a set 114 of multiple computing devices and uses information associated with the aggregated results to select one or more digital components to be provided in response to component request 112. For example, the digital component distribution system 110 may select a set of winning digital components (one or more digital components) based on the results of one or more digital component evaluation processes. Furthermore, the digital component distribution system 110 may generate and send response data 120 (e.g., digital data representing a response) via network 102, wherein the response data 120 enables the client device 106 to integrate the set of winning digital components into a given electronic document, such that the set of winning digital components and the content of the electronic document are presented together on the display of the client device 106.

[0041] In some implementations, client device 106 executes instructions included in response data 120, which configures and enables client device 106 to obtain a set of winning digital components from one or more digital component servers 108. For example, the instructions in response data 120 may include a network location (e.g., a URL) and a script that causes client device 106 to send a server request (SR) 121 to digital component server 108 to obtain a given winning digital component from digital component server 108. In response to server request 121, digital component server 108 identifies the given winning digital component specified in server request 121 and sends digital component data 122 (DI data) of the given winning digital component in an electronic document presented at client device 106.

[0042] In some cases, receiving digital components (or other data) related to web pages, application pages, or other electronic resources that a user has previously visited and / or interacted with can be beneficial to the user. To distribute such digital components to users, users can be assigned to user groups based on the digital content they access, such as user interest groups, similar user groups, or other group types involving similar user data. For example, when a user visits a specific website and interacts with a specific item presented on the website or adds an item to a virtual shopping cart, that user can be assigned to a user group that has already visited the same website or other websites with similar context or interest in the same items. To illustrate, if a user of client device 106 searches for shoes and visits multiple web pages from different shoe manufacturers, the user can be assigned to the user group "Shoes," which can include identifiers of all users who have visited shoe-related websites.

[0043] In some implementations, a user's group membership can be maintained at the user's client device 106, for example, via a browser-based application rather than via digital component server 108 or content server 104, or via another party. User groups can be designated by corresponding tags. User group tags can be descriptions of the group (e.g., a gardening group) or codes representing the group (e.g., a non-descriptive alphanumeric sequence). User group tags can be stored in secure storage at the client device 106, and / or can be encrypted during storage to prevent unauthorized access to the list.

[0044] In some implementations, a hash-based message authentication code (HMAC) (denoted as HMAC(user_group_label, eTLD+1)) parameterized by the user group's label and the domain of content server 104 can be used to generate the user group identifier. In some implementations, a secure hash algorithm (SHA-256) can be used to implement HMAC, which is a cryptographic hash function with a 256-bit digest length to generate a hashed 256-bit (32-byte) output. In such an example, HMAC(user_group_label, eTLD+1) generates a unique 256-bit identifier for the user group as the user group identifier.

[0045] Content server 104 can use a user's user group membership to select digital components or other content that the user may be interested in or that may otherwise benefit the user / user device (e.g., help the user complete a task). For example, such digital components or other content may include data that improves the user experience, enhances the operation of the user device, or otherwise benefits the user or user device.

[0046] When an application 107, such as a browser, loads a website 142 that includes one or more digital component slots from a publisher 140, the application 107 may request a digital component for each slot. In some implementations, the digital component slot may include code (e.g., a script) that causes the application 107 to request a digital component to be presented to a user on a client device 106. After receiving a digital component as a response from a digital component server, the digital component is presented in the corresponding digital component slot on the website 142. However, in this case, to avoid repeatedly presenting the same digital component, the application 107 may maintain a set of generic identifiers such that each identifier in the set can uniquely identify a digital component previously presented on the client device 106. For example, a trusted program (e.g., a web browser or operating system, or the client device 106) may maintain a set of identifiers.

[0047] In some implementations, each digital component may include an identifier within a domain that uniquely identifies the content source (e.g., for digital component server 108). In other implementations, a digital component may be part of an activity of digital component server 108. For example, digital component server 108 may launch a campaign to promote a specific brand of shoes. To promote this campaign, digital component server 108 may provide multiple digital components associated with the specific brand of shoes context. In this case, each of the multiple digital components associated with the shoe brand context is part of the campaign. In this case, each of the multiple digital components in the campaign may be identified by a unique identifier (called an campaign identifier), which distinguishes the campaign from other activities of digital component server 108.

[0048] When a digital component is presented on a client device 106 via application 107, application 107 retrieves the activity identifier assigned to the digital component by digital component server 108. In some implementations, application 107 may also retrieve the eTLD+1 of the digital content provider's domain. eTLD+1 is the valid top-level domain (eTLD) plus one more level than a public suffix. An example of eTLD+1 is "example.com", where ".com" is the top-level domain.

[0049] After retrieving the eTLD+1 of the activity identifier and the domain of the digital content provider (also known as the content source) for a specific digital component, application 107 can generate a generic identifier for that specific digital component. In some implementations, digital component server 108 can generate a generic identifier and assign it to a digital component. In such an implementation, application 107 can retrieve the generic identifier of a digital component presented on client device 106. The generic identifier is data that uniquely represents a digital component where the digital component (i) is provided by a specific content source (e.g., a digital content provider) and (ii) is triggered to be delivered to the client device by the same set of activities or distribution rules. In other words, two different digital components (or other data files) with the same generic identifier are considered to originate from the same content source and are triggered to be delivered by the same activity. For brevity and readability, the generic identifier will also be referred to as uniquely identifying a specific digital component in the following description. In some implementations, the generic identifier of a digital component can be calculated using a hash-based message authentication code (HMAC) parameterized by the activity identifier and the domain of digital component server 108 (denoted as HMAC(campaign_identifier, eTLD+1)). In some implementations, HMAC can be implemented using a secure hash algorithm (SHA-256), which is a cryptographic hash function with a 256-bit digest length to produce a hashed 256-bit (32-byte) output. In such an example, HMAC(campaign_identifier, eTLD+1) generates a 256-bit unique identifier for the digital component as a generic identifier.

[0050] By using a hash function to generate a universal identifier, it is computationally impractical for any entity other than the application 107 running on client device 106 and the corresponding digital component server 108 of the digital component to determine the identity of the content source providing the digital component or the activity identifier used by the content source, without additional information. Therefore, the hash function approach protects the confidentiality of the content source if another entity receives the set of universal identifiers or somehow gains unauthorized access to them.

[0051] Application 107 maintains a set of generic identifiers that uniquely identify digital components across the entire activity space on all digital component servers 108. In some implementations, the set of generic identifiers includes, is indexed to, a presentation counter for each of the generic identifiers in the set, or is otherwise associated with a presentation counter for each of the generic identifiers in the set. The presentation counter for each particular generic identifier indicates the frequency of delivery and / or presentation of the digital component having that particular generic identifier. For example, the presentation counter for a particular generic identifier may represent the number of times a digital component having that particular generic identifier has previously been delivered to and / or presented on client device 106 in a given time frame.

[0052] After calculating / generating a universal identifier for a specific digital component delivered to and presented on client device 106, application 107 updates the set of universal identifiers with the universal identifier of the specific digital component. If the universal identifier of the specific digital component is not in the set, application 107 adds the universal identifier of the specific digital component to the set and increments the corresponding presentation counter by 1. If the universal identifier of the specific digital component already exists in the set, application 107 updates the corresponding presentation counter of the universal identifier, for example, by incrementing the counter by 1.

[0053] In some implementations, application 107 executing at client device 106 may maintain a set of blocked generic identifiers, which includes generic identifiers of digital components that have been explicitly blocked by the user. For example, suppose a user interacts with a mute element corresponding to a given digital component (or a portion of data delivered to client device 106). In this example, the user's interaction with the mute element is an indication that the user does not want to see that digital component or potentially similar digital components (e.g., from the same content source or activity) in the future (e.g., at least for a certain amount of time). In response to this interaction, application 107 may add the generic identifier of the given digital component to the set of blocked generic identifiers, which can then be used to block the delivery (or presentation) of other digital components with the same generic identifier as the given digital component.

[0054] Application 107 can add those generic identifiers of digital components that have been delivered / presented at least a predetermined number of times (e.g., presented more than X times within a specified time period, such as a day, a week, a month, etc.) to the set of blocked generic identifiers. For example, when a digital component with the generic identifier 1A2B3C has been delivered and presented to a specific user more than X times in the past Y days, application 107 can add the generic identifier 1A2B3C to the set of blocked generic identifiers stored at the client device 106.

[0055] The threshold number and / or specified time period for adding a generic identifier to the set of blocked generic identifiers can be specified based on each content source and / or each activity. For example, a digital component server may store a set of rules for an activity on client device 106, where these rules do not allow the presentation of a digital component of an activity to exceed a set number of times (called max_ppt) within a set duration (called max_time). In this case, when retrieving the digital component identifier and eTLD+1 field from a response including the digital component, application 107 may also retrieve information defining the rules for the activity. When a digital component of a specific activity is presented within a time period and the set of generic identifiers associated with the digital component is updated, if the presentation counter exceeds max_ppt, application 107 updates the set of blocked generic identifiers by adding the generic identifier to the set of blocked generic identifiers. For example, suppose application 107 retrieves the rules for a specific activity set by digital component server 108, where digital component server 108 sets max_ppt to 2 and max_time to 60 seconds. It is also assumed that application 107 has already presented a first digital component provided by digital component server 108 for the specific activity. At this point, application 107 generates a universal identifier for the first digital component, updates the set of universal identifiers by including the universal identifier of the first digital component, and increments the corresponding presentation counter from 0 to 1. Note that max_ppt = 2 and max_time = 60 seconds means that within 60 seconds after the first digital component is presented, only one more digital component belonging to a specific activity of the digital component server 108 can be presented on the client device 106.

[0056] Continuing the example above, suppose that 20 seconds after the first digital component is rendered, application 107 receives a second digital component from the same digital component server 108 for a specific activity. Application 107 generates a generic identifier for the second digital component and updates the set of generic identifiers by incrementing the corresponding rendering counter from 1 to 2. Note that at this point, the digital component provided by digital component server 108 and associated with the specific activity has already been rendered on client device 106 2 times (i.e., equal to max_ppt). In this case, application 107 adds the generic identifier to the set of blocked generic identifiers, thereby indicating that digital components (or other data) with the same generic identifier (or matching generic identifiers that may not be exactly the same, such as within a range of values) are blocked from rendering at client device 106.

[0057] In some implementations, a set of universal identifiers with the same max_time can be implemented using a first-in, first-out (FIFO) method. Each entry in the FIFO is a pair of {time_stamp, universal_identifier}. It is also assumed that for a digital component belonging to a specific activity of the digital component server, i.e., for a specific activity of the digital component server, the digital component server 108 sets max_ppt to 2 and max_time to 60 seconds, during which at most two digital components will be presented on application 107. In this case, the FIFO implemented by application 107 will hold two entries, and whenever a digital component from a specific activity is presented on application 107, an entry with the universal identifier of the digital component's activity and a timestamp of when the digital component was presented on application 107 is pushed into the FIFO. This implementation may also include an entry deletion method, wherein the first entry in the FIFO can be automatically deleted when the timestamp of the first entry is earlier than max_time. If at any point in time the FIFO contains more than max_ppt occurrences of universal_identifier, the corresponding entry is included in the set of blocked universal identifiers.

[0058] In some implementations, if the user does not block the activity and / or digital component associated with the universal identifier within the most recent time period indicated by max_time, application 107 can remove the universal identifier from the set of blocked universal identifiers, thereby allowing the digital component associated with the removed universal identifier to be presented on application 107 on client device 106. Continuing the example above, when the user blocks the corresponding activity and / or digital component, the application can maintain a FIFO with pairs of blocked universal identifiers and timestamps. If the timestamp of the first entry is later than max_time, the application automatically deletes the first entry in the FIFO. At any time, application 107 can collect the set of blocked universal identifiers in the FIFO, and the result is a set of blocked universal identifiers.

[0059] In some implementations, application 107 may provide a user interface that allows a user to block and / or allow the presentation of digital components at the client device. For example, the user interface may allow the user to select digital components that they wish to avoid in the future. In this case, application 107 may generate a generic identifier and add it to a set of blocked generic identifiers. This provides the user with better transparency and control. In another implementation, the user interface may allow the user to reset the set of blocked generic identifiers, which will remove all entries from the set of blocked generic identifiers, thereby allowing all digital components to be presented on client device 106.

[0060] In some implementations, the digital components provided by the digital component server 108 may include a mute element. The mute element is a user interface control included within the digital component, and in response to user interaction with the mute element, a script is triggered that generates an indication that the user does not wish to see that digital component (or potentially similar digital components) in the future (e.g., at least for a specific period of time). In use, if the user wishes not to see similar digital components in the future, the user can interact with the mute element.

[0061] In such an implementation, application 107 may include techniques and methods for determining user interaction with a mute element of a digital component presented on client device 106 by analyzing a set of signals. For example, application 107 may implement a heuristic-based approach for determining user interaction with a mute element of a digital component. In such an implementation, application 107 analyzes signals generated by user interaction with a digital component provided by digital component server 108.

[0062] In another example, application 107 may implement a machine learning model that includes multiple trainable parameters and is trained to determine user interaction with a muting element of a digital component presented on client device 106 by analyzing signals. The machine learning model can be any model considered suitable for a particular implementation, such as decision trees, artificial neural networks, genetic programming, logic programming, support vector machines, clustering, reinforcement learning, Bayesian inference, etc.

[0063] In another example, website 142, which includes a slot for a digital component that presents a digital component, may include machine-executable instructions (e.g., scripts embedded in website 142) to determine user interaction with a mute element of the digital component. Upon detecting user interaction with the mute element, the machine-executable instructions may notify application 107 using one or more application user interfaces (APIs).

[0064] When an application 107, such as a browser, loads a website 142 that includes one or more slots for digital components, the application 107 can request digital components for each slot. In some implementations, the application 107 can generate a probabilistic data structure representing the set of blocked generic identifiers and the user group to which the client device 106 (or user) belongs. In some cases, the application 107 can generate two cuckoo filters for the set of blocked generic identifiers and the user group, at the cost of increased bandwidth consumption and computational cost. The application 107 can send the probabilistic data structure along with the requests for digital components to facilitate the management of data delivery (such as digital components) to the client device 106.

[0065] In some implementations, the probabilistic data structure is a cuckoo filter. Generally, a cuckoo filter consists of an array of buckets, where each bucket can hold b fingerprints. The fingerprint of an item is a bit string derived from the hash of that item. The cuckoo filter uses n hash functions, allowing items to be placed in n distinct buckets at any of the b locations. Typically, a cuckoo filter is identified by its fingerprints and bucket size. For example, a (2,4) cuckoo filter stores fingerprints of 2 bits in length, and each bucket in the cuckoo array can store up to 4 fingerprints.

[0066] In some implementations, application 107 uses a pseudorandom function (PRF) parameterized by either a user group identifier or a set of general identifiers from a set of blocked general identifiers, and a random variable generated by application 107. For example, suppose the random variables generated by application 107 are rand_var1a, rand_var1b, and rand_var2. It is also assumed that each item in the bucket is a k-bit integer. The application can generate a cuckoo filter table using PRF(ug_id, rand_var1a) and PRF(blocked_uid, rand_var1b), where ug_id is the user group identifier generated by applying HMAC to the user group's tag based on the content provider's domain, and blocked_uid is an identifier from the set of blocked general identifiers. Note that this process is repeated for all user group identifiers and all general identifiers in the set of blocked general identifiers.

[0067] As previously described, the digital component server 108 can be deployed with a secure multi-party computation (MPC) system comprising two or more computing servers to perform a secure MPC process for selecting digital components based on a probabilistic data structure, without any single MPC server being able to access the information in plaintext. For example, suppose the MPC system includes two computing servers, MPC1 and MPC2. To protect user privacy, application 107 generates secret shares of the probabilistic data structure and sends each of these secret shares to the corresponding computing server in the MPC system.

[0068] Application 107 can generate vector B based on a cuckoo filter table generated from the set of user group identifiers and blocked generic identifiers. Vector B can be represented as B i =PRF(rand_var2, i) – A i A i It is the cuckoo filter table, and i is the vector B. i And Cuckoo Filter Table A i The index. When application 107 initiates a request for a digital component for a slot, the application sends rand_var1a, rand_var1b, and rand_var2 to MPC1. Application 107 also sends vector B and rand_var1a and rand_var1b to MPC2. Note that since neither of the computation servers MPC1 nor MPC2 has access to all three secret shares and vector B, neither computation server is able to recreate the Cuckoo Filter table, thus maintaining user privacy.

[0069] In some implementations, application 107 can use a distributed pointfunction to generate a share of the set of blocked generic identifiers. The distributed pointfunction represents a secret share of the pointfunction. Generally, the pointfunction is the function fi:[N]→[N], where f(x) = 0 and f(i) = 1 when x! = i. The pointfunction f... i The secret share is two functions g i :[N]->[N] and h i :[N]->[N], such that for all x in set [N], f i (x)=g i (x)+h i (x). Furthermore, given the parameters of function hi or gi (but not both), it is impossible to recover the original function f. i .

[0070] This implementation can use a cuckoo filter with a table using two hash functions F1 and F2. The client device generates the cuckoo filter by calculating two possible positions for each user group identifier in the set of user group identifiers using both hash functions F1 and F2. If at least one of the two possible positions is empty, the client device 106 can insert an element into the empty position (which can be in either table) to complete the insertion process for that user group identifier. If both positions are occupied, the client device 106 randomly selects a position and swaps the item currently at that position with the item to be inserted. The client device 106 can then recalculate the two hash functions F1 and F2 and attempt insertion again. This process is repeated until insertion succeeds or too many attempts fail for each user group identifier in the set of user group identifiers. After constructing the cuckoo filter, each user group identifier ug_id is stored in a specific index of the table.

[0071] For each generic identifier (blocked_uid) in the set of blocked generic identifiers, a dotted function G is required. blocked_uid The function G at that point blocked_uid It can be divided into distributed point functions g blocked_uid,1 and g blocked_uid,2 This makes for The following relations are satisfied.

[0072] If i = F1(blocked_uid)

[0073] G blocked_uid (i)=g blocked_uid,1 (i)+g blocked_uid,2 (i) = blocked_uid

[0074] Otherwise G blocked_uid (i)=g blocked_uid,1 (i)+g blocked_uid,2 (i) = 0.

[0075] Similarly, a point function H is needed. block_uid The point function H block_uid It can be divided into distributed point functions h. block_uid,1 and h block_uid,2 This makes for The following relations are satisfied.

[0076] If i = F2(blocked_uid)

[0077] H blocked_uid (i)=h blocked_uid,1 (i)+h blocked_uid,2 (i) = blocked_uid

[0078] Otherwise H blocked_uid (i)=h blocked_uid,1 (i)+h blocked_uid,2 (i) = 0.

[0079] The distributed point function of a specific point function can be evaluated on multiple possible points (e.g., multiple possible blocked identifiers), but the result is always zero except for `blocked_uid`. Compared to sending user group identifiers in other encrypted forms, the distributed point function has a very small data size that can be transmitted over the network without using much bandwidth and has low latency.

[0080] Given a blocked_uid, a point function F1, and a corresponding first table of the cuckoo filter (if the blocked_uid is inserted into the first table), application 107 generates a distributed point function g for the computing system MPC1. blocked_uid,1 And generate distributed function g for the computing system MPC2. blocked_uid,2 Similarly, for a given blocked_uid, point function F2, and the corresponding second table of the cuckoo filter (if blocked_uid is inserted into the second table), application 107 generates the distributed point function h for the computing system MPC1. blocked_uid,1 Furthermore, it generates a distributed point function h for the computing system MPC2. blocked_uid,2 .

[0081] Similarly, Application 107 can use distributed point functions to generate secret shares of all user group identifiers associated with the user group of Application 107. For a given ug_id, point function F1, and the corresponding first table of the Cuckoo Filter (if blocked_uid is inserted into the first table), Application 107 generates a distributed point function g for computing system MPC1. ug_id,1 And generate distributed function g for the computing system MPC2. ug_id,2 Similarly, for a given ug_id, point function F2, and the corresponding second table of the cuckoo filter (if blocked_uid is inserted into the second table), application 107 generates the distributed point function h for the computing system MPC1. ug_id,1 And generate distributed point functions h for the computing system MPC2. ug_id,2 .

[0082] Application 107, executing on client device 106, can send a request for a digital component, including a corresponding secret share, to the corresponding computing server of the MPC system. For example, application 107 generates and sends a request for a digital component to MPC1, the request including a first secret share of the probabilistic data structure (i.e., the cuckoo filter). Request parameters include rand_var1a, rand_var1b, and rand_var2. Similarly, application 107 also sends a request for a digital component to MPC2, the request including a second secret share of the probabilistic data structure. Request parameters include vector B, rand_var1a, and rand_var1b.

[0083] In some implementations, after receiving the secret share, each of the computing servers within the MPC system uses the secret share, which is a probabilistic data structure, to perform a secure MPC process to select a digital component. For example, MPC1 can compute an array T, where the i-th element T of the array... i =PRF(rand_var2, i). Note that T and B are two additive secret shares of the cuckoo vector table A. For the purposes of explanation in this document, these two additive secret shares are represented as [A i,1 ] and [A i,2 Also note that MPC1 can calculate [A] i,1 ], and MPC2 receives [A] from application 107. i,2 ].

[0084] Continuing the example above, when determining the eligibility of each digital component, it can be determined whether each digital component is blocked by a set of blocked generic identifiers, and whether the user's user group identifier (e.g., interest group identifier) ​​matches the user group identifier corresponding to the selected value for each digital component. As part of the evaluation, MPC1 can calculate the following:

[0085] [loc 1,1 ] = [A H1 (ug_id(sv)),1]==PRF(ug_id(sv),rand_var2)

[0086] [loc 2,1 ] = [A H2 (ug_id(sv)),1]==PRF(ug_id(sv),rand_var2)

[0087] [block 1,1 ] = [A H1 (blocked_uid(sv)),1]==PRF(blocked_uid(sv),rand_var2)

[0088] [block 2,1 ] = [A H2 (blocked_uid(sv)),1]==PRF(blocked_uid(sv),rand_var2)

[0089] Similarly, MPC2 can calculate the following:

[0090] [loc 1,2 ] = [A H1 (ug_id(sv)),2]==PRF(ug_id(sv),rand_var2)

[0091] [loc 2,2 ] = [A H2 (ug_id(sv)),2]==PRF(ug_id(sv),rand_var2)

[0092] [block 1,2 ] = [A H1 (blocked_uid(sv)),2]==PRF(blocked_uid(sv),rand_var2)

[0093] [block 2,2 ] = [A H2 [(blocked_uid(sv)),2]==PRF(blocked_uid(sv),rand_var2 where sv is the selected value as explained in Table 2.

[0094] Even if the computing server does not access the secret shares of other computing servers in the MPC system, each computing server in the MPC system can use the values ​​determined above to determine the eligibility of different digital components based on the secret share information. Generally, by examining two positions within the secret share of the probability data structure received by the computing servers of the MPC system, each computing server of the MPC determines whether a specific user group identifier (e.g., interest group identifier) ​​corresponding to each selection value (e.g., score, ranking, bid, or other selection value for each digital component) is included in the probability data structure provided by client device 106. Each computing server of the MPC system also determines in the secret share of the probability data structure received by the MPC whether a general identifier corresponding to each selection value is included in a set of blocked general identifiers, wherein the blocked general identifiers are included in the probability data structure provided by the client device. For a digital component to be eligible for distribution, the user group identifier associated with the selection value of that digital component must be found in the probability data structure, and the general identifier of that digital component cannot be found in the probability data structure.

[0095] The calculations listed above result in an instruction to either MPC calculation server to locate the user group identifier (e.g., interest group identifier) ​​associated with the selected value of the digital component in either of two specified locations within their respective secret shares of the probabilistic data structure. For example, the MPC calculation server would execute a secure MPC procedure to compute a value of 1 in the secret share of loc1 or loc2, i.e., the value of loc1 can be obtained from [loc...]. 1,1 ] and [loc 1,2 Reconstruction. Similarly, if either of the two locations of the probability data structure available to the MPC computation server indicates a match with the user group identifier associated with the selected value, then the value of loc2 can be obtained from [loc...]. 2,1 ] and [loc 2,2 Reconstruction. Otherwise, the MPC server will compute a value of 0 in the secret share of both loc1 and loc2, where a value of 0 indicates that no match has been identified between the user group identifier associated with the selection value and the user's user group identifier. The user group identifier associated with the selection value must be identified by the MPC system at one of the locations so that the selection value is eligible and the corresponding digital component is eligible for delivery to client device 106. However, if the digital component is blocked (e.g., by including its generic identifier in the set of blocked generic identifiers), the digital component is still not eligible for delivery even if one of the MPCs identifies a match between the user group identifier of the digital component's selection value and the user's user group identifier.

[0096] Regarding whether a digital component corresponding to a selected value is blocked, according to the relationship shown above, if either of the two positions in the probability data structure indicating the general identifier of the digital component is included in the set of blocked general identifiers, then MPC1 will compute 1 for either block1 or block2. Otherwise, the MPC server will compute 0 for both block1 and block2. If the general identifier is determined by the MPC server to be included in the probability data structure, the digital component will not be eligible for delivery to the client device.

[0097] To determine the eligibility of each selected value and its corresponding numeric component, the results of MPC1 and MPC2 must be evaluated to determine whether the numeric component is blocked and whether the user group identifier associated with the selected value is found in the probabilistic data structure. Continuing the example above, as part of the eligibility determination, MPC1 can determine the eligibility of each candidate selected value (and candidate numeric component), for example, by calculating the secret Boolean parameter [is_candidate] as follows. sv,1 ]

[0098] [is_candidatesv,1 ]=(1-[loc 1,1 ==0]x[loc 2,1 ==0])x[block 1,1 ==0]x[block 2,1 == 0]. Similarly, MPC2 can compute the secret boolean parameter [is_candidate] as follows. sv,2 ]

[0099] [is_candidate sv,2 ]=(1-[loc 1,2 ==0]x[loc 2,2 ==0])x[block 1,2 ==0]x[block 2,2 ==0].

[0100] When a user's user group identifier (e.g., interest group identifier) ​​is found in either of the two designated locations of the secret share of the probability data structure available to the MPC, and a general identifier for the digital component is not found in either of the two designated locations of the secret share of the probability data structure available to the MPC, these operations result in a value of 1, which is an indication of eligibility for selecting a digital component to be delivered to client device 106. If a general identifier is found in either of the two designated locations checked by the MPC, the value will be 0, disqualifying the digital component from delivery. These results can be used as referenced. Figure 2 This is a more detailed description of a part of the digital component selection process for selecting digital components to be delivered to the client device. For example, if its two secret shares are [is_candidate] sv,1 ] and [is_candidate sv,2 If the value of the secret message is 0, the selection value will be considered ineligible, and the selection value cannot be used to trigger the delivery of the corresponding digital component to the client device 106.

[0101] In some implementations, the source of a digital component may provide the MPC system with selection criteria for the digital component, including selection values. These selection values ​​may indicate the amount that the digital component server 108 (or content source) is willing to provide for presentation or user interaction with the digital component. The MPC system may store the selection criteria for future digital component requests received from client devices 106. For each digital component, the content source may also load additional data for the digital component, such as metadata. This additional data may include a user group identifier (e.g., an interest group identifier) ​​corresponding to the user group associated with that digital component. For example, the content source may manage activities that include a collection of digital components, where digital components are distributed to client devices 106 of users who are members of user groups.

[0102] Additional data for the digital component may include context selection signals that indicate the context in which the digital component is eligible, such as the location of client device 106, the spoken language selected for application 107, the generic resource locator (URL) of resources that the digital component can render, and / or excluded URLs of resources that the digital component cannot render. This data for the digital component may also identify the digital component, for example, by using a unique identifier from which the domain of the digital component and / or other appropriate data of the digital component can be obtained.

[0103] In some implementations, the MPC system caches or otherwise stores the selection values ​​of digital components provided to the MPC system for use in digital component requests. In this example, the context signals for the digital component and the selection values ​​may include the context signals included in the digital component request.

[0104] In some implementations, each compute server in an MPC system uses a two-level lookup table (LUT) to store the selected values ​​of digital components. The first level can be keyed by a user group request key (UG_Request_Key). The UG_Request_Key can be a composite message based on a set of context signals (e.g., a set of context signals for a digital component request (e.g., URL, location, language, etc.) or a set of context signals that qualify a digital component to be distributed). That is, the first-level LUT can be keyed based on a set of context signals. The key for the first level can be a hash of the UG_Request_Key, for example, using a hash function such as SHA256. This key can be truncated to a specified number of bits, such as 16 bits, 32 bits, or other suitable number of bits. The value of each key UG_Request_Key in the first-level LUT can indicate a row in the second-level LUT, which includes the data of the digital component eligible for the digital component request, which includes the context signals of the UG_Request_Key. An example first-level LUT is shown in Table 1 below.

[0105] Keywords value SHA256(UG_Request_Key) OK… … OK…

[0106] Table 1

[0107] The second-level LUT can be keyed based on a combination of the user group request key (UG_Request_Key) and the user group identifier from the first-level LUT. Each row in the second-level LUT can be used for a specific selection value for a particular digit component. For example, a content source can submit different selection values ​​for the same digit component, each selection value for a different set of context signals and / or a different user group identifier. Therefore, the selection value of a digit component can vary based on the context.

[0108] A content source (e.g., digital component server 108) can associate digital components with user groups to which the content source wants to present the digital components (e.g., through links or mappings). For example, digital component server 108 can specify that digital components related to men's basketball shoes should be presented to men interested in basketball and / or shoes. In this example, digital component server 108 can provide the MPC system with data indicating that the digital component corresponds to a user group identifier that includes men interested in basketball and / or shoes.

[0109] In some implementations, the key for a row in the second-level LUT can be a hash or code generated based on a combination of the user group request key UG_Request_Key and the user group identifier of the row's numeric component. For example, the key could be a hash-based message authentication code (HMAC) of that combination, which can be represented as HMAC. SHA256 (UG_Request_Key, ug_id).

[0110] Continuing with the previous example of men's basketball shoes, the second-level lookup key for the row containing information about the digital component to be presented to users in the men's basketball shoe group can be a combination of the user group request key UG_Request_Key and the user group identifier ug_id for the men's basketball shoe group. Since the digital component can be presented in different contexts, the second-level lookup table can include multiple rows of the digital component (the user group identifier ug_id for the men's basketball shoe group), each with a different user group request key UG_Request_Key and a different value.

[0111] The value of each row in a Level 2 LUT can be a selection value for a digital component and other data about the digital component, such as metadata identifying the digital component or the network location from which the digital component can be downloaded. This value can be a digital component information element (dc_information_element), which can be a byte array containing the selection value and metadata. The byte array can have a specific format that the application 107 of client device 106 or trusted programs and computing systems MPC1 and MPC2 can parse to obtain the selection value and metadata. An example Level 2 LUT is shown in Table 2 below.

[0112]

[0113]

[0114] Table 2

[0115] The second-level LUT maps the selected value to a specific digital component, a specific user group identifier (ug_id), and a specific set of context signals defined by the first-level lookup keyword (UG_Request_Key). In doing so, the second-level LUT indicates the specific context in which the selected value of the digital component is intended for the digital component slot. This allows the digital component server 108 to specify different selected values ​​for the same digital component for different contexts defined by the context signals and the user's group membership. When a request is received indicating that the user to whom the digital component will be presented is a member of a specific user group identified by the specific user group identifier (ug_id) and that the digital component will be presented in a specific context defined by the context signals of the first-level lookup keyword, any selected value in the second-level LUT that matches the user group identifier and matches the first-level lookup keyword is a candidate selected for distribution in response to that request.

[0116] Figure 2 This is a swimlane diagram of an example process 200 for selecting digital components distributed to client devices. The operation of process 200 can be implemented, for example, by computing systems MPC1 and MPC2 of an MPC system. The operation of process 200 can also be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of these instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 200.

[0117] The computing system MPC1 identifies eligible selection values ​​(202). See above reference. Figure 1 As described in detail, the computing system MPC1 can identify eligible selection values ​​for digital component requests received from application 107. For example, when application 107 initiates a request for a digital component for a slot, the application can send rand_var1a, rand_var1b, and rand_var2 as parameters in the digital component request to MPC1. The digital component request may also include a first-level lookup key generated based on the context signals of the digital component request, such as SHA256 (UG_Request_Key).

[0118] The computing system MPC1 can use the first-level lookup keyword of the digital component request to identify eligible selection values. The computing system MPC1 can access the first-level LUT and use the first-level lookup keyword to identify rows of the second-level LUT, where the rows of the second-level LUT include information about the selection values ​​of the digital components eligible to be presented (e.g., selection values ​​of the digital components that have been received) for the set of context signals represented by the first-level lookup keyword. For example, as described above, each row of the second-level LUT includes information about the digital component and a second-level lookup keyword based on the set of context signals. Therefore, the computing system MPC1 can use the first-level lookup keyword to identify rows of the second-level LUT that have a set of context signals that match the set of context signals defined by the first-level lookup keyword received in the digital component request. These rows include information about digital components that are eligible to be presented or have eligible selection values ​​with the context defined by the first-level lookup keyword received in the digital component request.

[0119] Computing system MPC2 identifies eligible selection values ​​(204). Computing system MPC2 can identify eligible selection values ​​for digital component requests received from client device 106. For example, when application 107 initiates a request for a digital component for a slot, the application sends vectors B, rand_var1a, and rand_var1b to MPC1. The digital component request may also include a first-level lookup key generated based on context signals of the digital component request, such as SHA256 (UG_Request_Key). The first-level lookup key of the digital component request received by computing system MPC2 may be the same as the first-level lookup key received by computing system MPC1.

[0120] For the sake of brevity, the remaining steps of process 200 are described based on a probabilistic data structure that selects a digital component for distribution to application 107 on client device 106 in response to a digital component request. The MPC system can select the digital component to be presented on application 107. For example, both MPC1 and MPC2 perform a secure MPC process to select the digital component, as follows.

[0121] Computing system MPC2 can identify eligible selection values ​​using the first-level lookup keyword requested by the digital component. Computing system MPC2 can access the first-level LUT and use the first-level lookup keyword to identify rows in the second-level LUT, where the rows of the second-level LUT include information about the digital component eligible to be presented (e.g., whose selection value has been received) for the set of context signals represented by the first-level lookup keyword. As described above, each computing system MPC1 and MPC2 can maintain corresponding two-level LUTs including the same information. Similar to MPC2, MPC1 can also identify eligible selection values ​​using the first-level lookup keyword requested by the digital component.

[0122] For each eligible selection value, computing systems MPC1 and MPC2, in response to a digital component request, determine whether the selection value and its digital component are candidates to be selected for distribution to application 107 (206). A candidate selection value is an eligible selection value for a digital component that has a user group identifier that matches the user's user group identifier (e.g., a user group identifier that includes the user as a member) and a generic identifier that is not included in the set of blocked generic identifiers. As described above, each digital component can be mapped to one or more user groups, including members to which the digital component server 108 indicates should be presented. As described above, this information is part of the second-level lookup keyword of the second-level LUT.

[0123] If, by examining two locations within the probability data structure received by the computation server of the MPC system, the user group identifier ug_id, as part of the second-level lookup key corresponding to the row for each selected value (for each numeric component), is included in the probability data structure provided by the client device 106, then the numeric component in the row of the second-level LUT is a candidate for selection. However, if a numeric component is blocked (e.g., by including its generic identifier in the set of blocked generic identifiers), the numeric component is still not eligible for delivery, even if the MPC system recognizes a match between the user group identifier of the numeric component's selected value and the user's user group identifier.

[0124] Computing systems MPC1 and MPC2 can use a secure MPC technique (which uses secret shares so that neither MPC1 nor MPC2 knows which numeric components are candidates or user groups that include users as members) to identify candidate selection values. To this end, computing system MPC1 calculates a first share [is_candidate] of the candidate parameters for each selection value associated with the user group identifier ug_id and associated with the numeric component used as a candidate for selection. sv,1Similarly, the computing system MPC2 computes a second share of the candidate parameters [is_candidate] for each selection value associated with the same digital component and linked to the user group identifier ug_id. sv,2 Candidate parameter [is_candidate] sv,1 [is_candidate] is the first secret share, and [is_candidate] is the first secret share. sv,2 [This is the second secret share.]

[0125] Computing systems MPC1 and MPC2 can use secret sharing techniques or libraries that support the operations shown in Table 3 below. One example of a secret sharing technique that supports these operations is Security Through Private Information Aggregation (SEPIA).

[0126]

[0127]

[0128] Table 3

[0129] Computation server MPC1 determines the order of the selected values ​​(208). Similarly, computation server MPC2 determines the order of the selected values ​​(210). These two orders should be identical because the inputs to the sorting process are the same on both computation systems MPC1 and MPC2. Each computation server MPC1 and MPC2 can determine the order of the selected values ​​in its second-level LUT. This order can include all selected values ​​associated with UG_Request_key in the second-level LUT, including candidate selected values ​​and those not considered candidates. The order can be from the highest selected value to the lowest selected value. In some implementations, the selected values ​​used for the order can be values ​​that will be provided to the website publisher, where these values ​​will be used to present the selected digital components. Since the selected values ​​are in plaintext, computation servers MPC1 and MPC2 do not need to perform any round-trip computations to sort the selected values. Instead, each computation system MPC1 and MPC2 can independently sort the selected values ​​associated with UG_Request_key in its second-level LUT. If the selection values ​​are stored as secret shares at each computing server MPC1 and MPC2, and each computing server MPC1 and MPC2 has a corresponding secret share for each selection value, then computing servers MPC1 and MPC2 can use round-trip computation to perform a secure MPC process to sort the selection values. If a tie exists between two or more selection values, computing systems MPC1 and MPC2 can deterministically break the tie using additional metadata corresponding to the digital components of those selection values.

[0130] Computation servers MPC1 and MPC2 determine a secret share of the cumulative value for each candidate selection value (212). Conceptually, the cumulative value of a given selection value of a digital component represents the total number of candidate selection values ​​from the top of the order to the given selection value, including the given selection value if it is a candidate.

[0131] Table 4 below illustrates this concept.

[0132]

[0133]

[0134] Table 4

[0135] In this table, for each selected value with a candidate parameter `is_candidate` equal to 1, the cumulative value (acc) increases as it progresses from the top to the bottom of the sequence. For example, because the candidate parameter `is_candidate` of the highest selected value is zero, the cumulative value `acc` of the highest selected value is zero. Because the candidate parameter `is_candidate` of the second selected value is 1, and none of the selected values ​​above the second highest selected value have a candidate parameter `is_candidate` equal to 1, the cumulative value `acc` of the second highest selected value is 1. Moving down the sequence, the candidate parameter `is_candidate` of the third highest selected value is zero, so the cumulative value `acc` of the third highest selected value does not increase from the cumulative value `acc` of the second highest selected value. Since the candidate parameter `is_candidate` of the fourth highest selected value is 1, the cumulative value `acc` of the fourth highest selected value increases by 1 from the cumulative value of the third highest selected value. Therefore, because there are two selected values ​​from the highest selected value to the fourth highest selected value (inclusive) with a candidate parameter `is_candidate`, the cumulative value `acc` of the fourth highest selected value is 2.

[0136] Using this table, computing systems MPC1 and MPC2 will select the numerical component corresponding to the selection parameter to assign to application 107, where for this selection parameter, the candidate parameter is_candidate has a value of 1 and the cumulative value acc has a value of 1, as shown in the fourth column of Table 4. This indicates the highest-ranking selection value with a candidate parameter is_candidate value of 1. Since the candidate parameter is_candidate is held in a secret share by computing systems MPC1 and MPC2 to maintain user privacy and ensure user data is not leaked, computing systems MPC1 and MPC2 determine a secret share of the cumulative value acc for each selection value and use round-trip computation to determine which selection value has a cumulative value acc equal to 1 and a candidate parameter is_candidate equal to 1.

[0137] Computation servers MPC1 and MPC2 can independently determine the secret share of the cumulative value acc for each selected value without any round trip computation. For example, as shown in Table 4 above, computation server MPC1 can determine the first share of the cumulative value acc for each selected value sv by traversing all selected values ​​in descending order and summing the candidate parameter is_candidate of the selected values ​​in the process. sv,1 Similarly, the computation server MPC2 can determine the second share of the cumulative value acc for each selected value by iterating through all selected values ​​in descending order and summing the candidate parameter is_candidate of the selected values ​​in the process. sv,2 ].

[0138] Computation servers MPC1 and MPC2 determine a secret share (214) for each selected value that indicates whether the cumulative value has a specified result. As shown in columns 3 and 4 of Table 4, the specified value can be the value 1. As mentioned above, the selected value with a cumulative value of 1 and a candidate parameter is_candidate of 1 is the highest selected value among the candidate selected values.

[0139] Computation servers MPC1 and MPC2 can participate in multiple rounds of computation, such as multiple remote procedure calls (RPCs), as part of a secure MPC process to compute equations acc with respect to a secret share of each selected value. sv == 1. At the end of this process, the computation server MPC1 has a secret share of the result for each selected value. sv,1 == 1, and calculate server MPC2 for each selected value, which has another secret share of acc. sv,2 ==1.

[0140] Computation servers MPC1 and MPC2 determine the selection result (216). Computation servers MPC1 and MPC2 can determine the selection result based on each selection value, acc sv The secret share of ==1 and the candidate parameter is_candidate sv The secret share is used to determine the selection result. To this end, computation servers MPC1 and MPC2 can calculate the winner parameter [is_winner] based on the secret share. sv,1 ] and [is_winner sv,2 The winner parameter can be a Boolean value that indicates whether the selected value is the winner of the selection process; for example, whether the digital component corresponding to the selected value is selected to be distributed to application 107 in response to a digital component request.

[0141] Each compute server, MPC1 or MPC2, can collaborate to execute an encryption protocol, calculating the winner parameter for each chosen value in terms of secret share. This requires an RPC between compute servers MPC1 and MPC2 to multiply the two secret shares. At the end of this MPC process, compute server MPC1 has the result is_winner. sv A secret share, denoted as [is_winner] sv,1 ] = [is_candidate sv,1 ]x([acc sv,1 ]==1). Similarly, the compute server MPC2 has the result is_winner. sv Another secret share is represented as [is_winner] sv,2 ] = [is_candidate sv,2 ]x([acc sv,2 [==1]. Note that for all selected values, at most one selected value has a winner parameter is_winner equal to 1. sv This corresponds to the digital component selected for distribution to application 107. All others are equal to zero.

[0142] The calculation servers MPC1 and MPC2 can calculate the selection result based on the winner parameter of the selected value and the information_element of the selected value's numerical component, or the selected value itself. As mentioned above, the information_element of the numerical component can include the selected value of the numerical component and other data of the numerical component.

[0143] The following relation 1 can be used to calculate the selection result for servers MPC1 and MPC2. F1 .

[0144] (1)

[0145] In this example, select the result. F1 The value will be zero (if there is no cached selection value with a user group identifier that matches the user's user group identifier), or the selection result will be zero. F1 The value is equal to is_winner with a value of 1. sv The selected digital component's information element, `information_element`. In another example, the information element `information_element` can be replaced in relation 1 with the selected value of the digital component. In this example, the selection result is `result`. F1The value is zero (if there is no cached selection value with a user group identifier that matches the user's user group identifier), or the selection result is zero. F1 The value is equal to is_winner with a value of 1. sv The selected value of the chosen digital component.

[0146] In order to perform computations with secret shares, the computation system MPC1 acquires all selection values ​​and, in this way, the information element (which can be in plaintext form) of the selection values. sv Multiply by the winner parameter [is_winner] sv,1 The first secret share of the result is determined by the calculation system MPC1. The system can then determine the sum of these products and return the sum to the client device 106 that submitted the digital component request. That is, MPC1 can determine the sum as the first share of the result using the following relation 2.

[0147] (2)

[0148] The computing system MPC2 can perform similar calculations to determine the second share of the result using the following relation 3.

[0149] (3)

[0150] Computation system MPC1 can return the first share of the selection result to application 107. Similarly, computation system MPC2 can return the second share of the selection result to application 107. Application 107 can then, for example, determine the sum of the secret shares, assuming an additive secret share algorithm is used, using the two secret shares. and Reconstruct the selection result in plaintext F1 If you select the result... F1 If the value is zero, the MPC cluster has not identified a numeric component for a user group that includes that user as a member. Otherwise, select the result. F1 Having a value equal to the information_element of the digital component, application 107 can parse the information_element to obtain the selection value and metadata of the digital component. Application 107 can then display the digital component as described above or perform a selection process using the digital component received from the digital component server 108 and other digital components.

[0151] In some implementations, application 107 may perform a final verification, namely, matching the user groups of the digital components selected by the MPC system with user groups that include the user as a member. For example, the digital component information element (information_element) of each digital component may include the digital component's (multiple) user group identifiers. Application 107 may compare the user group identifiers of the digital component information element (information_element) with the user's user group list. If there is no match, application 107 may exclude the digital component from the selection process. If a match exists, application 107 may include the digital component in the selection process.

[0152] Figure 3 This is a flowchart of an example process for distributing digital components to client devices. The operation of process 300 is described below by... Figure 1 The components of the system described and depicted herein perform the operation. The operation of process 300 is described below for illustrative purposes only. The operation of process 300 can be performed by any suitable device or system (e.g., any suitable data processing apparatus). The operation of process 300 can also be implemented as instructions stored on a non-transitory computer-readable medium. Execution of the instructions causes one or more data processing apparatuses to perform the operation of process 300.

[0153] A generic identifier is generated for the digital component presented in the browser (310). After retrieving the activity identifier and the eTLD+1 of the domain of the digital content provider (also known as the content source) for a specific digital component, application 107 can generate a generic identifier for the specific digital component. In some implementations, the content source can compute the generic identifier. The generic identifier of the digital component can be computed using a hash-based message authentication code (HMAC) parameterized by the activity identifier and the domain of the digital component server 108 (denoted as HMAC(campaign_identifier, eTLD+1)). In some implementations, HMAC can be implemented using a secure hash algorithm (SHA-256), which is a cryptographic hash function with a 256-bit digest length to produce a 256-bit (32-byte) hash output. In such an example, HMAC(campaign_identifier, eTLD+1) generates a 256-bit unique identifier for the digital component as the generic identifier.

[0154] Update the set of generic identifiers already created for the digital component (320). Application 107 maintains a set of generic identifiers that uniquely identify digital components across all digital component servers 108 throughout the entire activity space. After calculating / generating a generic identifier for a specific digital component delivered to and presented on client device 106, application 107 updates the set of generic identifiers with the generic identifier of the specific digital component. For example, if a generic identifier for a specific digital component does not exist in the set, application 107 adds the generic identifier of the specific digital component to the set and increments the corresponding presentation counter by 1. If a generic identifier for a specific digital component already exists in the set, application 107 updates the corresponding presentation counter of the generic identifier, for example, by incrementing the counter by 1.

[0155] A set of blocked generic identifiers corresponding to a generic identifier is identified (330). Application 107, executing at client device 106, can maintain this set of blocked generic identifiers, which includes generic identifiers of digital components that have recently been explicitly blocked by the user. For example, suppose a user interacts with a mute element corresponding to a given digital component (or a portion of data delivered to client device 106). In this example, the user's interaction with the mute element is an indication that the user does not want to see that digital component or potentially similar digital components (e.g., from the same content source or activity, or visually similar) in the future (e.g., at least for a certain amount of time). In response to this interaction, application 107 can add the generic identifier of the given digital component to the set of blocked generic identifiers, which can then be used to block the delivery (or presentation) of other digital components with the same generic identifier as the given digital component.

[0156] Application 107 can add the generic identifiers of digital components that have been delivered / presented at least a predetermined number of times (e.g., more than X times within a specified time period, such as a day, a week, a month, etc.) to the set of blocked generic identifiers. For example, when a digital component with the generic identifier 1A2B3C has been delivered / presented to a specific user more than X times in the past Y days, application 107 can add the generic identifier 1A2B3C to the set of blocked generic identifiers stored at the client device 106.

[0157] A probabilistic data structure (240) is generated representing the set of blocked generic identifiers and the user group identifier. Application 107 can generate a probabilistic data structure representing the set of blocked generic identifiers and the user group to which the client device 106 (or user) belongs. In some implementations, the probabilistic data structure is a cuckoo filter. To generate the cuckoo filter, application 107 uses a pseudo-random function (PRF) parameterized by either the user group identifier or a generic identifier from the set of blocked generic identifiers, and either of two random variables generated by application 107. For example, suppose the three random variables generated by application 107 are rand_var1a, rand_var1b, and rand_var2. It is also assumed that each item in the bucket is a k-bit integer. The application can generate a Cuckoo Filter table containing PRF(ug_id, rand_var1a) and PRF(blocked_uid, rand_var1b), where ug_id is the identifier of the user group generated by applying HMAC to the tag of the user group based on the content provider's domain, and blocked_uid is the identifier from the set of blocked generic identifiers.

[0158] Create multiple shares (250) of the probabilistic data structure. Application 107 can generate vector B based on the cuckoo filter table generated for the set of user group identifiers and blocked generic identifiers. i Vector B can be represented as B i =PRF(rand_var2, i) – A i A i This is the content of the i-th entry in the cuckoo filter table, where i is vector B. i And Cuckoo Filter Table A i The index. Application 107 generates rand_var1a, rand_var1b, and rand_var2 as parameters in the digital component request sent to MPC1. Application 107 also generates vector B, rand_var1a, and rand_var1b as parameters in the digital component request sent to MPC2.

[0159] Different shares of the multiple shares are sent to different servers (260). For example, when application 107 makes a request for a digital component for a slot, the application sends rand_var1a, rand_var1b, and rand_var2 as request parameters to MPC1. Application 107 also sends vector B, rand_var1a, and rand_var1b as request parameters to MPC2.

[0160] Each of the different servers receives a separate response (270) generated based on a different share among multiple shares sent to the different servers. Upon receiving the secret share, each of the various computation servers within the MPC system performs a secure MPC process using the secret share in a probabilistic data structure to select a digital component. For example, MPC1 can compute an array T, where the i-th element T of the array... i =PRF(rand_var2, i). When determining the eligibility of each numeric component for selection, it can be determined whether each numeric component is blocked by a set of blocked generic identifiers, and whether the user's user group identifier (e.g., interest group identifier) ​​matches the user group identifier corresponding to the selection value of each numeric component.

[0161] Each computing server in the MPC system can determine the eligibility of different digital components using determined values ​​based on secret share information. Each computing server in the MPC system also determines, within the secret share of the probability data structure received by the MPC, whether the general identifier corresponding to each selection value is included in the set of blocked general identifiers, wherein the blocked general identifiers are included in the probability data structure provided by the client device. For a digital component to be eligible for distribution, a user group identifier associated with the selection value of that digital component must be found in the probability data structure, and the general identifier of that digital component cannot be found in the probability data structure.

[0162] Reference Figure 2 The details of the selection process were explained. Subsequently, the MPC system's computation server calculated the selection result. F1 Generate result F1 The system calculates the secret share of the selection result and sends the corresponding secret share to application 107. For example, MPC1 can return the first share of the selection result to application 107. Similarly, computing system MPC2 can return the second share of the selection result to application 107.

[0163] Identify the digital components to be presented in the browser (280). Application 107 can reconstruct the selection result in plaintext using the secret share received from the computing server of the MPC system. F1 For example, applying 107, two secret shares can then be used, and the selection result can be reconstructed in plaintext form, for example, by determining the sum of the secret shares. F1 .

[0164] Figure 4This is a block diagram of an example computer system 400 that can be used to perform the operations described above. System 400 includes a processor 410, memory 420, storage device 430, and input / output device 440. Each of components 410, 420, 430, and 440 may be interconnected, for example, using a system bus 450. Processor 410 is capable of processing instructions that execute within system 400. In one embodiment, processor 410 is a single-threaded processor. In another embodiment, processor 410 is a multi-threaded processor. Processor 410 is capable of processing instructions stored in memory 420 or on storage device 430.

[0165] The memory 420 stores information within the system 400. In one embodiment, the memory 420 is a computer-readable medium. In one embodiment, the memory 420 is a volatile memory cell. In another embodiment, the memory 420 is a non-volatile memory cell.

[0166] Storage device 430 provides high-capacity storage for system 400. In one embodiment, storage device 430 is a computer-readable medium. In various other embodiments, storage device 430 may include, for example, a hard disk drive, an optical disk drive, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other high-capacity storage device.

[0167] Input / output device 440 provides input / output operations for system 400. In one embodiment, input / output device 440 may include one or more of a network interface device (such as an Ethernet card), a serial communication device (e.g., an RS-232 port), and / or a wireless interface device (e.g., an 802.11 card). In another embodiment, input / output device may include a driver device configured to receive input data and send output data to other input / output devices (e.g., a keyboard, printer, and display device). However, other embodiments may also be used, such as mobile computing devices, mobile communication devices, set-top box television client devices, etc.

[0168] Although already Figure 4 An example processing system is described herein, but the implementation of the subject matter and functional operation described herein may be implemented in other types of digital electronic circuits, or in computer software, firmware, or hardware that includes the structures disclosed herein and their equivalents, or in a combination of one or more of them.

[0169] An electronic document (for simplicity, it will be referred to as a document) does not necessarily correspond to a file. A document can be stored as a part of a file that contains other documents, as a single file dedicated to the document in question, or as multiple collaborative files.

[0170] The embodiments of the subject matter and operation described in this specification can be implemented in digital electronic circuits, or in computer software, firmware, or hardware that includes the structures disclosed in this specification and their equivalents, or in a combination of one or more of these. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a computer storage medium (or media) for execution by a data processing apparatus or for controlling the operation of a data processing apparatus. Alternatively or additionally, the program instructions may be encoded on artificially generated propagation signals (e.g., machine-generated electrical, optical, or electromagnetic signals) that are generated to encode information for transmission to a suitable receiver device for execution by the data processing apparatus. The computer storage medium may be or be included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of these. Furthermore, although the computer storage medium is not a propagation signal, it may be a source or destination of computer program instructions encoded in artificially generated propagation signals. The computer storage medium may also be or be included in one or more separate physical components or media (e.g., multiple optical discs, magnetic disks, or other storage devices).

[0171] The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0172] The term "data processing apparatus" includes all kinds of devices, apparatuses, and machines for processing data, including, for example, programmable processors, computers, systems-on-a-chip, or a combination thereof. The apparatus may include special-purpose logic circuitry, such as field-programmable gate arrays (FPGAs) or application-specific integrated circuits (ASICs). In addition to hardware, the apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or combinations thereof. The apparatus and execution environment can implement various computing model infrastructures, such as network services, distributed computing, and grid computing infrastructures.

[0173] Computer programs (also known as programs, software, software applications, scripts, or code) can be written in any programming language (including compiled or interpreted languages, declarative or procedural languages) and can be deployed in any form (including as standalone programs or as modules, components, subroutines, objects, or other units suitable for use in a computing environment). Computer programs can, but are not required to, correspond to files in a file system. Programs can be stored as a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple co-located files (e.g., a file storing one or more modules, subroutines, or portions of code). Computer programs can be deployed to execute on a single computer, located at a site, or distributed across multiple sites and interconnected via a communication network.

[0174] The processes and logic flows described in this specification can be executed by one or more programmable processors that execute one or more computer programs to perform actions by manipulating input data and generating outputs. These processes and logic flows can also be executed by special-purpose logic circuits, and the apparatus can be implemented as special-purpose logic circuits, such as field-programmable gate arrays (FPGAs) or application-specific integrated circuits (ASICs).

[0175] For example, processors suitable for executing computer programs include both general-purpose and special-purpose microprocessors. Typically, a processor receives instructions and data from read-only memory or random access memory, or both. The basic components of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include, or be operatively coupled to, one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, to receive data from or send data to, or both. However, a computer does not necessarily have to have such devices. Furthermore, a computer can be embedded in another device (e.g., a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive)). Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example: semiconductor memory devices such as EPROM, EEPROM, and flash memory devices; disks such as internal hard disks or removable disks; magneto-optical disks; and optical disks and DVDs. The processor and memory may be complemented or integrated therein by special-purpose logic circuitry.

[0176] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user, such as a cathode ray tube (CRT) or liquid crystal display (LCD) monitor, and a keyboard and pointing device, such as a mouse or trackball, for the user to provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual, auditory, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Furthermore, the computer can interact with the user by sending documents to and receiving documents from the device used by the user; for example, by sending a webpage to a web browser on the user's client device in response to a request received from a web browser.

[0177] Embodiments of the subject matter described in this specification can be implemented in a computing system that includes back-end components, such as a data server, or middleware components, such as an application server, or front-end components, such as a client computer having a graphical user interface or a web browser through which a user can interact with an implementation of the subject matter described in this specification, or any combination of one or more such back-end, middleware, or front-end components. The components of the system can be interconnected via digital data communication (e.g., a communication network) of any form or medium. Examples of communication networks include local area networks (“LANs”) and wide area networks (“WANs”), internal networks (e.g., the Internet) and peer-to-peer networks (e.g., self-organizing peer-to-peer networks).

[0178] A computing system may include clients and servers. Clients and servers are typically geographically separated and usually interact via a communication network. The client-server relationship is generated by computer programs running on their respective computers and having a client-server relationship with each other. In some embodiments, the server sends data (e.g., HTML pages) to the client device (e.g., for the purpose of displaying data to a user interacting with the client device and receiving user input from it). Data generated at the client device (e.g., the result of user interaction) can be received from the client device at the server.

[0179] While this specification contains numerous specific implementation details, these should not be construed as limiting any invention or the scope of the claims, but rather as descriptions of specific features of particular embodiments of a particular invention. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually in multiple embodiments or in any suitable sub-combination. Furthermore, although features may be described above as functioning in certain combinations, and even initially claimed in this way, in some cases, one or more features from a claimed combination may be removed from the set, and the claimed combination may refer to a sub-combination or a variation of a sub-combination.

[0180] Similarly, although operations are described in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order or sequence shown, or requiring all of the shown operations to obtain the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of the various system components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated into a single software product or packaged into multiple software products.

[0181] Therefore, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions listed in the claims may be performed in a different order and the desired result may still be obtained. Furthermore, the processes described in the drawings do not necessarily require the specific order or sequence shown to obtain the desired result. In some embodiments, multitasking and parallel processing may be advantageous.

Claims

1. A computer-implemented method comprising: generating, by an application and for a digital component presented in the application, a universal identifier that is an encrypted version of a combination of (i) an activity identifier for a content source that provides the digital component and (ii) a domain of the content source; updating, by the application and based on the generated universal identifier, a set of universal identifiers that have been created for digital components presented by the application within a specified time period; identifying, by the application, a set of blocked universal identifiers that correspond to universal identifiers that have been (i) generated by the application and (ii) blocked from being used for future presentation of digital components in the application; generating, by the application, a probabilistic data structure that represents the set of blocked universal identifiers; creating, by the application, a plurality of shares of the probabilistic data structure; sending, by the application, different shares of the plurality of shares to different servers; receiving, by the application, individual responses generated by each of the different servers based on different shares of the plurality of shares sent to the different servers; and identifying, by the application and based on a combination of the individual responses, a digital component to be presented in the application.

2. The method of claim 1, further comprising: detecting, by the application, an interaction with a mute element that corresponds to a given digital component presented in the application; and in response to detecting the interaction with the mute element in a most recent time frame, updating the set of blocked universal identifiers to include a universal identifier of the given digital component.

3. The method of claim 1, wherein, updating the set of universal identifiers includes incrementing a presentation counter that indicates a frequency of presentation of digital components having a particular universal identifier in response to the digital component associated with the particular universal identifier being presented by the application.

4. The method of claim 3, further comprising adding the particular universal identifier to the set of blocked universal identifiers when the presentation counter exceeds a specified value.

5. The method of claim 1, wherein, generating the probabilistic data structure includes generating a probabilistic data structure that represents (i) the set of blocked universal identifiers and (ii) a set of user group identifiers that correspond to user groups assigned to users of the application.

6. The method of claim 5, wherein, generating the probabilistic data structure further includes using a pseudo-random function parameterized by two or more random variables.

7. The method of claim 1, wherein, the universal identifier of the digital component is generated by an entity that provides the digital component.

8. The method of claim 1, wherein, the probabilistic data structure is a cuckoo filter.

9. A system for data processing, comprising: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the system to perform operations comprising: generating, by an application and for a digital component presented in the application, a universal identifier that is an encrypted version of a combination of (i) an activity identifier for a content source that provides the digital component and (ii) a domain of the content source; updating, by the application and based on the generated universal identifier, a set of universal identifiers that have been created for digital components presented by the application within a specified time period; ​ identifying, by the application, a set of blocked universal identifiers corresponding to universal identifiers that have been (i) generated by the application and (ii) blocked from being used to present future digital components in the application; generating, by the application, a probabilistic data structure representing the set of blocked universal identifiers; creating, by the application, a plurality of shares of the probabilistic data structure; sending, by the application, different ones of the plurality of shares to different servers; receiving, by the application, separate responses generated by each of the different servers based on different ones of the plurality of shares sent to the different servers; and identifying, by the application and based on a combination of the separate responses, a digital component to be presented in the application.

10. The system of claim 9, wherein, The operations further include: detecting, by the application, an interaction with a mute element corresponding to a given digital component presented in the application; and responsive to detecting the interaction with the mute element in a most recent time frame, updating the set of blocked universal identifiers to include a universal identifier of the given digital component.

11. The system of claim 9, wherein, Updating the set of universal identifiers includes incrementing a presentation counter indicating a frequency of presentation of digital components having a particular universal identifier responsive to the particular universal identifier being associated with a digital component presented by the application.

12. The system of claim 11, wherein, The operations further include adding the particular universal identifier to the set of blocked universal identifiers when the presentation counter exceeds a specified value.

13. The system of claim 9, wherein, Generating the probabilistic data structure includes generating a probabilistic data structure representing (i) the set of blocked universal identifiers and (ii) a set of user group identifiers corresponding to user groups assigned to users of the application.

14. The system of claim 13, wherein, Generating the probabilistic data structure further includes using a pseudo-random function parameterized by two or more random variables.

15. The system of claim 9, wherein, The universal identifier of the digital component is generated by an entity providing the digital component.

16. The system of claim 9, wherein, The probabilistic data structure is a cuckoo filter.

17. A non-transitory computer-readable medium storing instructions that, when executed by one or more data processing apparatuses, cause the one or more data processing apparatuses to perform operations comprising: generating, by an application and for a digital component presented in the application, a universal identifier that is an encrypted version of a combination of (i) an activity identifier of a content source used to provide the digital component and (ii) a domain of the content source; updating, by the application and based on the generated universal identifier, a set of universal identifiers that have been created for digital components presented by the application in a specified time period; identifying, by the application, a set of blocked universal identifiers corresponding to universal identifiers that have been (i) generated by the application and (ii) blocked from being used to present future digital components in the application; generating, by the application, a probabilistic data structure representing the set of blocked universal identifiers; creating, by the application, a plurality of shares of the probabilistic data structure; sending, by the application, different ones of the plurality of shares to different servers; receiving, by the application, separate responses generated by each of the different servers based on different ones of the plurality of shares sent to the different servers; and identifying, by the application and based on a combination of the separate responses, a digital component to be presented in the application. receiving, by the application, a separate response generated by each of the different servers based on a different share of the plurality of shares sent to the different servers; and identifying, by the application and based on a combination of the separate responses, a digital component to be presented in the application.

18. The non-transitory computer-readable medium of claim 17, wherein, The operations further include: detecting, by the application, an interaction with a mute element corresponding to a given digital component presented in the application; and in response to detecting the interaction with the mute element in a most recent time frame, updating the set of blocked universal identifiers to include a universal identifier of the given digital component.

19. The non-transitory computer-readable medium of claim 17, wherein, Generating the probabilistic data structure includes generating a probabilistic data structure representing (i) the set of blocked universal identifiers and (ii) a set of user group identifiers corresponding to user groups assigned to users of the application.

20. The non-transitory computer-readable medium of claim 19, wherein, Generating the probabilistic data structure further includes using a pseudo-random function parameterized by two or more random variables.

Images