Improving content selection process integrity using secure multi-party computation

Abstract

This document describes systems and techniques for improving integrity and protecting information security in content selection and distribution. In one aspect, a method includes receiving, by a first server of a secure multi-party computation (MPC) system, a request for a digital component from an application on a user device. The request is parsed into different sub-requests. Each sub-request is transmitted to a different server. A set of candidate selection values is received from the separate servers. The first server collaborates with one or more second servers of the MPC system to perform a selection process to generate a selection result of a winning digital component, including merging the first set of candidate selection values and a set of cached selection values to create a final set of candidate selection values, and ordering the final set according to values of the candidate selection values.

Description

[0001] Cross-references to related applications

[0002] This application claims priority to IL application No. 279405, filed on December 13, 2020. The disclosure of the aforementioned application is incorporated herein by reference. Technical Field

[0003] This manual addresses data security and integrity. Background Technology

[0004] Secure multi-party computation (MPC) is an encryption protocol that prevents data access by distributing computation across multiple parties, preventing any single party from accessing the data of another party. MPC computing systems use secret shares of data to perform computations. Summary of the Invention

[0005] Generally, an innovative aspect of the subject matter described in this specification can be embodied in a method comprising: receiving a request for a digital component from an application on a user device by a first server of a secure multi-party computation (MPC) system; resolving the request into two or more distinct sub-request portions by the first server; transmitting each of the two or more distinct sub-requests to a different server by the first server; receiving a first set of candidate selection values ​​from a separate server in response to transmitting the two or more distinct sub-requests; performing a selection process in cooperation with one or more second servers of the MPC system to generate a selection result for a winning digital component, including merging the first set of candidate selection values ​​and a set of cached selection values ​​by the first server to create a final set of candidate selection values; sorting the final set of candidate selection values ​​according to the values ​​of the candidate selection values ​​by the first server; applying each of a set of two or more selection rules by the first server; and transmitting the selection result for the winning digital component to the user device in cooperation with one or more second servers.

[0006] These and other implementations may optionally include one or more of the following features. In some implementations, the method includes receiving a notification from an application on a user device by a first server of the secure MPC system, the notification including data indicating that a winning digital component is presented on the client device. In some implementations, the notification is received by the first server of the secure MPC system along with a second request for a second selection value, the notification including data indicating that a digital component corresponding to the winning selection value is presented on the client device.

[0007] In some implementations, transmitting the selection result of the winning digital component from the final selection process includes receiving a first secret share of the selection result from each second server of the secure MPC system by a first server of the secure MPC system, and transmitting (i) each first secret share of the selection result and (ii) a second secret share of the selection result to the client device by the first server of the secure MPC system.

[0008] In some implementations, receiving the first set of candidate selection values ​​includes receiving at least two secret shares of each candidate selection value from a separate server. In some implementations, merging and sorting can be performed by the first server as a single comparison-based sorting process.

[0009] In some implementations, this set of selection rules includes at least privacy-preserving anonymization enforcement rules.

[0010] Other embodiments of this aspect include corresponding systems, apparatuses, and computer programs coded on computer storage devices, configured to perform the actions of the method.

[0011] The subject matter described in this specification may be implemented in certain embodiments to achieve one or more of the following advantages.

[0012] The proposed architecture employs a secure MPC process executed by two or more MPC servers operated by different parties to select digital components based on a secret share of user information. This ensures that neither the MPC server nor another party can access user information in plaintext or plaincode form without unauthorized collusion between the MPC servers. This MPC process is used to implement privacy protection measures and reduce transmissions between requesting client devices and the MPC cluster.

[0013] The MPC cluster also performs a final selection process and can directly transmit a secret share of the result to the requesting client device, the result of which identifies the selected numeric component chosen by the MPC cluster using a secure MPC process. Because the final selection process is performed on the MPC cluster rather than on the requesting client device, only the selection value of the winning numeric component is transmitted to the requesting client device, rather than information on all or a large set of numeric components. This reduces the amount of data transmission required, decreases the bandwidth consumed in transmitting information, reduces transmission latency, and reduces the amount of processing power required to transmit information and the associated battery power of battery-powered devices (e.g., mobile devices).

[0014] Furthermore, caching data locally on a specific computing system reduces latency for future requests of any cached data. Reducing content rendering latency also reduces the number of errors that occur while user devices are waiting for such content to arrive. Since content typically needs to be delivered to wirelessly connected mobile devices within milliseconds, reducing the latency of selecting and delivering content is crucial for preventing errors and minimizing user frustration.

[0015] This process also reduces the likelihood of confidential information leakage from content platforms submitting digital component selection values ​​to the MPC cluster by limiting the number of digital components that provide information to client devices. The described technology provides a simplified process for maintaining advanced privacy. The system offers a high standard of user privacy without requiring significant changes to the demand-side platform.

[0016] Various features and advantages of the foregoing subject matter are described below with reference to the accompanying drawings. Additional features and advantages will be apparent from the subject matter and claims described herein. Attached Figure Description

[0017] Figure 1 This is a block diagram of an environment where an MPC cluster performs a secure MPC process to select digital components for allocation to client devices.

[0018] Figure 2 It is a data flow diagram used to select digital components to provide an example process for displaying or assigning to client devices.

[0019] Figure 3 It is a swimlane diagram used to select digital components to provide an example process for displaying or assigning to client devices.

[0020] Figure 4 This is a flowchart illustrating an example process for selecting digital components to assign to a client device.

[0021] Figure 5 This is a block diagram of an example computer system.

[0022] The same reference numerals and names in each figure indicate the same elements. Detailed Implementation

[0023] In summary, this document describes systems and techniques for improving information integrity and protecting information security during content selection and distribution. An MPC cluster of server computers can perform a secure MPC process to select digital components based on user information, ensuring that no single MPC server can access user information in plaintext without unauthorized collusion. Probabilistic data structures can be used to send user information to the MPC cluster to reduce the data size of information transmitted over the network and maintain information security during transmission. In some implementations, additional techniques including distributed point functionality can be used to send user information to the MPC cluster.

[0024] The MPC cluster provides a secure environment for performing a selection process to choose a value mapped to a digital component in response to a request from a client device. Performing this selection process at the MPC cluster offers improved process integrity and user privacy compared to performing the final selection process at the requesting client device, which requires transmitting securely determined candidates from the MPC cluster to the client device. Furthermore, the client device presents an environment where fraud prevention is more difficult—once candidate selection values ​​are received, the final selection process is typically performed in plaintext and can be easily manipulated. By performing the final selection process at a secure MPC cluster, the described system offers many advantages over performing the process at the client device.

[0025] For example, a client device might transmit requests for digital components based on potentially sensitive information such as the user group to which the user might belong, and transmit separate requests for digital components based on non-sensitive information such as the context in which the digital component will be presented in a single digital component slot, in order to protect user privacy. This process could result in the client device transmitting twice as many requests for digital components as there are available digital component slots, and receiving twice as many candidates from potentially multiple different servers in response to these requests. The additional requests and responses require additional bandwidth and battery power, which could degrade the user's online experience. The described system reduces the amount of transmission required between the client device and another server: because the MPC cluster is performing the entire selection process, the client device can send only one request to the servers in the MPC cluster, and the client device can receive only one response from the MPC cluster.

[0026] In some cases, it is beneficial for users to receive digital components (or other data) related to web pages, application pages, or other electronic resources that they have previously visited and / or interacted with. To assign such digital components to users, users can be assigned to user groups based on the digital content they access, such as user interest groups, queues of similar users, or other group types involving data from similar users. For example, when a user visits a specific website and interacts with a specific item presented on that website or adds an item to a virtual shopping cart, that user can be assigned to a user group that has visited the same website or other websites with similar contexts, or that is interested in the same item. For instance, if a user of client device 110 searches for shoes and visits multiple web pages from different shoe manufacturers, that user can be assigned to the user group "Shoes," which may include identifiers of all users who have visited shoe-related websites.

[0027] In some implementations, user group memberships can be maintained on the user's client device 110, for example, through a browser-based application, rather than through a digital composition server, content provider, or other party. User groups can be designated by corresponding tags. User group tags can describe the group (e.g., a gardening group) or represent the group using codes (e.g., non-descriptive alphanumeric sequences). User group tags can be stored in secure storage on the client device 106, and / or can be encrypted during storage to prevent unauthorized access to the list.

[0028] In some implementations, a hash-based Message Authentication Code (HMAC), parameterized by the user group's label and the content provider's domain, can be used to generate the user group identifier, denoted as HMAC(user_group_label, eTLD+1). In some implementations, HMAC can be implemented using a secure hash algorithm (SHA-256), a cryptographic hash function with a 256-bit digest length, to produce a hashed 256-bit (32-byte) output. In such an example, HMAC(user_group_label, eTLD+1) generates a 256-bit unique identifier for the user group as the user group identifier.

[0029] A user's membership in a user group can be used to select digital components or other content that the user may be interested in, or to otherwise benefit the user / client device (e.g., to help the user complete a task). For example, such digital components or other content may include data that improves the user experience, improves the operation of the user's device, or otherwise benefits the user or client device.

[0030] The MPC cluster forwards digital component requests, or a portion thereof, to the Supply-Side Platform (SSP) to request candidate selection values, while simultaneously masking sensitive information from the SSP, such as requesting the IP address of the client device. An IP address is a strong fingerprint signal, or information that can be used to identify a specific device and associate it with its user; hiding the device's IP address from the SSP enhances user privacy.

[0031] Furthermore, performing the entire selection process within the MPC cluster allows selection rules to be uniformly applied to all candidate selection values ​​for a specific response to a digital component request. In contrast, during the final selection process performed at the client device, the MPC cluster can only apply selection rules to candidate selection values ​​accessible to the MPC cluster, not to candidate selection values ​​received individually by the client device. This improves the consistency of the user experience and reduces potential confusion, such as when a user specifies a particular selection rule that applies to some digital components but not others.

[0032] The MPC cluster implements a secret-sharing algorithm to maintain the security of the selection process. In the described system, the MPC cluster can use a secret-sharing algorithm such as the Unintentional Transport Extension (OTe) to securely evaluate the Boolean operations that need to be performed during the selection process. This algorithm minimizes the incremental computational cost and latency required to support the application of selection rules.

[0033] Figure 1 This is a block diagram of environment 100, in which an MPC cluster performs a secure MPC process to select digital components to be assigned to client device 110. Example environment 100 includes a data communication network 105, such as a local area network (LAN), wide area network (WAN), Internet, mobile network, or a combination thereof. Network 105 connects client device 110, secure MPC cluster 130, publisher 140, website 142, content platform, such as provider-side platform (SSP) 170, and demand-side platform (DSP) (150). Example environment 100 may include many different client devices 110, secure MPC cluster 130, publisher 140, website 142, DSP 150, and SSP 170.

[0034] Client device 110 is an electronic device capable of communicating via network 105. Example client device 110 includes a personal computer, a mobile communication device such as a smartphone, and other devices that can send and receive data via network 105. The client device may also include a digital assistant device that accepts audio input via a microphone and outputs audio via a speaker. When the digital assistant detects a “hot word” or “hot phrase” that activates the microphone to accept audio input, the digital assistant can be put into listening mode (e.g., ready to accept audio input). The digital assistant device may also include a camera and / or display to capture images and visually present information. The digital assistant can be implemented in various forms of hardware devices, including wearable devices (e.g., watches or glasses), smartphones, speaker devices, tablet devices, or other hardware devices. The client device may also include digital media devices, such as streaming devices that plug into a television or other display to stream video to the television, game consoles, or virtual reality systems.

[0035] Client device 110 typically includes applications 112, such as web browsers and / or native applications, to facilitate the sending and receiving of data over network 105. Native applications are applications developed for a specific platform or device (e.g., a mobile device with a specific operating system). In some implementations, application 112 may be a program such as an operating system. Publisher 140 may develop and provide native applications to client device 110 (e.g., make them available for download). For example, in response to a user of client device 110 entering a resource address for resource 145 in the address bar of a web browser or selecting a link referencing that resource address, the web browser can request resource 145 from a web server hosting website 142 of publisher 140. Similarly, native applications can request application content from a publisher's remote server.

[0036] Some resources, application pages, or other application content may include digital component slots for presenting digital components using resource 145 or application pages. As used throughout this document, the phrase "digital component" refers to a discrete unit of digital content or digital information (e.g., a video clip, audio clip, multimedia clip, image, text, or another unit of content). Digital components may be stored electronically as a single file or a collection of files on a physical storage device, and digital components may take the form of video files, audio files, multimedia files, image files, or text files, and may include advertising information, making advertising a digital component. For example, a digital component may be content designed to complement the content of a webpage or other resource presented by application 112. More specifically, digital components may include digital content related to the resource content (e.g., a digital component may relate to the same topic as the webpage content, or a related topic). Thus, the provision of digital components can complement and generally enhance webpage or application content.

[0037] When application 112 loads a resource (or application content) that includes one or more digital component slots, application 112 may request digital components for each slot. In some implementations, the digital component slot may include code (e.g., a script) that causes application 112 to request digital components from an MPC cluster, such as MPC cluster 130, which selects digital components and provides them to application 112 for presentation to a user of client device 110. As described below, application 112 may request digital components from MPC cluster 130, which may forward the request to other servers, such as SSP 170.

[0038] Some publishers 140 use SSP 170 to manage the process of acquiring digital components from their resource and / or application digital component slots. SSP 170 is a technology platform implemented in hardware and / or software that automates the process of acquiring digital components from resources and / or applications. Each publisher 140 may have a corresponding SSP 170 or multiple SSP 170s. Some publishers 140 may use the same SSP 170.

[0039] Digital ingredient provider 160 may create (or otherwise publish) digital ingredients that are presented in digital ingredient slots within publisher resources and applications. Digital ingredient provider 160 may use DSP 150 to manage the supply of its digital ingredients for presentation in digital ingredient slots. DSP 150 is a hardware and / or software-implemented technology platform that automates the process of allocating digital ingredients for presentation with resources and / or applications. DSP 150 may interact on behalf of digital ingredient provider 160 with multiple supply-side platforms (SSPs) to provide digital ingredients for presentation utilizing the resources and / or applications of multiple different publishers 140. Typically, DSP 150 may receive requests for digital ingredients (e.g., from SSPs), generate (or select) selection values ​​for one or more digital ingredients created by one or more digital ingredient providers based on those requests, and provide the SSPs with data related to the digital ingredients (e.g., the digital ingredients themselves) and selection parameters. Selection values ​​may indicate the amount that digital ingredient provider 160 is willing to provide for the presentation or user interaction of the digital ingredients. Then, the SSP can select the digital components to be presented on the client device 110 and provide the client device 110 with the data that enables the client device 110 to present the digital components.

[0040] In some cases, it is beneficial for users to receive digital components related to web pages, application pages, or other electronic resources that they have previously visited and / or interacted with. To assign such digital components to users, when a user visits a specific resource or performs a specific action on that resource (e.g., interacting with a specific item presented on a web page or adding that item to a virtual shopping cart), the user can be assigned to a user group, such as a user interest group, a queue of similar users, or other group types involving similar user data. User groups can be generated by digital component providers 160. That is, when a user visits an electronic resource of a digital component provider 160, each digital component provider 160 can assign the user to their user group. User groups can also be created by content platforms, such as DSP 150 and / or SSP 170.

[0041] To protect user privacy, user group memberships may be maintained on the user's client device 110, for example, by one of the applications 112 or operating systems of client device 110, rather than by a digital component provider, content platform, or other party. In a specific example, a trusted program (e.g., a web browser or operating system) may maintain a list of user group identifiers (“user group list”) for users using a web browser or another application (e.g., users logged into a browser, application, or client device 110). The user group list may include a group identifier for each user group that includes the user as a member. Digital component providers 160 that create user groups may assign user group identifiers to their user groups. The user group identifier may describe the group (e.g., a gardening group) or represent the group using codes (e.g., a non-descriptive alphanumeric sequence). The user's user group list may be stored in secure storage on client device 110 and / or may be encrypted at storage to prevent access to the list by others.

[0042] When application 112 presents resources or application content related to web pages on digital component provider 160 or website 142, the resource may request application 112 to add one or more user group identifiers to the user group list. In response, application 112 may add one or more user group identifiers to the user group list and securely store the user group list.

[0043] MPC cluster 130 can use a user's user group membership to select digital components or other content that the user may be interested in or otherwise beneficial to the user / user device. For example, such digital components or other content may include data that improves user experience, enhances the operation of the user device, or otherwise benefits the user or user device. However, the user group identifier of the user's user group list can be provided and used to prevent the computing systems MPC1 and MPC2 of MPC cluster 130 from accessing the user's user group identifier in plaintext when selecting digital components, thereby protecting user privacy when using user group membership data to select digital components. Plaintext is text that has not been computed, specially formatted, or written in code or data (including binary files), in a form that can be viewed or used without the need for a key or other decryption device or process. MPC cluster 130 also uses a set of candidate selection values ​​received from SSP 170 to perform a final selection process to select a winning selection value mapped to a digital component. MPC cluster 130 then, in response to a digital component request, directly provides the data of the digital component mapped to the winning selection value to client device 110. This data may include, for example, data that identifies the digital component, the location where the digital component is stored and / or the location from which the digital component can be requested, the winning selection value, and other parameters.

[0044] Secure MPC cluster 130 includes two computing systems, MPC1 and MPC2 (e.g., server computers), which perform a secure MPC process to select digital components based on a user's group membership for assignment to the user's client device without accessing group membership information (or other sensitive user information) in plaintext. While the example MPC cluster 130 includes two computing systems, more computing systems can be used, as long as MPC cluster 130 includes more than one. For example, MPC cluster 130 may include three, four, or other appropriate numbers of computing systems. Using more computing systems in MPC cluster 130 can provide greater security, but it also increases the complexity of the MPC process.

[0045] Computing systems MPC1 and MPC2 can be operated by different entities. This means that each entity may not have access to user group memberships in plaintext. For example, one of the computing systems MPC1 or MPC2 can be operated by a trusted party different from the user, publisher 140, DSP 150, SSP 170, and digital component provider 160. For example, an industry group, a government group, or a browser developer could maintain and operate one of the computing systems MPC1 and MPC2. Other computing systems can be operated by different ones from these groups, such that different trusted parties operate each computing system MPC1 and MPC2. Preferably, the different parties operating the different computing systems MPC1 and MPC2 have no incentive to collude to compromise user privacy. In some implementations, computing systems MPC1 and MPC2 are architecturally separate and monitored to not communicate with each other except for performing the secure MPC processes described herein.

[0046] In addition to the descriptions herein, users may be provided with controls (e.g., user interface elements that users can interact with) allowing them to choose whether and when the systems, programs, or features described herein may collect user information (e.g., information about a user's social networks, social actions or activities, occupation, user preferences, or the user's current location), and whether to transmit content or communications from a server to the user. Furthermore, certain data may be processed in one or more ways before being stored or used to remove personally identifiable information. For example, a user's identity may be processed so that the user's personally identifiable information cannot be determined, or the user's geographic location may be generalized (e.g., generalized to a city, zip code, or state level) if location information is available, thus making it impossible to determine the user's specific location. Therefore, users can control what information about themselves is collected, how that information is used, and what information is provided to them.

[0047] Figure 2This is a data flow diagram for an example process 200 used to select digital components for display or allocation on a client device. The operation of process 200 can be implemented, for example, by application 112 on client device 110, computing systems MPC1 and MPC2 of MPC cluster 130, DSP 150, and SSP 170. The operation of process 200 can also be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 200. Although process 200 and the other processes described below are based on two computing systems MPC cluster 130, MPC clusters with more than two computing systems can also be used to perform similar processes.

[0048] This specification includes two types of selection values—selection values ​​or "conditional selection values" conditioned on any sensitive user information, and selection values ​​or "unconditional selection values" not conditioned on sensitive information, such as user group membership or other commercially sensitive information, or changes in their values ​​that could allow unscrupulous parties to infer parameters of sensitive information. To protect user privacy, the conditions of the "conditional selection values" are evaluated within the MPC cluster 130, rather than within the SSP 170 or DSP 150, to determine whether the "conditional selection values" are suitable for the content selection process.

[0049] This architecture allows MPC cluster 130 to protect user privacy and trade secrets, and to prove its trustworthiness to application providers (such as the provider of application 112). In this example, MPC cluster 130 relies on a secure two-party computation (2PC) architecture that applies cryptographic techniques to ensure that there is no leakage of confidential user data or trade secrets if at least one of the two computing systems in MPC cluster 130 is honest. If MPC cluster 130 includes more than two computing systems, the current MPC protocol can be extended, or other MPC protocols can be used.

[0050] MPC cluster 130 runs a secure 2PC protocol to evaluate and apply conditions to select qualified candidates for the selection process, implement the selection process to choose digital components based on winning selection values ​​(e.g., cases where digital components are mapped to winning selection values), and receive impression notifications to update counters on which these conditions depend. All of these processes can be accomplished using secret-sharing techniques. See below for reference. Figure 3 Please describe the protocol in detail.

[0051] Process 200 begins in phase A, where application 112 collaborates with a triggering element from a content distribution server such as SSP 170 to send requests for digital components to MPC cluster 130. Application 112 may include multiple requests for digital components together in a combined request to fetch multiple digital components. MPC cluster 130 may then serve each request in the combined request independently or make one or more selection decisions as a whole. In this example, the request is for a single digital component and includes requests for digital components selected based on sensitive information or digital components selected without sensitive information. MPC cluster 130 may respond to the request by selecting a specific selection value from a set of selection values, where each selection value is mapped to a corresponding specific digital component. These selection values ​​may be selection values ​​previously cached or otherwise stored in MPC cluster 130 and / or selection values ​​generated by a platform such as DSP 150 or SSP 170, or just-in-time (JIT) selection values. JIT selection values ​​are generated directly in response to need and improve efficiency and reduce waste because selection values ​​are generated only when digital components are needed. For example, a JIT select value can be generated when a digital component slot becomes available—indicated by the receipt of a request for a digital component.

[0052] The request includes information used in the digital ingredient selection process, including potentially sensitive information such as identifiers of user groups mapped or otherwise associated by application 112, as well as non-sensitive information such as contextual signals from application 112 regarding the context in which the digital ingredients will be presented and / or displayed. As described in further detail below, the client device 110 is designed to improve the protection of potentially sensitive or confidential user data.

[0053] The triggering element may be, for example, a tag that detects the presence of a digital component slot within an internet location accessed by application 112. The triggering element may be placed at, for example, an internet location and may notify application 112 of the existence of a digital component slot for which a digital component should be requested.

[0054] Process 200 continues to Phase B, in which MPC cluster 130 transmits a request for digital components based on non-sensitive information such as context signals to SSP 170. This request is referred to as a "context request," and the response to this context request can be an unconditional choice value because the request is not conditional on receiving sensitive information. The context request may contain various context signals and user information directly collected by the internet location that triggered the request for digital components (e.g., a content publisher). For example, context signals may include analytics data, language settings, and other data that helps the content publisher provide a good user experience. However, the context request provided to SSP 170 does not include sensitive information such as user group identifiers.

[0055] Process 200 continues to stage C, where SSP 170 forwards the scenario request to one or more DSPs 150. In this particular example, for simplicity, SSP 170 forwards the scenario request to a single DSP 150. For example, SSP 170 may forward the scenario request to DSP 150. In this example, DSP 150 has digital components and selection values ​​mapped to those digital components.

[0056] Process 200 continues to stage D, where one or more DSPs 150 return selection values ​​in response to a context request. For example, DSP 150 returns one or more selection values ​​mapped to digital components in response to a context request. DSP 150 may return any number of selection values ​​in response to a context request. In some implementations, DSP 150 may also return selection values ​​in response to a digital component request based on sensitive information such as user group information. These selection values ​​are “conditional selection values” because they are conditional on sensitive information, and therefore conditional on MPC cluster 130 receiving a request that includes sensitive information matching the sensitive information conditional on the selection values. For each selection value provided by DSP 150, DSP 150 includes information such as a Time-to-Live (TTL) parameter, which is the maximum time span for which MPC cluster 130 can cache the selection value. This TTL parameter enables MPC cluster 130 to cache selection values ​​received from DSP 150. In some implementations, without a TTL parameter, the MPC cluster 130 does not cache the received selection value, but discards it after the selection value has been used in the selection process, such as in the selection process corresponding to the digital component request transmitted in stages A, B, and C.

[0057] Process 200 continues to phase E, where SSP 170 applies content selection rules. For example, SSP 170 applies rules such as content provider and digital component blocking rules, which prevent specific content providers from qualifying to offer candidate digital components and selection values, or prevent specific digital components from becoming candidates. In some implementations, application 112 may maintain a set of blocked identifiers, including identifiers of digital components that have been explicitly blocked by the user. For example, suppose a user interacts with a mute element corresponding to a given digital component (or a portion of data delivered to client device 110). In this example, the user's interaction with the mute element is an indication that the user does not want to see that digital component or potentially similar digital components (e.g., from the same or different content source or activity) in the future (e.g., at least for a certain time). In response to this interaction, application 112 may add the identifier of the given digital component to the set of blocked generic identifiers, which can then be used to prevent the delivery or presentation of other digital components with the same identifier as the given digital component. In some implementations, application 112 may maintain a set of blocked identifiers, including identifiers of digital components that have been displayed to the user too frequently recently—for example, more than X times in the last Y minutes. Application 112 may add the identifier of a given digital component to this set of blocked general identifiers, and then use this set of blocked general identifiers to prevent the delivery or presentation of other digital components with the same identifier as the given digital component in the near future.

[0058] SSP 170 also applies selection value rules to determine, for example, how selection values ​​affect the post-release value for a particular content provider. The post-release value may indicate, for example, the amount of digital components provided to the content provider for distribution. SSP 170 then performs a selection process to determine the highest unconditional selection value that produces the highest post-release value. The unconditional selection value is not conditional on sensitive information, therefore content selection rules such as user group membership, frequency control, content allocation rules, and pacing rules are not applied. SSP 170 then forwards the following as JIT selection values ​​to MPC cluster 130: all selection values ​​that can be cached in MPC cluster 130 (selection values ​​with TTL values), and all selection values ​​whose post-release value is not less than the highest unconditional selection value.

[0059] Process 200 continues to phase F, where MPC cluster 130 updates its cache using the received JIT selection values ​​(i.e., those with TTL values) that enable caching. Furthermore, MPC cluster 130 applies selection rules, such as user membership rules, frequency control, pacing rules, and rules to prevent micro-targeting by a particular user in all selection values ​​received in phase E, as well as previously cached selection values, to select valid candidates for the selection process. These rules may include restrictions and guidelines on how digital components are allocated or the frequency, as well as other factors. These rules include frequency control, suppression, budget, and pacing constraints. MPC cluster 130 then runs the final selection process among all eligible candidates, selects the winning selection value, and then, in response to a digital component request, returns the data of the digital components mapped to the winning selection value to application 112.

[0060] Process 200 continues to phase G, where application 112 renders the digital components mapped to the winning selection value. Application 112 then provides an impression notification to MPC cluster 130. This impression notification includes data that allows MPC cluster 130 to update information related to an update counter, which allows MPC cluster 130 to enforce the selection rules. In some implementations, application 112 can send the impression notification G to MPC cluster 130 via a future component request A to reduce the amount of network communication and battery / bandwidth consumption of mobile devices.

[0061] Figure 3 The swimlane diagram illustrates an example process 300 for selecting digital components used to provide information for display or allocation to a client device. Operation of process 300 can be implemented, for example, by application 112 on client device 110, computing systems MPC1 and MPC2 of MPC cluster 130, DSP 150, and SSP 170. Operation of process 300 can also be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 300. Although process 300 and other processes described below are based on two computing systems MPC cluster 130, MPC clusters with more than two computing systems can also be used to perform similar processes. In this particular example, the two computing systems MPC1 and MPC2 have the same software and functionality but are managed by different entities with no incentive to collude to compromise user privacy.

[0062] The MPC cluster executes a secure MPC process to select digital components based on characteristic information such as user group information in the digital component request. This may also include identifying selection values ​​for candidate digital components based on digital components having user group identifiers that match one of the user's user group identifiers. It may also include selecting a digital component from the candidate digital components based on the selection values. These selection values ​​include selection values ​​cached in the MPC cluster and selection values ​​received from other servers in response to requests for selection values, and some selection values ​​may be conditional on sensitive information. All of this can be performed without the computing systems MPC1 or MPC2 accessing the user group identifiers in plaintext.

[0063] Computing systems MPC1 and MPC2 can use secret shares to identify candidate selection values ​​using secure MPC techniques, such that neither MPC1 nor MPC2 knows which digital components are candidates, or user groups that include the user as a member. To this end, computing system MPC1 computes a first share of candidate parameters for each conditional selection value in a set of conditional selection values ​​that may potentially serve the current digital component request. Similarly, computing system MPC2 computes a second share of candidate parameters for each conditional selection value in the same set of conditional selection values. Conditional selection values ​​can be Boolean values ​​(e.g., 0 or 1) that indicate whether a selection value associated with a digital component and an optional user group identifier is a candidate.

[0064] Computing systems MPC1 and MPC2 can use secure MPC technology to calculate the secret share of the selection process result through one or more round trips between the computing systems. That is, computing systems MPC1 and MPC2 can determine the secret share of the winning selection value, identify the data of its corresponding digital component, and / or identify the network location from which client devices can download the digital component.

[0065] Once the secret shares have been calculated, MPC1 and MPC2 can each return one of the shares representing the selection result to the client device. The client device can then use these two secret shares to reconstruct the selection result in plaintext.

[0066] Process 300 begins in step 1, where application 112 generates a digital component request to be transmitted to MPC cluster 130. Application 112 selects one of the computing systems in MPC cluster 130 to which the request will be transmitted. This selection process can be arbitrary; in this example, for simplicity, the selected computing system is MPC1.

[0067] The initial advertising request contains three types of information: a digital component request based on sensitive information from each computing system MPC1 and MPC2, and a digital component request based on non-sensitive information from SSP 170.

[0068] To securely and efficiently generate digital component requests based on sensitive information, application 112 can use probabilistic data structures such as cuckoo filters or Bloom filters. In this example, the probabilistic data structure is a cuckoo filter. Typically, a cuckoo filter consists of an array of buckets, where each bucket can store b fingerprints. The fingerprint of an item is a bit string derived from the hash of that item. The cuckoo filter uses n hash functions that allow an item to be placed in any of b positions across n distinct buckets. Typically, a cuckoo filter is identified by the number of fingerprints in each bucket and the number of buckets. For example, a (2,4) cuckoo filter has 2 buckets, and each bucket in the cuckoo array can store up to 4 fingerprints. Therefore, the total capacity of the cuckoo filter is 2×4 or 8 fingerprints.

[0069] Depending on the configuration of the cuckoo filter, an item can be inserted into the cuckoo filter at one of N possible locations, for example, N=2. Application 112 uses N pseudo-random functions (PRFs) to determine all possible locations for the item to be inserted. These PRFs are parameterized by a user group identifier or an identifier from a blocked group, and either one of two random variables generated by application 112. For example, suppose the two random variables generated by application 112 are rand_var1a and rand_var1b. In some implementations, application 112 and MPC cluster 130 pre-agree on the PRFs, where PRF(x,y)∈[0,2]. k -1], where k is the number of bits in each item in the bucket of the Cuckoo Filter. Each position in the Cuckoo Filter can be occupied by a user group identifier or a blocked identifier, or it can be empty. For example, application 112 can generate a Cuckoo Filter table whose elements are PRF(ug_id, rand_var1a), PRF(blocked_uid, rand_var1b) and 0, where ug_id is the identifier of the user group generated by applying HMAC to the user group's tag based on the content provider's domain, blocked_uid is an identifier from a set of blocked identifiers, and 0 represents an empty item. This process is repeated for all user group identifiers and all identifiers in that set of blocked identifiers.

[0070] Application 112 can generate vector B based on a cuckoo filter table, which is generated from the user group identifier and the common identifiers that are blocked in that group. Vector B can be represented as B i =Ai-PRF(rand_var2,i), where A iThis is the Cuckoo Filter Table, where i is the index of vector B and the Cuckoo Filter Table A. When application 112 initiates a request for digital components in the digital component slot, it transmits rand_var1a, rand_var1b, and rand_var2 as request parameters to MPC1. Application 112 also transmits vector B and rand_var1 as request parameters to MPC2. Because neither the computing systems MPC1 nor MPC2 can access all the request parameters, neither of them can recreate the Cuckoo Filter Table, thus protecting user privacy.

[0071] Application 112 can transmit a request for digital components containing corresponding secret shares to the corresponding computing server of the MPC system. For example, application 112 generates and transmits a request for digital components to MPC1, the request including a first secret share of a probabilistic data structure (i.e., a cuckoo filter), which may be a vector B described in the previous paragraph. Parameters include rand_var1a and rand_var1b, and a context signal from the location that triggered the generation and transmission of the digital component request. Similarly, application 112 also transmits a request for digital components to MPC2, the request including a second secret share of a probabilistic data structure defined by rand_var2 via a function PRF(rand_var2,i) where i is an index of the secret share array, and rand_var1a and rand_var1b. Additional data included in a digital component request may include context selection signals indicating which contexts the digital component is eligible for, such as the location of client device 110, the language spoken for application 110, a generic resource locator (URL) from which the digital component may utilize resources presented, and / or exclusion URLs from which the digital component may not utilize resources presented. This data of the digital component may also identify the digital component, for example, using a unique identifier from which the domain of the digital component can be obtained, and / or other appropriate data of the digital component.

[0072] Application 112 encrypts digital component requests based on sensitive information because if MPC1 has access to the request parameters for MPC2, MPC1 can reconstruct the Cuckoo Filter Table A and recover the user group identifier, thus violating the privacy of the user of Application 112. For example, Application 112 can encrypt the digital component request for MPC2 using public-key encryption and MPC2's public key: PubKeyEncrypt(rand_var1a||rand_var1b||rand_var2||other signals,MPC2), where || is any reversible method that can be used to compose a complex message from a simple message, such as a protocol buffer or JSON. By using the function PubKeyEncrypt(), the parameters in parentheses are encrypted using a public-key algorithm and MPC2's public key, allowing MPC2 to decrypt the shares using the corresponding private key. If encrypted, Application 112 can send the digital component request for MPC2 to MPC1, and MPC1 can forward this encrypted request to MPC2. In this way, application 112 can send a single request to MPC1 comprising three sub-requests, for example, a context request including a context signal and two user group requests (i.e., a conditional request conditional on user group information). The first user group sub-request is directed to MPC1, and the second user group sub-request is an encrypted user group request directed to MPC2. The second sub-request is encrypted so that MPC1 cannot access the information and must simply forward the share to MPC2.

[0073] In order to securely and efficiently generate digital component requests for SSP 170 based on non-sensitive information such as context signals, application 112 uses context signals including arbitrary signals such as signals specifically targeting a particular content provider, but excluding user group identifiers or blocked identifiers provided solely by the digital component request based on sensitive information.

[0074] To minimize risks to user privacy and maintain process integrity, Application 112 encrypts digital component requests intended for SSP 170 using public-key encryption based on non-sensitive information. For example, Application 112 can use public-key encryption and the public key of SSP 170 to encrypt digital component requests for SSP 170: PubKeyEncrypt(digital_component_request, SSP).

[0075] Process 300 continues to step 2, where MPC1 parses the initial digital component request to obtain each of the three sub-requests. For example, MPC1 receives the digital component request. In some implementations, the request can be parsed into sub-requests, and the request can be parsed into three sub-requests, such that the sub-requests can be forwarded to individual receivers. For example, the context request can be forwarded to the SSP, the user group request can be stored and processed by MPC1, and the encrypted user group request can be forwarded to MPC2.

[0076] The process continues to step 3, where MPC1 retrieves JIT selection values ​​from SSP 170 and DSP 150 using a contextual or unconditional digital component request, which is a sub-request from step 1. Some JIT selection values ​​are conditional, depending on, for example: (1) whether the user is a member of a specific user group, (2) applicable selection rules, such as frequency control or pacing rules, and (3) whether the digital component idea associated with the selection value satisfies rules preventing micro-targeting. In some implementations, the JIT selection values ​​can be cached by MPC cluster 130 based on TTL information provided along with the selection values.

[0077] Micro-targeting is a selection process that narrows the target audience to a level that might make some users uncomfortable. For example, a digital component targeted only to a few users and assigned to them might feel overly personalized, and users might feel picked out or uncomfortable with the specificity of that digital component. By ensuring that specific digital components are offered to a threshold number of other users, the system ensures that digital components are distributed to a sufficiently broad audience through enforced k-anonymization, making users comfortable with the size of the digital components they receive and the target audience of those components. The concept of k-anonymization ensures that the data of a particular user cannot be distinguished from the data of other users within a threshold number k. The system can enforce k-anonymization rules, for example, by ensuring that, in response to a request for one or more digital components, a specific digital component is assigned to client devices 110 at least k times, thus maintaining anonymization within a set of at least k users. In some implementations, each of the k times a digital component is assigned must be for a different device or a different user. The system enforces k-anonymization using privacy-preserving data structures. The allocation of a specific digital component can be tracked in privacy-preserving data structures, such as a counter of the number of times a digital component has been selected for allocation or actually presented to users.

[0078] Furthermore, when users navigate across multiple different websites, they typically prefer to be shown the same third-party content in a non-continuous manner. Therefore, continuously assigning the same third-party content to the same user across multiple websites results in wasted computing resources allocated to content that the user doesn't want to see and might ignore. One way to limit the number of times a particular user is exposed to the same third-party content is to utilize frequency control techniques, which prevent the same user from being exposed to the same third-party content more than a specified number of times within a recently specified time period.

[0079] The system allows further user input by receiving information from the user regarding the suppression of digital elements or the prevention of their presentation for a period of time. For example, a user can select to suppress specific digital elements that have been presented to them for a five-day period. In some implementations, this period can be specified by the client device 110, MPC cluster 130, DSP 150, digital content provider 160, or SSP 170 based on the type of content item and / or the type of feedback provided by the user, as well as other factors.

[0080] Content allocation can also be controlled by input from digital component provider 160 via pacing control technology. The digital component provider can specify a total threshold for selected values ​​over a period of time to implement measures to ensure that resources for an activity or a set of digital components including that digital component are not exhausted early in the activity period. For example, digital component provider 160 can specify that the total number of digital components or selected values ​​for a specific digital component selected from digital component provider 160 within a week is limited to a maximum of 8000 units. Once the maximum total number of selected values ​​is reached, the specific digital component for which the maximum value is imposed will no longer be eligible for allocation to client device 110 until the end of that period (e.g., a week).

[0081] The digital component provider can also specify a speed or pace at which a threshold is reached for the digital component selected from the digital component provider 160, or for a specific digital component's selection value. For example, the digital component provider 160 can specify a maximum threshold of 6000 units that must be reached at a pace of less than 250 units per day over a month. Once the daily total selection value is reached, the paced digital components provided by the digital component provider 160 will no longer be eligible for the selection process assigned to the client device 110 until the end of that period (day). Furthermore, among other metrics, pacing can be based on the pace of a specific digital component selected and delivered to the user device, or the pace at which a specific digital component has been delivered to the user and the user interacts with that specific digital component.

[0082] In addition to executing the selection process for content selection and user preference rules, the system can enhance security by preventing MPC cluster 130 from accessing JIT selection values ​​in plaintext. SSP 170 can split each JIT selection value into secret shares before transmitting the selection values ​​to MPC cluster 130. Furthermore, SSP 170 can sort the JIT selection values ​​according to their published values.

[0083] In steps 4 through 6, SSP 170 requests selection values ​​from DSP 150, receives candidate selection values ​​from DSP 150, and performs an initial selection process. In step 4, SSP 170 transmits a field digital component request to DSP 150.

[0084] In step 5, DSP 150 returns a selection value mapped to a specific digital component. The selection value can include unconditional selection values ​​and conditional selection values.

[0085] In step 6, SSP 170 applies content provider and digital component blocking rules that prevent a particular content provider from being eligible to provide candidate digital components and selected values, or prevent a particular digital component from becoming a candidate. Additionally, SSP 170 performs an initial selection process to choose an unconditional selection value from the candidate unconditional selection values ​​and select a conditional selection value. The conditional selection value can be used to repopulate the cache of MPC cluster 130 for subsequent requests from application 112.

[0086] In step 7, SSP 170 calculates the post-publishing value based on the selected values ​​and information provided by DSP 150. For example, SSP 170 can calculate the number of digital components to be provided to the content publisher for display, mapped to the selected values.

[0087] In step 8, SSP 170 returns both conditional and unconditional selection values ​​to MPC cluster 130. The SSP's response to MPC1 has the following parameters: {[jit_sv 1，1 ], ...[jit_sv n,1 ]}, where n is the number of JIT selected values, PubKeyEncrypt({[jit_sv 1,2 ], ...[jit_sv n,2 ]}, MPC2), {cache_ttl1,...cache_ttl n} and {post_publishing_value1,...post_publishing_value nAs mentioned above, PubKeyEncrypt is a public-key encryption algorithm that allows SSP 170 to transmit a single response, including a response to MPC2, to MPC1 without granting MPC1 access to the response data. Parameters appearing in parentheses represent the secret share of the variable within the parentheses. For example, here, [jit_sv i,1 ] and [jit_sv i,2 ] is jit_sv i Two secret shares, jit_sv i This represents the JIT selection value. Regarding the secret share, subscript 1 indicates the parameter representing the first secret share, and subscript 2 indicates the parameter representing the second secret share. In some implementations, jit_sv i This includes data identifying the selected values ​​and the digital components they map to, as well as parameter values ​​corresponding to the parameters specified in the digital component request, and other data. SSP 170 can transmit jit_sv... i It splits into its secret shares, and a suitable cryptographic library that supports the secret share algorithm can be used to reconstruct the jit_sv from its secret shares. i For example, using an additional secret share library, client device 110 can add the two secret shares of the selection result together to obtain the plaintext selection result. This allows client device 110 to access the selection value of the digital component and its metadata, such as the identity of the digital component and the location where client device 110 can download the digital component. The parameter `cache_ttl`... i publisher_value represents the TTL value for each selection value i. i This represents the post-publication value for each selection value i.

[0088] The selection result may include the selected value and / or data of the numerical components corresponding to the selected value. For example, the selection result may be a data array including numerical components, or a URL or other resource locator referencing the network location where the client device 110 can obtain the numerical components. In this way, the client device 110 can display the winning numerical component after combining the secret share of the selection result.

[0089] Process 300 continues with steps 9 and 10, in which the computation system MPC1 merges the cached and received JIT candidate selection values, and in which the computation system MPC1 parses the response from SSP 170. First, in step 9, MPC1 analyzes the response received from SSP 170.

[0090] Process 300 continues to step 10, in which computing system MPC1 transmits a request with the following parameters to MPC2: PubKeyEncrypt({[jit_sv 1,2], ...[jit_sv n，2 ]}, MPC2), {cache_ttl1,...cache_ttl n} and {post_publishing_value1,...post_publishing_value n These are the values ​​that MPC1 receives from SSP170 in step 8, where subscript 2 indicates the value jit_sv. i The second secret share. Afterwards, MPC1 performs an efficient, general, comparison-based sorting algorithm, such as a merge-sort operation, to merge the cached selection values ​​associated with the signals from the original request received in step 1. For example, the merge-sort operation may include dividing the unsorted list of cached selection values ​​and the received selection values ​​into n sublists, each containing one element (a list of elements is considered sorted), and then repeatedly merging the sublists to produce new sorted sublists until only one sublist remains, which is the final sorted list. Merge-sort is particularly suitable for this situation because both the cached list of selection values ​​and the selection values ​​received from SSP170 in step 8 can be pre-sorted.

[0091] The sorting process merges the JIT select values ​​and the cached select values ​​into a sequence of select values ​​(in the form of secret shares) ranked according to their post-release values. In parallel, MPC2 performs the same merge sorting process on the cached select values ​​and their secret shares of the JIT select values.

[0092] The merge-sort process results are used for two reasons: to update cached selection values ​​that may exist in the sorting sequence of MPC cluster 130, and to prepare a list of candidate selection values. The input to the final selection process is the list of candidate selection values ​​prepared by the merge-sort process. Additionally, the final selection process input includes any number of user group identifiers and blocked identifiers encoded in the probabilistic data structure received from application 112 in step 1, as well as counters or other data structures that support the enforcement of selection rules.

[0093] The final selection process of process 300 comprises two consecutive phases, steps 11 and 12. All calculations in the final selection process are performed on the secret share. Although some calculations may be described in plaintext in later chapters, this is purely for the sake of brevity.

[0094] For each cached or received selection value used in the final selection process (i.e., the selection value in the final list produced by the merge-sort process performed in step 10), the MPC cluster 130 conceptually computes the variable value is_candidate for each selection value x. x MP C1 calculates is_candidatex A secret share, denoted as [is_candidate] x,1 MPC2 calculates is_candidate x Another secret share is represented as [is_candidate] x,2 MPC1 and MPC2 can collaboratively compute secret shares using a secure MPC process.

[0095] In step 11, MPC1 determines whether each candidate selection value is associated with the user group specified in the request received in step 1. MPC1 receives an equivalent of the secret share array of the Cuckoo Filter Table M in step 1, denoted by [M1]. Each user group identifier present in M ​​will be located in one of N possible positions. If the selection value x is associated with the user group specified in the request received in step 1 (i.e., the user group identifier of the selection value x exists in the probabilistic data structure from step 1), then the selection value x must exist in one of the N possible positions.

[0096] MPC1 calculates [is_candidate] according to the following equation. x,1 ]:

[0097]

[0098] Where Π represents the product of multiple items. Here, ug_id(x) is a function used to retrieve the ug_id associated with the selected value x, {F1,…F N} is a function used to calculate the possible indices (i.e., positions) of items within the Cuckoo Filter table A, and rand_val1a is the random value received in step 1. [M x,1 [x] is the x-th element in array [M1]. The equality test is performed between the plaintext integer and the secret share of the secret integer. The result of this test is the secret share of the secret integer as either 0 (not equal to) or 1 (equal to). Here, [M... i,1 The value of ] is equal to Bi as defined above.

[0099] Similarly, MPC2 calculates [is_candidate] according to the following equation. x,2 ]:

[0100]

[0101] Here, [M i,2 The value of ] is PRF(rand_val2,i).

[0102] When [is_candidate] x,1 ] and [is_candidate x,2When combining values, it is clear that if the selected value x's ug_id is in the probability data structure table, then is_candidate x The false positive rate of the cuckoo filter is 1. The false positive rate is controlled by the length (i.e., number of bits) k of the entries in the cuckoo filter and can affect the candidate eligibility of the selected value. Otherwise, is_candidatex is 0.

[0103] In this particular example, a user group check occurs after MPC cluster 130 receives an unconditional selection value response from SSP 170 in step 8. In some implementations, MPC cluster 130 performs the user group check in parallel with sending the context digital composition request in step 3 and receiving the context digital composition response in step 8.

[0104] In this specific example, the context digital component may contain conditionally selected values ​​from the DSP 150 via the SSP 170, and the MPC cluster 130 may perform user group checks on those JIT conditionally selected values, which may potentially qualify for the final selection process in step 13 and may become the winner of the current digital component request received in step 1 if and only if the JIT conditionally selected value satisfies the rules preventing user micro-targeting. In an alternative design, the JIT conditionally selected values ​​are not eligible for the final selection process and cannot become the winner of the current digital component request. Furthermore, the DSP 150 and SSP 170 have the opportunity to customize lookup keywords for the cache, providing additional flexibility for the DSP and SSP.

[0105] However, the latency of performing the user group check after receiving the conditional selection value will increase the total latency of the entire process by 300, as shown between steps 1 and 14. For example, even the most efficient secret share equality test requires three round-trip remote procedure calls (RPCs) between the computing systems of the MPC cluster 130, which can take tens to hundreds of milliseconds depending on network conditions and the equality test algorithm selected.

[0106] Process 300 continues to step 12, where MPC cluster 130 applies the selection rule—the MPC1 and MPC2 collaboratively apply the selection rule. Each of the following rules is optional, and if a particular selection process does not require a particular selection rule, then that selection rule will not be applied.

[0107] For example, MPC cluster 130 may optionally apply rules where a specific numeric component identifier mapped to a particular selection value is on a block list and therefore ineligible for the selection process. Here, block_id(x) is a function that retrieves the block_id associated with the selection value x. MPC1 can calculate:

[0108]

[0109] Similarly, MPC2 can calculate:

[0110]

[0111] If it is possible to access [should_block] x,1 ] and [should_block x,2 Rebuild should_block x Therefore, it is clear that if the block_id of the chosen value x is in the probabilistic data structure, then should_block x The FPR of a probabilistic data structure is 1. The FPR of a probabilistic data structure is controlled by the length of the entries in the structure. In `should_block` x When the value is 1, MPC cluster 130 should set is_candidate x Set to 0 because the identifier should be blocked and therefore ineligible to be a candidate. For example, for a 2-position cuckoo filter, if the block_id of the selection value x is not in the probability data structure, i.e., the block_id does not match an item in either of the two cuckoo filter positions, then should_block x The value is 0. In this case, MPC cluster 130 should not modify is_candidate. x The value of `should_block` is determined because the identifier should not be blocked. x It does not affect whether the selection value x is eligible to become a candidate.

[0112] In order to determine according to should_block x Modify the value of is_candidate x MPC1 calculates [is_candidate] x,1 ] = [is_candidate x,1 ]x(1-[should_block x,1 Similarly, MPC2 calculates [is_candidate] x,2 ] = [is_candidate x,2 ]x(1-[should_block x,2 ]).

[0113] Next, the MPC cluster 130 optionally applies the pacing selection rules provided by the content provider. For each digital component request, the MPC cluster 130 conceptually randomly generates a secret share of rules_selector for each unit of the selection value to which the selection rules have been applied. runit_idAlternatively, `runit_id`. The function `runit_id(x)` retrieves the `runit_id` of the selected value `x`.

[0114] For example, MPC1 first randomly generates [rules_selector] runit_id,1 MPC1 then determines the rule_selector based on the rule_selector. runit_id Modify the value of is_candidate x MPC1 calculates [is_candidate] x,1 ] = [is_candidate x,1 ]x(1-[rule_selector runit_id(x),1 ]).

[0115] Similarly, MPC2 calculates [is_candidate] x,2 ] = [is_candidate x,2 ]x(1-[rule_selector runit_id(x),2 ]).

[0116] Here, when the maximum total selection value of the unit runit_id is exhausted, rules_selector runit_id Set to 0. Furthermore, when the rate at which rules_selector reaches the threshold value of the selected digital component lags behind the target pace, rules_selector runit_id It has an increasing probability of 1. For example, MPC1 generates rules_selector randomly. runit_id When the value is 1, the rules_selector is increased to 1. runit_id The probability. If the set step leads the target step, then rules_selector runit_id It has a reduced probability of 1.

[0117] Next, the MPC cluster 130 can optionally prevent micro-targeting by implementing k-anonymization. Here, aggregate_id is the unit of the selected value to which k-anonymization is performed, and the aggregate_id of the selected value x is retrieved using the function aggregate_id(x). aggregate_id can be the activity ID of a specific numeric component mapped to one or more selected values. In some implementations, aggregate_id and runit_id are the same.

[0118] MPC1 asynchronously updates `satisfy_k_anonymity` for each cached selection value `x` in the secret share. aggregate_id(x)To implement k-anonymization. For example, MPC1 asynchronously maintains [satisfy_k_anonymity]. aggregate_id(x),1 And calculate [is_candidate] x,1 ] = [is_candidate x,1 ]x[satisfy_k_anonymity aggregate_id(x),1 ].

[0119] Similarly, MPC2 calculates [is_candidate] x,2 ] = [is_candidate x,2 ]x[satisfy_k_anonymity aggregate_id(x),2 ].

[0120] After steps 11 and 12, MPC 1 and MPC 2 have respectively calculated [is_candidate] x,1 ] and [is_candidate x,2 The two secret shares of the secret message are is_candidate. x Here, if the selection value x is eligible for use in the final selection process performed by the MPC cluster 130 before the winning selection value mapped to the digital component is provided to the client device 110 for presentation and / or display, then the result is the is_candidate. x =1. If the selected value x is not eligible for use in the final selection process, then is_candidate x =0.

[0121] The above description involves multiplying secret shares of secret integers whose values ​​are 0 or 1 to compute a logical AND. The above description also involves subtracting a secret share of a secret integer whose value is 0 or 1 from 1 to compute a logical NOT. In some implementations, alternative solutions can be employed to evaluate logical expressions with secret shares. For example, to compute a logical AND of several additive secret shares of secret integers whose values ​​are 0 or 1, the MPC cluster can compare the sum of these additive secret shares with the number of secret shares. In another example, to compute an arbitrary logical expression with secret shares as input, the MPC cluster can employ a truth table approach, whereby MPC1 constructs a truth table containing one row for each possible combination of input secret shares held by MPC2. MPC1 randomly selects a secret share for the result, denoted as [result1]. For each row, MPC1 can combine its input secret share with speculative input secret shares held by MPC2 to reconstruct the input to the logical expression in plaintext, and then evaluate the result of the logical expression. For each row, MPC1 splits the result into two secret shares, one being [result1] and the other [result2]. MPC1 then writes [result2] into the row of the truth table. After MPC1 has completed constructing the truth table, MPC2 can initiate an unintentional transfer extension (OTe) to fetch the row in the truth table corresponding to the input secret share held by MPC2. The fetch result is [result2]. At the end of the above process, MPC1 and MPC2 hold [result1] and [result2] respectively, which are the secret shares of the result of the logical expression. MPC1 does not know the value of [result2], and MPC2 does not know the value of [result1]. In some implementations, MPC1 and MPC2 can evaluate the logical expression to determine [is_candidatex,1] and [is_candidatex,2] by constructing obfuscated circuits.

[0122] In step 13, MPC cluster 130 performs the final selection process. Conceptually, MPC cluster 130 calculates a cumulative value for a given selection value of the numerical components, which represents the total number of candidate selection values ​​from the top of the permutation to the given selection value. For example, MPC cluster 130 calculates the cumulative value acc using the following equation. x The cumulative value acc x This represents the total number of eligible candidate selection values ​​that are ranked before the selection value x in the final selection process.

[0123] acc x =∑is_candidate b

[0124] Here, variable b represents the candidate selection value b that ranks ahead of selection value x based on the selection value. In the actual implementation, using the secret share, MPC1 calculates [acc] x,1 MPC2 calculates [acc] x,2 ].

[0125] First, the MPC cluster 130 ranks the selection values ​​based on a metric such as the selection value. For example, if selection value x has a value of 12 units and selection value y has a selection value of 14 units, the MPC cluster 130 can rank selection value y higher than selection value x. This process can be performed in plaintext. Once the selection values ​​have been ranked, the MPC cluster 130 completes the final selection process by choosing a winner. The MPC cluster can determine the variable is_winner for each cached selection value. x The value is used to calculate the winning result of the final selection process.

[0126] is_winner x =is_candidate x ×(acc x ==0)

[0127] The variable is_winner is true if and only if x is the winner of the final selection process. x =1. Otherwise, the variable is_winner x =0. Of all cached and JIT selection values, for each final selection process performed in response to a digital component request, there is at most one for its is_winner. x =1. Choose the value x.

[0128] The computing system MPC1 holds [is_winner] x，1 The computing system MPC2 holds [is_winner] x，2 ]. [is_winner x，1 ] and [is_winner x，2 Each variable in the [] represents is_winner x The secret share.

[0129] In order to create a response, MPC1 calculates:

[0130]

[0131] Where cached_or_jit_svx represents the cache selection value at MPC cluster 130 or the JIT selection value received by MPC cluster 130.

[0132] Similarly, MPC2 calculates:

[0133]

[0134] Because there can be at most one target for its is_winner x The selection value x has a non-zero value (i.e., a value of 1), so the result is 0 (where no numeric component is the winner, and therefore no numeric component will be provided in response to a numeric component request) or the selection value x is one of the cached or JIT selection values ​​for which is_winnerx is 1.

[0135] Next, MPC2 encrypts its secret share of the result using application 112's public key according to the following formula: PubKeyEncrypt([result2], application_public_key), where application_public_key is application 112's public key, and [result2] is the secret share of the result held by MPC2. The encryption function PubKeyEncrypt prevents MPC1 from accessing [result2], thus preventing MPC1 from reconstructing the result from the two secret shares once it receives [result2] from MPC2 for eventual transmission to application 112.

[0136] In some implementations, MPC2 signs the secret share of its result according to the following equation: PubKeySign(PubKeyEncrypt([result2],application_public_key),MPC2), where the PubKeySign function allows MPC2 to sign the secret share of its result, making it verifiable by application 112 that [result2] originates from MPC2. Signing the result prevents MPC1 from forging the result of MPC2. In some implementations, MPC2 signs the secret share of its result according to the following equation: PubKeyEncrypt(PubKeySign([result2],MPC2),application_public_key).

[0137] In step 14, one of the MPC computing systems returns a response to the digital component request received in step 1 to the client device 110. In this example, MPC1 returns a complete response to the client device 110. The response returned by MPC1 includes: [result1] and PubKeySign(PubKeyEncrypt([result2],application_public_key),MPC2).

[0138] In step 15, client device 110 renders the digital components mapped to the selected values ​​indicated by the result. First, client device 110 receives a response with two secret shares of the results derived from MPC1 and MPC2, respectively, which enables application 112 to reconstruct the results in plaintext and present the digital components of the results on client device 110.

[0139] If MPC2 has signed its secret share of the result, application 112 verifies MPC2's digital signature. Furthermore, application 112 decrypts MPC2 using its own private key, which corresponds to the public key that MPC2 used to encrypt [result2], in order to recover [result2] in plaintext. Now, application 112 holds both secret shares of the result in plaintext, and reconstructs the result from [result1] and [result2].

[0140] In step 16, client device 110 returns an impression notification to MPC cluster 130, which allows MPC cluster 130 to update data structures used to track the selection rules for implementing rules such as pacing control rules and k-anonymization rules. The impression notification may include variable values ​​for updating counter variables maintained by MPC cluster 130 for tracking k-anonymization and pacing control. These counter variables may be cached by MPC cluster 130.

[0141] In step 17, MPC cluster 130 updates its counter variables based on the impression notification. For example, MPC1 and MPC2 may update cached counters within MPC cluster 130 to track pacing control and k-anonymization. In some implementations, to reduce the number of operations performed on MPC cluster 130 (e.g., queries per second (QPS)), application 112 may maintain the impression notification for a duration and send it asynchronously to MPC cluster 130. For example, application 112 may transmit the impression notification to MPC cluster 130 using a digital component request, or carry the impression notification with a future digital component request. By transmitting the impression notification along with the data that must be transmitted to MPC cluster 130, application 112 can reduce data traffic. In some implementations, if application 112 cannot find any carrying opportunities at the end of the predetermined duration, the application may send the impression notification to MPC cluster 130 in a dedicated message to prevent delays in updating the counters and any inaccuracies that delays in updating the counters may cause. For example, application 112 may transmit the impression notification to MPC cluster 130 in a dedicated HTTP request.

[0142] In some implementations, to prevent MPC cluster 130 from becoming a single point of failure for environment 100, if MPC cluster 130 experiences a power outage and application 112 fails to send a request to MPC cluster 130, the triggering element embedded in the internet location where the digital components will be rendered and / or displayed can also directly resend the digital component request transmitted to application 112 to SSP 170 (e.g., an unconditional request). This backup mechanism does not increase the complexity of the triggering element embedded in the internet location where the digital components will be rendered and / or displayed, since the triggering element typically creates unconditional requests. Furthermore, the backup mechanism does not increase the complexity of SSP 170. SSP 170 will receive the same digital component request from MPC cluster 130 during normal operation, or directly from the triggering element if MPC cluster 130 experiences a power outage. Regardless of whether the triggering element receives the response from MPC cluster 130 during normal operation or from SSP 170 during a power outage of MPC cluster 130, the triggering element only needs to render the winning final result.

[0143] This system is designed to allow for an improved user experience without significantly increasing the bandwidth and battery consumption of mobile devices. MPC cluster 130 prevents SSP 170 and DSP 150 from seeing identification information of client device 110, such as the IP address of client device 110 associated with the digital component. Without additional cost in terms of computing resources, this system prevents SSPs and DSPs from passively collecting user data using the IP address of client device 110 as a fingerprint. This could be a problem because many SSPs and DSPs passively listen for digital component requests to collect signals without user permission, and those servers could use that data to identify users when the digital component request lacks a user identifier that can be used as a fingerprint (i.e., a deterministic signal that can uniquely identify the user). This system prevents such passive data collection based on information such as the IP address of client device 110.

[0144] For servers that provide elements at internet locations, such servers can implement signal collection logic to prevent unwanted or malicious content from being distributed as scripts within digital components, thereby improving the user experience. The collected signals can be transmitted back to the server in an impression notification.

[0145] In some implementations, certain entities may legitimately use fingerprint signals, such as IP addresses. For example, the use of geographic information is widely used to customize and deliver location-specific digital components to users to improve the relevance and usability of the information provided. To enable legitimate use cases, the MPC cluster 130 may perform functions such as sending location signals and / or identification information with appropriate granularity to the SSP and DSP, or forwarding appropriately truncated or edited information to the SSP and DSP. Alternatively, for each application and content publisher domain pair, the MPC cluster 130 may assign alternative IP addresses from the same geographic region to support geotargeting functionality.

[0146] In addition, the MPC cluster 130 can block unauthorized traffic, improve user experience, and reduce unnecessary traffic. For example, after identifying malicious or unauthorized traffic from a specific IP address or subnet, the SSP 170 can upload an IP address block list to the MPC cluster 130, which securely stores this information. The MPC cluster 130 can then filter out all numeric requests from IP addresses on the block list.

[0147] Figure 4 This is a flowchart illustrating an example process 400 for selecting digital components for allocation to a client device. The operation of process 400 can be implemented, for example, by computing systems MPC1 or MPC2 of the MPC cluster 130. The operation of process 400 can also be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices can cause the one or more data processing devices to perform the operation of process 400. For simplicity, process 400 is described as being executed by computing system MPC1 of the MPC cluster 130.

[0148] Process 400 begins with the first server of the secure multi-party computation (MPC) system receiving a request for digital components from an application on the user device (402). For example, the computing system MPC1 of the MPC cluster 130 may receive a request for one or more digital components from the client device 110 for a specific digital component slot. The request may include information indicating the characteristics of the digital component slot, the slot's context (including the content in which the digital component slot is located), content allocation and / or selection rules specified by the client device 110, and other information such as user-provided information.

[0149] Process 400 continues, where the first server of the secure MPC system parses the request into two or more distinct sub-requests (404). For example, MPC1 might parse the request into three sub-requests. In some implementations, the different parts can be separated based on the destination and the type of information conditioned on the request (i.e., sensitive or non-sensitive information). For example, a sub-request might include a secret share for each computing system MPC1 and MPC2 based on a request for digital components based on sensitive information and a request for digital components based on non-sensitive information for SSP 170.

[0150] Process 400 continues, with the first server of the secure MPC system transmitting each of the two or more distinct parts of the request to a different server (406). For example, MPC1 may transmit separate sub-requests to SSP 170, MPC1 (itself), and MPC2.

[0151] In some implementations, two or more distinct servers include a supply-side platform server that automates the process of allocating digital components and communicates with one or more content publishers. For example, MPC1 may transmit different sub-requests of a request to SSP 170 and MPC2. In some implementations, MPC1 may transmit different sub-requests of a request to SSP 170, and SSP 170 may forward different portions of the sub-requests to DSP 150.

[0152] Process 400 continues, and in response to two or more different sub-requests of the transmission request, the first server of the secure MPC system receives a first set of candidate selection values ​​from a separate server (408). For example, MPC1 may receive a secret share of a set of candidate selection values ​​from MPC2 and from SSP 170.

[0153] In some implementations, this includes receiving at least two secret shares for each candidate selection value in the first set of candidate selection values ​​from a separate server. For example, MPC1 may receive two secret shares for each candidate selection value from SSP 170, wherein the first secret share is unencrypted and the second secret share is encrypted using a public-key encryption algorithm and MPC2's public key.

[0154] Process 400 continues with the first server collaborating with the second server of the MPC system to perform a selection process to generate the selection results for the winning numerical component. This selection process includes the first server merging a first set of candidate selection values ​​and a set of cached selection values ​​to create a final set of candidate selection values; the first server sorting the final set of candidate selection values ​​according to their values; and the first server applying each of a set of two or more selection rules (410). For example, the computing system MPC1 of the MPC cluster 130 can collaborate with MPC2 to perform the selection process regarding... Figure 2 and Figure 3 The final selection process is as follows: MPC cluster 130 applies all selection rules to the cached selection values ​​and the selection values ​​received from SSP 170 to determine a set of eligible selection values. MPC cluster 130 then ranks the eligible selection values ​​and selects the winner of the selection process.

[0155] In some implementations, the selection process includes a first server of the secure MPC system merging two or more groups of candidate selection values ​​and a set of cached selection values ​​to create a final set of candidate selection values, and then the first server of the secure MPC system sorting the final set of candidate selection values ​​according to the values ​​of the candidate selection values. In some implementations, merging and sorting may be performed by the first server as a single comparison-based sorting process. For example, MPC cluster 130 may perform a merge-sort operation on cached selection values ​​and selection values ​​received from SSP 170.

[0156] In some implementations, the group selection rule includes at least a privacy-preserving anonymization enforcement rule. In some implementations, the group selection rule includes a budget rule or a pacing rule. In some implementations, the group selection rule includes at least one rule specifying a function in which each user group identifier in a set of one or more user group identifiers is compared with a user group identifier mapped to a candidate selection value. For example, MPC cluster 130 may determine the eligibility of each candidate selection value in a final set of candidate selection values ​​indicated by a digital component request, based on user group membership of the candidate selection values.

[0157] Process 400 continues, with the first server of the secure MPC system cooperating with the second server of the MPC system to transmit the winning selection value to the user device (412). For example, MPC1 of MPC cluster 130 can provide the secret share of the winning selection value to the client device 110.

[0158] In some implementations, transmitting the winning selection value from the final selection process includes receiving a first secret share of the selection result from a second server of the secure MPC system by a first server of the secure MPC system; and transmitting (i) the first secret share of the selection result and (ii) the second secret share of the selection result from the first server of the secure MPC system to the client device. For example, MPC2 of MPC cluster 130 transmits a secret share of MPC2 indicating the digital components of the data mapped to the winning selection value to MPC1 of MPC cluster 130, and MPC1 transmits its own secret share of the data indicating the digital components of the data mapped to the winning selection value, together with the secret share from MPC2, to the client device 110.

[0159] In some implementations, MPC2 encrypts its secret share of the selection result before sending it to MPC1. In this way, MPC1 cannot combine the two secret shares to obtain the plaintext value of the selection result, preventing MPC1 from identifying the winning selection value and its corresponding digital components, thereby protecting user privacy regarding the digital components presented to the user. Each MPC2 can encrypt its share of the selection result using the public key of the user device or the application of the user device. The user device can then decrypt the selection result using its private key corresponding to the public key.

[0160] Process 400 may include receiving a notification from an application on a user device by a first server of the secure MPC system, the notification including data indicating the rendering of digital components on the client device. For example, MPC1 of MPC cluster 130 may receive an impression notification from client device 110 indicating that digital components are rendered at client device 110.

[0161] In some implementations, process 400 includes updating a data structure used by a first server of the secure MPC system to determine whether a digital component satisfies a privacy-preserving anonymization enforcement rule, which maintains values ​​for privacy-preserving properties corresponding to the winning selection value. For example, MPC cluster 130 may update a counter variable `satisfy_k_anonymity` for each selection value x. x The variable satisfy_k_anonymity x This indicates whether the selected value x satisfies the k-anonymization rule.

[0162] In some implementations, the notification, along with a second request for a second selection value, is received by a first server of the secure MPC system. This notification includes data indicating that the digital component corresponding to the winning selection value is presented on the client device. For example, application 112 may asynchronously provide the impression notification to MPC cluster 130 along with subsequent digital component requests to conserve required transmission and computational resources.

[0163] Figure 5 This is a block diagram of an example computer system 500 that can be used to perform the operations described above. System 500 includes a processor 510, memory 520, storage device 530, and input / output device 540. Each of components 510, 520, 530, and 540 can be interconnected, for example, using a system bus 550. Processor 510 is capable of processing instructions for execution within system 500. In some embodiments, processor 510 is a single-threaded processor. In another embodiment, processor 510 is a multi-threaded processor. Processor 510 is capable of processing instructions stored in memory 520 or storage device 530.

[0164] Memory 520 stores information within system 500. In one embodiment, memory 520 is a computer-readable medium. In some embodiments, memory 520 is a volatile memory cell. In another embodiment, memory 520 is a non-volatile memory cell.

[0165] Storage device 530 provides mass storage for system 500. In some embodiments, storage device 530 is a computer-readable medium. In various embodiments, storage device 530 may include, for example, a hard disk drive, an optical disk drive, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other mass storage device.

[0166] Input / output device 540 provides input / output operations for system 500. In some embodiments, input / output device 540 may include one or more network interface devices, such as Ethernet cards, serial communication devices, such as RS-232 ports, and / or wireless interface devices, such as 802.11 cards. In another embodiment, input / output device may include a driver device configured to receive input data and send output data to external device 560 (e.g., keyboard, printer, and display device). However, other embodiments may also be used, such as mobile computing devices, mobile communication devices, set-top box television client devices, etc.

[0167] Although already Figure 5An example processing system is described herein, but the implementation of the subject matter and functional operations described herein may be implemented in other types of digital electronic circuits, or in computer software, firmware, or hardware, including the structures disclosed herein and their structural equivalents, or combinations thereof.

[0168] Embodiments of the subject matter and operations described in this specification may be implemented in digital electronic circuits or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or combinations thereof. Embodiments of the subject matter described in this specification may be implemented as one or more computer programs, i.e., one or more computer program instruction modules encoded on a computer storage medium (or multiple media), for execution by a data processing apparatus or for controlling the operation of a data processing apparatus. Alternatively or additionally, program instructions may be encoded on artificially generated propagated signals, such as machine-generated electrical, optical, or electromagnetic signals, generated to encode information for transmission to a suitable receiver device for execution by the data processing apparatus. The computer storage medium may be or be included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination thereof. Furthermore, while the computer storage medium is not a propagated signal, it may be a source or destination of computer program instructions encoded in artificially generated propagated signals. The computer storage medium may also be or be included in one or more separate physical components or media (e.g., multiple CDs, discs, or other storage devices).

[0169] The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or on data received from other sources.

[0170] The term "data processing apparatus" includes all types of devices, apparatuses, and machines for processing data, including, for example, programmable processors, computers, systems-on-a-chip, or a combination thereof. The apparatus may include special-purpose logic circuitry, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits). In addition to hardware, the apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or combinations thereof. The apparatus and execution environment can implement a variety of different computing model infrastructures, such as web services, distributed computing, and grid computing infrastructures.

[0171] Computer programs (also known as programs, software, software applications, scripts, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as standalone programs or modules, components, subroutines, objects, or other units suitable for a computing environment. A computer program may, but does not need to, correspond to a file in a file system. A program may be stored as a part of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple collaborative files (e.g., a file storing one or more modules, subroutines, or code sections). A computer program can be deployed to execute on a single computer or on multiple computers located in one place or distributed across multiple locations and interconnected through a communication network.

[0172] The processes and logic flows described in this specification can be executed by one or more programmable processors, which execute one or more computer programs to perform actions by manipulating input data and generating outputs. The processes and logic flows can also be executed by dedicated logic circuits, and the device can be implemented as dedicated logic circuits, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits).

[0173] Processors suitable for executing computer programs include, for example, general-purpose and special-purpose microprocessors. Typically, a processor receives instructions and data from read-only memory or random access memory, or both. The basic components of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include or be operatively coupled to one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, to receive data from or transfer data to, or both, such mass storage devices. However, a computer does not need to have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), etc. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices such as EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROMs and DVD-ROMs. The processor and memory can be supplemented or incorporated by dedicated logic circuitry.

[0174] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user and a keyboard and pointing device for the user to provide input to the computer. The display device may be, for example, a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, and the pointing device may be, for example, a mouse or trackball. Other types of devices may also be used to provide interaction with the user; for example, feedback provided to the user may be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user may be received in any form, including sound, speech, or tactile input. Furthermore, the computer can interact with the user by sending documents to and receiving documents from the device used by the user; for example, by sending a webpage to a web browser on the user's client device in response to a request received from a web browser.

[0175] Embodiments of the subject matter described in this specification can be implemented in computing systems that include backend components, such as data servers, or middleware components, such as application servers, or frontend components, such as client computers having a graphical user interface or web browser through which users can interact with embodiments of the subject matter described in this specification, or any combination of one or more of the backend, middleware, or frontend components. The components of the system can be interconnected via any form or medium of digital data communication, such as a communication network. Examples of communication networks include local area networks (LANs) and wide area networks (WANs), the Internet (e.g., the Internet), and peer-to-peer networks (e.g., self-organizing peer-to-peer networks).

[0176] A computing system may include clients and servers. Clients and servers are typically geographically separated and usually interact via a communication network. The client-server relationship arises from computer programs running on respective computers and having a client-server relationship with each other. In some embodiments, the server transmits data (e.g., HTML pages) to a client device (e.g., to display data to a user interacting with the client device and to receive user input from that user). Data generated at the client device (e.g., the result of user interaction) can be received from the client device at the server.

[0177] While this specification contains numerous specific implementation details, these should not be construed as limiting any invention or the scope of any possible claims, but rather as descriptions of specific features of specific embodiments of a particular invention. Certain features described in this specification within the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments. Furthermore, although features may be described above as functioning in certain combinations, and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and the claimed combination may be for sub-combinations or variations thereof.

[0178] Similarly, although the operations are depicted in a specific order in the figures, this should not be construed as requiring such operations to be performed in the specific order or sequence shown, or requiring all illustrated operations to be performed in order to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of the various system components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0179] Therefore, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the invention. In some cases, the actions described in the invention can be performed in a different order and the desired result can still be obtained. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0180] The following is a non-exhaustive list of aspects of this disclosure:

[0181] Aspect 1. A computer-implemented method comprising:

[0182] The first server of the secure multi-party computation (MPC) system receives requests for digital components from applications on user devices.

[0183] The first server parses the request into two or more different sub-requests;

[0184] The first server of the secure MPC system transmits each of the two or more different sub-requests to a different server;

[0185] In response to transmitting the two or more different sub-requests, the first server receives a first set of candidate selection values ​​from a separate server;

[0186] The selection process, performed collaboratively by the first server and one or more second servers of the MPC system, generates the selection results for the winning digital component, including:

[0187] The first server merges the first set of candidate selection values ​​and a set of cached selection values ​​to create a final set of candidate selection values.

[0188] The first server sorts the final set of candidate selection values ​​according to the values ​​of the candidate selection values; and

[0189] The first server applies each of two or more selection rules from a set; and

[0190] The first server, in cooperation with one or more second servers, transmits the selection result of the winning digital component to the user equipment.

[0191] Aspect 1a. The method according to aspect 1, wherein the different server is a second server of the MPC system.

[0192] Aspect 1b. The method according to aspect 1, wherein the different servers are supply-side platform servers.

[0193] Aspect 1c. The method according to any one of Aspects 1 to 1b, wherein the separate server is a supply-side platform server.

[0194] Aspect 2. The method according to any one of aspects 1 to 1c, further comprising:

[0195] The first server of the secure MPC system receives a notification from the application on the user device, the notification including data indicating that the winning digital component is presented on the client device.

[0196] Aspect 3. The method according to aspect 2, wherein the notification, together with a second request for a second selection value, is received by the first server of the secure MPC system, the notification including data indicating that the digital component corresponding to the winning selection value is presented at the client device.

[0197] Aspect 4. The method according to any one of Aspects 1 to 3, wherein transmitting the selection result from the winning digital component of the final selection process comprises:

[0198] The first server of the secure MPC system receives the first secret share of the selection result from each of the second servers of the secure MPC system; and

[0199] The first server of the secure MPC system transmits (i) each first secret share of the selection result and (ii) a second secret share of the selection result to the client device.

[0200] Aspect 5. The method according to any one of Aspects 1 to 4, wherein receiving the first set of candidate selection values ​​includes receiving at least two secret shares of each candidate selection value in the first set of candidate selection values ​​from the separate server.

[0201] Aspect 6. The method according to aspect 5, wherein the merging and the sorting can be performed by the first server as a single comparison-based sorting process.

[0202] Aspect 7. The method according to any one of Aspects 1 to 6, wherein the set of selection rules includes at least privacy-preserving anonymization enforcement rules.

[0203] Aspect 8. A system comprising:

[0204] One or more processors; and

[0205] One or more memory elements including instructions, which, when executed, cause the one or more processors to perform operations, the operations including:

[0206] The first server of the secure multi-party computation (MPC) system receives requests for digital components from applications on user devices.

[0207] The first server parses the request into two or more different sub-requests;

[0208] The first server of the secure MPC system transmits each of the two or more different sub-requests to a different server;

[0209] In response to transmitting the two or more different sub-requests, the first server receives a first set of candidate selection values ​​from a separate server;

[0210] The selection process, performed collaboratively by the first server and one or more second servers of the MPC system, generates the selection results for the winning digital component, including:

[0211] The first server merges the first set of candidate selection values ​​and a set of cached selection values ​​to create a final set of candidate selection values.

[0212] The first server sorts the final set of candidate selection values ​​according to the values ​​of the candidate selection values; and

[0213] The first server applies each of two or more selection rules from a set; and

[0214] The first server, in cooperation with one or more second servers, transmits the selection result of the winning digital component to the user equipment.

[0215] Aspect 8a. The system according to aspect 8, wherein the different server is a second server of the MPC system.

[0216] Aspect 8b. The system according to aspect 8, wherein the different servers are supply-side platform servers.

[0217] Aspect 8c. The system according to any one of Aspects 8 to 8b, wherein the separate server is a supply-side platform server.

[0218] Aspect 9. The system according to any one of Aspects 8 to 8c, wherein the operation further comprises:

[0219] The first server of the secure MPC system receives a notification from the application on the user device, the notification including data indicating that the winning digital component is presented on the client device.

[0220] Aspect 10. The system according to Aspect 9, wherein the notification, together with a second request for a second selection value, is received by the first server of the secure MPC system, the notification including data indicating that the digital component corresponding to the winning selection value is presented at the client device.

[0221] Aspect 11. The system according to any one of Aspects 8 to 10, wherein transmitting the selection result of the winning digital component from the final selection process comprises:

[0222] The first server of the secure MPC system receives the first secret share of the selection result from each of the second servers of the secure MPC system; and

[0223] The first server of the secure MPC system transmits (i) each first secret share of the selection result and (ii) a second secret share of the selection result to the client device.

[0224] Aspect 12. The system according to any one of Aspects 8 to 11, wherein receiving the first set of candidate selection values ​​includes receiving at least two secret shares of each candidate selection value in the first set of candidate selection values ​​from a separate server.

[0225] Aspect 13. The system according to aspect 12, wherein the merging and the sorting are performed by a first server as a single comparison-based sorting process.

[0226] Aspect 14. The system according to any one of Aspects 8 to 13, wherein the set of selection rules includes at least privacy-preserving anonymization enforcement rules.

[0227] Aspect 15. A non-transitory computer storage medium encoded with instructions, said instructions causing the distributed computing system to perform operations when executed by the distributed computing system, said operations including:

[0228] The first server of the secure multi-party computation (MPC) system receives requests for digital components from applications on user devices.

[0229] The first server parses the request into two or more different sub-requests;

[0230] The first server of the secure MPC system transmits each of the two or more different sub-requests to a different server;

[0231] In response to transmitting the two or more different sub-requests, the first server receives a first set of candidate selection values ​​from a separate server;

[0232] The selection process, performed collaboratively by the first server and one or more second servers of the MPC system, generates the selection results for the winning digital component, including:

[0233] The first server merges the first set of candidate selection values ​​and a set of cached selection values ​​to create a final set of candidate selection values.

[0234] The first server sorts the final set of candidate selection values ​​according to the values ​​of the candidate selection values; and

[0235] The first server applies each of two or more selection rules from a set; and

[0236] The first server, in cooperation with one or more second servers, transmits the selection result of the winning digital component to the user equipment.

[0237] Aspect 15a. The non-transitory computer storage medium according to aspect 15, wherein the different server is a second server of the MPC system.

[0238] Aspect 15b. The non-transitory computer storage medium according to aspect 15, wherein the different servers are supply-side platform servers.

[0239] Aspect 15c. The non-transitory computer storage medium according to any one of aspects 15 to 15b, wherein the separate server is a supply-side platform server.

[0240] Aspect 16. The non-transitory computer storage medium according to any one of aspects 15 to 15c, wherein the operation further comprises:

[0241] The first server of the secure MPC system receives a notification from the application on the user device, the notification including data indicating that the winning digital component is presented on the client device.

[0242] Aspect 17. The non-transitory computer storage medium according to aspect 16, wherein the notification, together with a second request for a second selection value, is received by the first server of the secure MPC system, the notification including data indicating that the digital component corresponding to the winning selection value is presented at the client device.

[0243] Aspect 18. The non-transitory computer storage medium according to any one of Aspects 15 to 17, wherein transmitting the selection result of the winning digital component from the final selection process comprises:

[0244] The first server of the secure MPC system receives the first secret share of the selection result from each of the second servers of the secure MPC system; and

[0245] The first server of the secure MPC system transmits (i) each first secret share of the selection result and (ii) a second secret share of the selection result to the client device.

[0246] Aspect 19. The non-transitory computer storage medium according to any one of Aspects 15 to 18, wherein receiving the first set of candidate selection values ​​includes receiving at least two secret shares of each candidate selection value in the first set of candidate selection values ​​from the separate server.

[0247] Aspect 20. The non-transitory computer storage medium according to any one of aspects 15 to 19, wherein the merging and sorting are performed by the first server as a single comparison-based sorting process.

[0248] Aspect 21. A system comprising: one or more processors; and

[0249] One or more memory elements comprising instructions that, when executed, cause the one or more processors to perform operations including the method according to any one of aspects 1 to 7.

[0250] Aspect 22. A non-transitory computer storage medium encoded with instructions that, when executed by a distributed computing system, cause the distributed computing system to perform operations including the method according to any one of Aspects 1 to 7.

Claims

1. A computer-implemented method comprising: receiving, by a first server of a secure multi-party computation (MPC) system, a request for a digital component from an application on a user device; parsing, by the first server, the request into two or more different sub-requests; transmitting, by the first server of the secure MPC system, each of the two or more different sub-requests to a different server; in response to transmitting the two or more different sub-requests, receiving, by the first server, a first set of candidate selection values from the separate servers; performing, by the first server in cooperation with one or more second servers of the secure MPC system, a selection process to generate a selection result of a winning digital component, including: merging, by the first server, the first set of candidate selection values and a set of cached selection values to create a final set of candidate selection values; ordering, by the first server, the final set of candidate selection values according to values of the final set of candidate selection values; and applying, by the first server, each of a set of two or more selection rules; and transmitting, by the first server in cooperation with the one or more second servers, the selection result of the winning digital component to the user device.

2. The method of claim 1, further comprising: receiving, by the first server of the secure MPC system, a notification from the application on the user device, the notification including data indicating that the winning digital component is presented at the user device.

3. The method of claim 2, wherein, the notification is received by the first server of the secure MPC system with a second request for a second selection value, the notification including data indicating that the winning digital component is presented at the user device.

4. The method of claim 1, wherein, transmitting the selection result of the winning digital component from the selection process includes: receiving, by the first server of the secure MPC system, a respective first secret share of the selection result from each second server of the secure MPC system; and transmitting, by the first server of the secure MPC system to the user device, (i) each first secret share of the selection result and (ii) a second secret share of the selection result computed by another secure MPC system.

5. The method of claim 1, wherein, receiving the first set of candidate selection values includes receiving at least two secret shares of each candidate selection value in the first set of candidate selection values from the separate servers.

6. The method of claim 5, wherein, the merging and the ordering can be performed by the first server as a single comparison-based ordering process.

7. The method of claim 1, wherein, the set of selection rules includes at least a privacy-preserving anonymization enforcement rule.

8. A system for selecting a digital component to assign to a client device, comprising: one or more processors; and one or more memory elements including instructions that, when executed, cause the one or more processors to perform operations comprising: receiving, by a first server of a secure multi-party computation (MPC) system, a request for a digital component from an application on a user device; parsing, by the first server, the request into two or more different sub-requests; transmitting, by the first server of the secure MPC system, each of the two or more different sub-requests to a different server; in response to transmitting the two or more different sub-requests, receiving, by the first server, a first set of candidate selection values from the separate servers; performing, by the first server in cooperation with one or more second servers of the secure MPC system, a selection process to generate a selection result of a winning digital component, including: merging, by the first server, the first set of candidate selection values and a set of cached selection values to create a final set of candidate selection values; ordering, by the first server, the final set of candidate selection values according to values of the final set of candidate selection values; and applying, by the first server, each of a set of two or more selection rules; and transmitting, by the first server in cooperation with the one or more second servers, the selection result of the winning digital component to the user device.

9. The system of claim 8, the operations further comprising: receiving, by the first server of the secure MPC system, a notification from the application on the user device, the notification including data indicating that the winning digital component was presented at the user device.

10. The system of claim 9, wherein, the notification is received by the first server of the secure MPC system with a second request for a second selection value, the notification including data indicating that the winning digital component was presented at the user device.

11. The system of claim 8, wherein, transmitting the selection result of the winning digital component from the selection process includes: receiving, by the first server of the secure MPC system, a first secret share of the selection result from each second server of the secure MPC system; and transmitting, by the first server of the secure MPC system to the user device, (i) each first secret share of the selection result and (ii) a second secret share of the selection result computed by another secure MPC system.

12. The system of claim 8, wherein, receiving the first set of candidate selection values includes receiving at least two secret shares of each candidate selection value in the first set of candidate selection values from the separate servers.

13. The system of claim 12, wherein, the merging and the ordering can be performed by the first server as a single comparison-based ordering process.

14. The system of claim 8, wherein, the set of selection rules includes at least a privacy-protecting anonymization enforcement rule.

15. A computer storage medium encoded with instructions that, when executed by a distributed computing system, cause the distributed computing system to perform operations comprising: receiving, by a first server of a secure multi-party computation (MPC) system, a request for a digital component from an application on a user device; parsing, by the first server, the request into two or more different sub-requests; transmitting, by the first server of the secure MPC system, each of the two or more different sub-requests to a different server; in response to transmitting the two or more different sub-requests, receiving, by the first server, a first set of candidate selection values from the separate servers; performing, by the first server in collaboration with one or more second servers of the secure MPC system, a selection process to generate a selection result of a winning digital component, including: merging, by the first server, the first set of candidate selection values and a set of cached selection values to create a final set of candidate selection values; ordering, by the first server, the final set of candidate selection values according to values of the final set of candidate selection values; and applying, by the first server, each rule of a set of two or more selection rules; and transmitting, by the first server in collaboration with the one or more second servers, the selection result of the winning digital component to the user device.

16. The computer storage medium of claim 15, the operations further comprising: receiving, by the first server of the secure MPC system, a notification from the application on the user device, the notification including data indicating that the winning digital component was presented at the user device.

17. The computer storage medium of claim 16, wherein, the notification is received by the first server of the secure MPC system with a second request for a second selection value, the notification including data indicating that the winning digital component was presented at the user device.

18. The computer storage medium of claim 15, wherein, transmitting the selection result of the winning digital component from the selection process includes: receiving, by the first server of the secure MPC system from each second server of the secure MPC system, a first secret share of the selection result; and transmitting, by the first server of the secure MPC system to the user device, (i) each first secret share of the selection result and (ii) a second secret share of the selection result computed by another secure MPC system.

19. The computer storage medium of claim 15, wherein, receiving the first set of candidate selection values includes receiving at least two secret shares of each candidate selection value in the first set of candidate selection values from the separate servers.

20. The computer storage medium of claim 19, wherein, the merging and the ordering can be performed by the first server as a single comparison-based ordering process.

Images