Feedback controller using secret sharing

Abstract

This document describes the use of a feedback controller implemented using secret sharing to pace and control the rate of digital component distribution. In one aspect, a method includes, for each of one or more activities, initializing, by a first computing system in a multi-party computation (MPC) system and one or more second computing systems in the MPC system, a feedback controller for the activity in secret shares using a secure MPC process. The first computing system updates an output of the feedback controller based on an error parameter representing a difference between a set point and a measured rate of the activity. The first computing system determines, based at least on the output of the first secret share, a first secret share of a pacing selector parameter that defines whether the activity satisfies a pacing eligibility condition for the activity.

Description

Technical Field

[0001] This specification relates to cryptography and feedback controllers. Background Art

[0002] A feedback controller is a controller that monitors a process variable and, based on the difference between the actual value of the process variable and a set point, generates an action to drive the process variable to the same value as the set point. One type of feedback controller is a proportional-integral-derivative (PID) controller. Summary of the Invention

[0003] In general, one innovative aspect of the subject matter described herein can be embodied in a method comprising: for each of one or more activities: a first computing system in a plurality of multi-party computation (MPC) systems, in collaboration with one or more second computing systems in the MPC systems, initializing a feedback controller for the activity using a secure MPC process in a secret share, wherein the feedback controller includes a setpoint based on a target rate of the activity; updating, by the first computing system, an output of the feedback controller based on an error parameter representing a difference between the setpoint and a measured rate of the activity; and determining, by the first computing system, a first secret share of a pacing selector parameter that defines whether the activity satisfies a pacing eligibility condition for the activity based on at least the output of the first secret share. The method comprises: receiving, by the first computing system, a digital component request; performing, by the first computing system and the one or more second computing systems, a given digital component selection process for the digital component request, wherein the digital component selection process selects a given digital component from a set of candidate digital components, each candidate digital component in the set of candidate digital components satisfying one or more eligibility conditions, the one or more eligibility conditions including being in an eligible activity that satisfies the pacing eligibility condition; and transmitting, by the first computing system, a first secret share identifying a selection result of the given digital component to a client device. Other embodiments of this aspect include corresponding apparatus, systems, and computer programs encoded on computer storage devices configured to perform aspects of the method.

[0004] These and other embodiments can each optionally include one or more of the following features.In some aspects, the target rate for an activity includes one of a target presentation rate for the activity, a target user interaction rate for a given activity, or a target resource consumption rate for a given activity.

[0005] In some aspects, the feedback controller comprises a proportional-integral-derivative (PID) controller. The digital component request can include a secret share of data identifying one or more first user groups including a user of the client device as a member. Performing a given digital component selection process for the digital component request by the first computing system in collaboration with the one or more second computing systems can include: identifying a plurality of digital components, wherein each digital component corresponds to: (i) a corresponding selection value, (ii) a corresponding second user group identifier of a corresponding second user group to which the digital component is eligible for distribution, and (iii) a corresponding activity including the digital component; for each selection value, determining a first secret share of an overall candidate parameter, the overall candidate parameter indicating: (i) whether the second user group identifier corresponding to the selection value matches one of the one or more first user groups, and (ii) whether a pacing selector parameter of the corresponding activity indicates that the corresponding activity satisfies a pacing eligibility condition of the corresponding activity; and generating a first secret share of a selection result based on the corresponding selection value and the candidate parameters of each digital component in the plurality of digital components, wherein the given digital component is a particular digital component with a highest selection value from the set of eligible digital components.

[0006] In some aspects, each qualifying digital component is a digital component for which the overall candidate parameter has a specified value, wherein the specified value indicates that: (i) the second user group identifier corresponding to the digital component matches one of the one or more first user groups, and (ii) a corresponding pacing selector parameter of an activity including the digital component indicates that the activity satisfies the pacing eligibility condition.

[0007] Generating a first secret share for a selection result can include: generating an order of a plurality of digital components based on the magnitude of each selected value; determining a first secret share for a cumulative value of each selected value based on the order of the digital components and an overall candidate parameter for each digital component; determining a first secret share for a winner parameter for each digital component based on (i) the overall candidate parameter for the selected value and (ii) a result of an equality test indicating whether the cumulative value of the selected value is a specific specified value; and determining, for each selected value, a first secret share for a sum of products of the winner parameter for the selected value and a digital component information element of the selected value as the first secret share for the selection result. Determining the first secret share for the cumulative value of each selected value can include, for each individual selected value, determining, between the highest selected value and the individual selected value, a number of selected values having a candidate parameter indicating that a second user group identifier corresponding to the selected value matches at least one of the one or more first user group identifiers, including the highest selected value and the individual selected value. The specific specified value can be one or logically true.

[0008] Some aspects can include storing a first secret share of a winner parameter with a reference to a selection process identifier for a given digital component selection process, receiving a notification from a client device, the notification including the selection process identifier and the first secret share of data indicating at least one of (i) whether the given digital component was presented at the client device or (ii) whether a user interacted with the given digital component, and updating a first secret share of a measured rate for a feedback controller of an activity including the given digital component using the selection process identifier and the first secret share of data indicating at least one of (i) whether the digital component was presented at the client device or (ii) whether the user interacted with the given digital component. Some aspects can include collaborating with one or more second computing systems to update a first secret share of a corresponding pacing selector parameter for the given activity based on the updated first secret share of the measured rate and a corresponding second secret share of the measured rate maintained by each of the one or more second computing systems. Updating the first secret share of the corresponding pacing selector parameter of the given activity can include: cooperating with the one or more second computing systems to update the first secret share of the output of the feedback controller for the given activity, and cooperating with the one or more second computing systems to update the first secret share of the pacing selector for the given activity based on the updated first secret share of the output of the feedback controller for the given activity and a corresponding updated second secret share of the output of the feedback controller for the given activity maintained by each of the one or more second computing systems.

[0009] The subject matter described in this specification can be implemented in certain embodiments to achieve one or more of the following advantages: Using a secure MPC process performed by two or more MPC servers operated by different parties to select digital components based on a secret share of user information, ensuring that user information cannot be accessed in plain text by an MPC server or another party without unauthorized collusion between the MPC servers.

[0010] During the digital component selection process, the MPC server can select from among eligible digital components that meet one or more eligibility criteria while preventing parties from accessing user information in clear text. The eligibility criteria can include restrictions and guidelines on the manner or frequency of distribution of the digital components, as well as other factors. These criteria can include user group membership, frequency control, muting, budget, k-anonymity, and / or pacing constraints.

[0011] The user's client device can generate a probabilistic data structure, such as a cuckoo filter, that represents a user group that includes the user as a member. The client device can split the probabilistic data structure into two or more secret shares. Alternatively, the client device can generate a distributed point function, one distributed point function for each user group that includes the user as a member. The distributed point function is a secret share that cryptographically indicates whether the user is a member of the user group. Using the probabilistic data structure and / or distributed point function in this manner protects user privacy by preventing access to user group membership and reduces the size of the information provided to the MPC cluster. This reduction in data size reduces the amount of bandwidth consumed to transmit information, reduces the latency of transmitting information, and reduces the amount of processing power and associated battery power required for battery-operated devices (e.g., mobile devices) to transmit information.

[0012] The MPC cluster is capable of transmitting secret shares identifying the results of selecting digital components selected by the MPC cluster using a secure MPC process. By transmitting only the secret shares of the results of selecting digital components, rather than information about all or a large set of digital components, the bandwidth, latency, processing power, and battery power consumed in transmitting and receiving the results are similarly reduced. This also reduces the potential leakage of confidential information from content platforms that submit selected digital component values to the MPC cluster by limiting the number of digital components for which information is provided to client devices.

[0013] A feedback controller, such as a PID controller, can be implemented using secret sharing to ensure target pacing of digital components, for example, such that active digital components are evenly or nearly evenly distributed over the entire time period of activity. Target pacing can include even distribution of digital components, even user interaction with digital components, or even conversions resulting from viewing digital components over a given time period. The feedback controller can also precisely control digital component distribution resources (e.g., a budget) while preventing others from accessing user information. The feedback controller also provides real-time or near real-time control of pacing and resource consumption while providing targeted privacy protection. Thus, the feedback controller for digital component distribution can eliminate redundant digital component distributions or distributions that would otherwise be too frequent, which saves network resources and associated transmission and reception resources.

[0014] Various features and advantages of the aforementioned subject matter are described below with reference to the accompanying drawings. Additional features and advantages will be apparent from the subject matter described herein and the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 is a block diagram of an environment in which an MPC cluster performs a secure MPC process to select digital components for distribution to client devices.

[0016] Figure 2is a swim lane diagram of an example process for selecting a digital component for display at a client device.

[0017] Figure 3 is a swim lane diagram of an example process for selecting a digital component for distribution to a client device.

[0018] Figure 4 is a swim lane diagram illustrating an example process for determining a secret share for a pacing selector parameter using a feedback controller.

[0019] Figure 5 is a flow chart illustrating an example process for selecting a digital component for distribution to a client device.

[0020] Figure 6 is a block diagram of an example computer system.

[0021] The same reference numbers and names in different drawings indicate the same elements. DETAILED DESCRIPTION

[0022] In general, this document describes systems and techniques for pacing and controlling the rate of digital component distribution using a feedback controller implemented using secret sharing. The control techniques described herein can be used with other types of controllers where information should be kept confidential. An MPC cluster of server computers can perform a secure MPC process to select digital components based on user information or signals derived from the user information, without the MPC server being able to access the user information or the derived signals in plain text without unauthorized collusion. User information can be sent to the MPC cluster using probabilistic data structures or distributed point functions to reduce the data size of the information transmitted over the network and maintain the security of the information during transmission.

[0023] A feedback controller (e.g., a PID controller) implemented using secret sharing can be used to control when one or more digital components of an activity meet eligibility conditions, making the digital components eligible for distribution to client devices, e.g., assuming the digital components meet any other conditions set for the digital components. A variable of the controller can be calculated and maintained by the MPC cluster in the secret share. The variable can be based on the number of digital component displays, the number of user interactions with the digital component, or the amount of distribution resources (e.g., a budget) allocated for the digital component of the activity. For example, the variable can be a display rate, an interaction rate, a conversion rate, and / or a resource consumption rate. The display rate can be the rate at which the digital component of the activity is displayed within a given time period. The interaction rate can be the rate at which interactions with the digital component occur within a given time period. The conversion rate can be the rate at which conversions occur after the digital component is displayed within a given time period. The resource consumption rate can be the rate at which distribution resources allocated for the digital component of the activity are consumed within a given time period. The controller can adjust the probability of a digital component being eligible for selection in response to a digital component request based on the difference between the set point of the variable and the actual rate.

[0024] Figure 1 1 is a block diagram of an environment 100 in which an MPC cluster performs a secure MPC process to select digital components for distribution to a client device 110. The example environment 100 includes a data communications network 105, such as a local area network (LAN), a wide area network (WAN), the Internet, a mobile network, or a combination thereof. The network 105 connects the client devices 110, secure MPC clusters 130, publishers 140, websites 142, content platforms, such as supply-side platforms (SSPs) 170, and demand-side platforms (DSPs) 150. The example environment 100 can include many different client devices 110, secure MPC clusters 130, publishers 140, websites 142, DSPs 150, and SSPs 170.

[0025] The client device 110 is an electronic device capable of communicating over the network 105. Example client devices 110 include personal computers, mobile communication devices, such as smart phones, and other devices capable of sending and receiving data over the network 105. The client device can also include a digital assistant device that accepts audio input through a microphone and outputs audio output through a speaker. When the digital assistant detects a "hot word" or "hot phrase" that activates the microphone to accept audio input, the digital assistant can be placed in a listening mode (e.g., ready to accept audio input). The digital assistant device can also include a camera and / or a display to capture images and visually present information. The digital assistant can be implemented in different forms of hardware devices, including wearable devices (e.g., watches or glasses), smart phones, speaker devices, tablet devices, or another hardware device. The client device can also include a digital media device, such as a streaming device that is plugged into a TV or other display to stream video to a TV, a gaming system, or a virtual reality system.

[0026] The client device 110 typically includes applications 112, such as a web browser and / or native applications, to facilitate sending and receiving data over the network 105. Native applications are applications developed for a specific platform or specific device (e.g., a mobile device with a specific operating system). Publishers 140 can develop and provide (e.g., make available for download) native applications to client devices 110. For example, in response to a user of the client device 110 entering a resource address of a resource 145 in an address bar of a web browser or selecting a link that references a resource address, the web browser can request the resource 145 from a web server hosting a website 142 of the publisher 140. Similarly, native applications can request application content from a publisher's remote server.

[0027] Some resources, application pages or other application content can include a digital component slot for displaying a digital component together with a resource 145 or application page. As used throughout this document, the phrase "digital component" refers to a discrete unit of digital content or digital information (e.g., a video clip, an audio clip, a multimedia clip, an image, text, or another content unit). A digital component can be stored electronically in a physical memory device as a single file or as a collection of files, and the digital component can take the form of a video file, an audio file, a multimedia file, an image file, or a text file, and include advertising information, such that an advertisement is a type of digital component. For example, a digital component can be content that is intended to supplement the content of a web page or other resource displayed by an application 112. More specifically, a digital component can include digital content related to the resource content (e.g., the digital component can relate to the same topic as the web page content, or a related topic). Therefore, the provision of a digital component can supplement and generally enhance the web page or application content.

[0028] When an application 112 loads a resource (or application content) that includes one or more digital component slots, the application 112 can request a digital component for each slot. In some embodiments, the digital component slots can include code (e.g., a script) that enables the application 112 to request the digital component from a digital component distribution system, which selects the digital component and provides it to the application 112 for display to a user of the client device 110. As described below, the application 112 can request the digital component from the MPC cluster 130 and / or one or more SSPs 170.

[0029] Some publishers 140 use an SSP 170 to manage the process of obtaining digital components for their resources and / or applications' digital component slots. An SSP 170 is a technology platform implemented in hardware and / or software that automates the process of obtaining digital components for resources and / or applications. Each publisher 140 can have a corresponding SSP 170 or multiple SSPs 170. Several publishers 140 may use the same SSP 170.

[0030] Digital component providers 160 can create (or otherwise publish) digital components for display in digital component slots of publishers' resources and applications. Digital component providers 160 can use DSPs 150 to manage the provision of their digital components for display in digital component slots. DSP 150 is a technology platform implemented in hardware and / or software that automates the process of distributing digital components for display with resources and / or applications. DSP 150 can interact with multiple supply-side platforms (SSPs) on behalf of digital component providers 160 to provide digital components for display with resources and / or applications from multiple different publishers 140. Generally, DSP 150 can receive a request for a digital component (e.g., from an SSP), generate (or select) selection values for one or more digital components created by one or more digital component providers based on the request, and provide the SSPs with data related to the digital component (e.g., the digital component itself) and selection parameters. The selection value can indicate the amount that the digital component provider 160 is willing to provide for display or user interaction with the digital component. The SSP can then select a digital component to display at the client device 110 and provide data to the client device 110 that causes the client device 110 to display the digital component.

[0031] In some cases, it is beneficial for users to receive digital components related to web pages, application pages, or other electronic resources that the user has previously accessed and / or interacted with. In order to distribute such digital components to users, when a user accesses a particular resource or performs a particular action on that resource (e.g., interacting with a particular item displayed on a web page or adding that item to a virtual shopping cart), the user can be assigned to a user group, such as a user interest group, a group of similar users, or other group types involving similar user data. The user group can be generated by the digital component provider 160. That is, when a user accesses the electronic resources of the digital component provider 160, each digital component provider 160 can assign the user to their user group. The user group can also be created by the content platform, such as by the DSP 150 and / or SSP 170.

[0032] To protect user privacy, user group membership can be maintained at the user's client device 110, for example, by one of the applications 112 or the operating system of the client device 110, rather than by the digital component provider, content platform, or other party. In a specific example, a trusted program (e.g., a web browser or an operating system) can maintain a list of user group identifiers ("user group list") for a user using a web browser or another application (e.g., a user logged into the browser, application, or client device 110). The user group list can include a group identifier for each user group of which the user is a member. Digital component providers 160 that create user groups can specify user group identifiers for their user groups. The user group identifier of a user group can describe the group (e.g., a gardening group) or be a code (e.g., a non-descriptive alphanumeric sequence) representing the group. The user group list of a user can be stored in secure storage at the client device 110 and / or can be encrypted when stored to prevent others from accessing the list.

[0033] When the application 112 displays a resource or application content related to the digital component provider 160 or a web page on the website 142, the resource can request the application 112 to add one or more user group identifiers to the user group list. In response, the application 112 can add the one or more user group identifiers to the user group list and securely store the user group list.

[0034] In some embodiments, the MPC cluster 130 can use the user's user group membership to select digital components or other content that may be of interest to the user or that may otherwise be beneficial to the user / user device. For example, such digital components or other content may include data that improves the user experience, improves the operation of the user's device, or benefits the user or user device in some other way. However, a user group identifier for the user's user group list can be provided and used to select digital components in a manner that prevents the computing systems MPC1 and MPC2 in the MPC cluster 130 from accessing the user's user group identifier in plain text, thereby protecting the user's privacy when using user group membership data to select digital components. Plain text is text that is not computationally marked, specially formatted, or written in code or data (including binary files) in a form that can be viewed or used without the need for a key or other decryption device or other decryption process.

[0035] The secure MPC cluster 130 includes two computing systems, MPC1 and MPC2 (e.g., server computers), that perform a secure MPC process to select digital components for distribution to a user's client device based on user group membership, but without accessing the group membership or other user information or signals derived from such user information in plain text. Although the example MPC cluster 130 includes two computing systems, more computing systems can be used as long as the MPC cluster 130 includes more than one computing system. For example, the MPC cluster 130 can include three computing systems, four computing systems, or another suitable number of computing systems. Using more computing systems in the MPC cluster 130 can provide greater security, but can also increase the complexity of the MPC process.

[0036] Computing systems MPC1 and MPC2 can be operated by different entities. In this way, each entity may not be able to access user group memberships, other user information, or signals derived from such user information in plain text. For example, one of computing systems MPC1 or MPC2 can be operated by a trusted party different from the user, publisher 140, DSP 150, SSP 170, and digital component provider 160. For example, an industry group, a government group, or a browser developer can maintain and operate one of computing systems MPC1 and MPC2. The other computing system can be operated by a different one of these groups, such that a different trusted party operates each computing system MPC1 and MPC2. Preferably, the different parties operating different computing systems MPC1 and MPC2 have no incentive to collude to compromise user privacy. In some embodiments, computing systems MPC1 and MPC2 are architecturally separate and monitored so that they do not communicate with each other except to execute the secure MPC process described herein.

[0037] Each computing system MPC1 and MPC2 can store selection values (and other information) for digital components. For example, computing systems MPC1 and MPC2 can cache selection values previously received from SSP 170 and / or DSP 150 as part of a previous digital component selection process. In this manner, MPC cluster 130 can use the selection values to select digital components for distribution to client device 110 in response to future user group-based digital component requests received from client device 110.

[0038] In the example below, each digital component has a user group-based condition that qualifies the digital component and its selection value only for use in a digital component selection process in which the digital component is selected for users who are members of a particular group. Additionally or alternatively, each digital component can be associated with other conditions, such as a frequency control condition that prevents the same user from being exposed to the same digital component more than a specified number of times within a period of time, a mute condition that prevents the digital component from being displayed to users who have opted to mute, a k-anonymity condition, and / or a pacing condition as described in more detail below.

[0039] In some embodiments, each computing system MPC1 and MPC2 uses a two-level lookup table (LUT) to store selection values for digital components. Using a two-level LUT can provide some performance advantages, but other suitable data structures can also be used. The first level can be keyed by a user group request key (UG_Request_Key). The UG_Request_Key can be a composite message based on a set of context signals, such as a set of context signals for a digital component request (e.g., URL, location, language, etc.) or a set of context signals for which a digital component is eligible for distribution. In other words, the first-level LUT can be keyed based on the set of context signals. The key of the first level can be a hash of the UG_Request_Key, for example, using a hash function such as SHA256. The key can be truncated to a specified number of bits, such as 16 bits, 32 bits, or other suitable number of bits. The value of each key UG_Request_Key in the first-level LUT can indicate a row of the second-level LUT that includes data for a digital component that is eligible for a request for a digital component that includes the context signal of the UG_Request_Key. An example first-level LUT is shown in Table 1 below.

[0040] key value SHA256(UG_Request_Key) OK… … OK…

[0041] Table 1

[0042] The second-level LUT can be keyed based on a combination of the user group request key UG_Request_Key and the user group identifier in the first-level LUT. Each row in the second-level LUT can be used for a specific selection value for a specific digital component. For example, the DSP 150 can submit different selection values for the same digital component, where each selection value is used for a different set of context signals and / or a different user group identifier. Thus, the selection value of a digital component can vary based on context and other factors.

[0043] DSP 150 or digital component provider 160 can associate (e.g., link or map) the digital component to a user group to which DSP 150 or digital component provider wants to display the digital component. For example, DSP 150 may want to display a digital component associated with men's basketball shoes to men who have expressed an interest in basketball and / or shoes. In this example, DSP 150 can provide data to MPC cluster 130 indicating that the digital component corresponds to a user group identifier that includes men who have expressed an interest in basketball and / or shoes.

[0044] In some embodiments, the key for a row in the second-level LUT can be a hash or code generated based on a combination of the user group request key UG_Request_Key and the user group identifier of the numeric component of the row. For example, the key can be a hash-based message authentication code (HMAC) of the combination, which can be represented as HMAC SHA256 (UG_Request_Key, ug_id). The user group identifier ug_id can be based on a combination of the user group's internal user group identifier and the domain of the user group's owner (e.g., the DSP, SSP, or digital component provider that owns the user group). For example, the user group identifier ug_id can be a numeric digest of the owner's domain's eTLD+1 and the user group's owner's internal user group identifier. eTLD+1 is the effective top-level domain (eTLD) plus one more domain than the public suffix. An example of eTLD+1 is "example.com," where ".com" is the top-level domain. ug_id can be truncated to 16 bytes or other appropriate data size.

[0045] Continuing with the previous example of the men's basketball shoes, the second-level lookup key for a row containing information about a digital component to be displayed to users in the men's basketball shoe set can be a combination of the user group request key UG_Request_Key and the user group identifier ug_id of the men's basketball shoe set. Because the digital component can be displayed in different contexts, the second-level lookup table can include multiple rows for the digital component (i.e., the user group identifier ug_id of the men's basketball shoe set), each row having a different user group request key UG_Request_Key and a different value.

[0046] The value of each row of the second level LUT can be a selection value of the digital component and other data of the digital component, such as metadata identifying the digital component or a network location from which the digital component can be downloaded, etc.

[0047] The value can be a digital component information element dc_information_element, which can be a byte array with a selected value and metadata. The byte array can have a specific format that the application 112 or trusted program of the client device 110 and the computing systems MPC1 and MPC2 can parse to obtain the selected value and metadata. An example second-level LUT is shown in Table 2 below.

[0048] key value HMAC(UG_Request_Key,UG_ID) {select value, metadata} … …

[0049] Table 2

[0050] The second-level LUT maps the selection value to a specific digital component, a specific user group identifier ug_id, and a specific context signal set defined by the first-level search key UG_Request_Key. By doing so, the second-level LUT indicates that the selection value of the digital component is eligible for the specific context of the digital component slot. This allows the DSP 150 or digital component provider 160 to specify different selection values for the same digital component in different contexts defined by the context signal and user group membership. When a digital component request is received indicating that the user to whom the digital component will be displayed is a member of a specific user group identified by the specific user group identifier ug_ig and that the digital component will be displayed in the specific context defined by the context signal of the first-level search key, any selection value in the second-level LUT with a matching user group identifier and a matching first-level search key is a candidate selected for distribution in response to the request. Although a two-level LUT is used in this example, other appropriate data structures can also be used.

[0051] DSP 150 or digital component provider 160 can initiate one or more campaigns for a user group. For example, DSP 150 can initiate a campaign for a shoe manufacturer to promote a particular brand of shoes to a specific user group. To promote the campaign, DSP 150 can provide one or more digital components related to (e.g., contextually related to) the particular brand of shoes. In this case, each campaign can be identified by a unique identifier (referred to as a campaign identifier) that distinguishes the campaign from other campaigns of DSP 150. As part of the campaign, digital components can be provided to users who are members of a particular user group. User groups and campaigns can have an m:n relationship, such that one user group can be associated with multiple campaigns n, and one campaign can be delivered to multiple user groups m. DSP 150 or digital component provider 160 can include one or more campaign identifiers for the campaigns in the metadata of the selection values and corresponding digital components that are eligible for selection by MPC cluster 130.

[0052] The metadata for each stored selection value for a digital component that is part of a campaign can include a universal campaign identifier for the campaign, universal_campaign_id. The universal campaign identifier universal_campaign_id can indicate the source of the digital component. For example, the universal campaign identifier universal_campaign_id can uniquely identify the entity (e.g., DSP 150 or digital component provider 160) that provided the selection value for the digital component and / or the specific set of digital components (e.g., a campaign) that triggered the transmission of the digital component to the client device 110. In some embodiments, the universal campaign identifier universal_campaign_id for the digital component can be calculated using an HMAC parameterized by a campaign identifier (e.g., an internal campaign identifier of the entity that provided the selection value) and the domain of the entity, represented as HMAC(campaign_identifier, domain). In some embodiments, the HMAC can be implemented using a secure hash algorithm (SHA-256), which is a cryptographic hash function with a digest length of 256 bits to generate a 256-bit (32-byte) hashed output. In this example, HMAC(campaign_identifier, domain) generates a 256-bit unique identifier for the digital component as a universal campaign identifier. The entity's domain can be the domain's eTLD + 1. Using a universal campaign identifier instead of an internal campaign identifier prevents malicious parties from disrupting other DSPs' pacing and digital component distribution resource utilization. For example, using a digital digest in this manner prevents a malicious party from submitting setpoints, selection values, and the like for legitimate campaigns.

[0053] Each selection value and corresponding digital component that is part of one or more campaigns for one or more user groups can be associated with a user group identifier-universal campaign identifier pair for each campaign. This pair can be represented as {ug_id, universal_campaign_id}, which represents the user group identifier ug_id of the user group and the universal campaign identifier universal_campaign_id of the campaign. This pair can be part of the metadata for the selection value stored in the second-level LUT described above.

[0054] MPC cluster 130 can use a feedback controller for the activity to manage the rate at which the digital components of the activity are provided for display at client device 110. In some embodiments, MPC cluster 130 uses a PID controller to manage the rate at which the digital components are provided. The controller can be implemented using secret sharing to prevent computing systems MPC1 and MPC2 or other entities from obtaining user information, such as user group membership information, in clear text. For example, if not protected using secret sharing, granular resources spent, impressions delivered, and / or click / conversion data can enable computing systems MPC1 and MPC2 to infer user group membership data.

[0055] As described in more detail below, the MPC cluster 130 can receive tuning parameters, setpoints, and digital component distribution resource (e.g., budget) information for an activity from an activity owner (e.g., DSP 150 or digital component provider 160). Some or all of this data can be received as secret shares. The MPC cluster 130 can initialize a PID controller based on this data and update the controller's output in a recurring manner, e.g., periodically, based on updated variables such as presentation rate, interaction rate, etc. The MPC cluster 130 can use this output to set a Boolean pacing selector parameter, pacing_selector, in the secret shares, which defines whether the activity meets the activity's pacing eligibility condition. If so, the digital components included in the activity also meet the pacing eligibility condition. If a digital component meets all conditions for the digital component, including the pacing eligibility condition, then the digital component is a qualified digital component eligible for inclusion in the digital component selection process.

[0056] By adjusting the value of the pacing selector parameter pacing_selector based on updates to the process variables, the MPC cluster 130 can control the rate at which active digital components are distributed, for example, to ensure that the digital components are evenly distributed during the active time period and / or to ensure that digital component distribution resources are not exhausted prematurely during the active time period. As described in more detail below, the pacing selector parameter pacing_selector can be used in combination with another parameter (is_dc_a_candidate) that qualifies a digital component and its corresponding selection value based on one or more other conditions, such as: whether the user group associated with the selection value matches the user group of the user to whom the digital component is to be provided; whether the digital component satisfies a frequency control condition that prevents the same user from being exposed to the same digital component more than a specified number of times within a period of time; whether the digital component satisfies a mute condition that prevents the digital component from being displayed to users who have selected to mute; and / or whether the digital component satisfies a k-anonymity condition.

[0057] In addition to the description throughout this document, controls (e.g., user interface elements with which the user can interact) can be provided to the user to allow the user to choose whether and when the systems, programs, or features described herein can enable the collection of user information (e.g., information about the user's social network, social actions or activities, occupation, the user's preferences, or the user's current location), as well as whether to send content or communications from a server to the user. In addition, before certain data is stored or used, it can be processed in one or more ways so that personally identifiable information is removed. For example, the user's identity can be processed so that personally identifiable information of the user cannot be determined, or the user's geographic location can be generalized (e.g., city, zip code, or state level) if location information is obtained so that the user's specific location cannot be determined. Thus, the user can control what information is collected about the user, how the information is used, and what information is provided to the user.

[0058] Figure 2is a swim lane diagram of an example process 200 for selecting digital components for display at a client device. The operations of process 200 can be implemented, for example, by client device 110, computing systems MPC1 and MPC2 in MPC cluster 130, and DSP 150. The operations of process 200 can also be implemented as instructions stored on one or more computer-readable media, which can be non-transitory, and whose execution by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 200. Although process 200 and other processes below are described in terms of two computing systems, MPC cluster 130, an MPC cluster with more than two computing systems can also be used to perform similar processes. In addition, the operations of process 200 can be implemented by SSP 170.

[0059] DSP 150 provides the selection values and selection criteria of the digital components to MPC cluster 130 (202). In some embodiments, DSP 150 provides the selection values and selection criteria of the digital components to MPC cluster 130 via SSP (for simplicity, Figure 2 DSP 150 may also upload additional data (e.g., metadata) for each digital component. The additional data (or selection criteria) may include one or more conditions that the digital component must meet in order to be included in the digital component selection process. For example, the additional data may include a user group identifier corresponding to the user group of the digital component and / or a campaign identifier for each of zero or more campaigns that include the digital component. For example, DSP 150 may manage campaigns in which the digital component is distributed to client devices 110 of users who are members of the user group. As described above, the metadata for the digital component may include a {ug_id, universal_campaign_id} pair.

[0060] The data for the digital component can include context selection signals indicating the context for which the digital component is eligible, such as the location of the client device 110, the spoken language selected for the application 112, uniform resource locators (URLs) of resources with which the digital component can be displayed, and / or excluded URLs of resources with which the digital component cannot be displayed. The data for the digital component can also identify the digital component, for example, using a unique identifier, a domain from which the digital component can be obtained, and / or other appropriate data for the digital component.

[0061] In some embodiments, the MPC cluster 130 caches or otherwise stores the selection values, selection criteria, and other metadata of the digital components provided to the MPC cluster 130 in response to digital component requests. In this example, the context signals for the digital components and the selection values can include the context signals included in the digital component requests. As described above, the selection values and metadata can be stored in a two-level LUT.

[0062] Client device 110 receives content (204). For example, client device 110 can receive an electronic resource (e.g., a web page) for display by a web browser or application content for display by a native application. The content can include one or more digital component slots that include computer-readable code, such as a script, that, when executed, causes client device 110 to request a digital component for each slot. Client device 110 can render the content on a display of client device 110.

[0063] The client device 110 identifies a set of user group identifiers (206). The set of user group identifiers can be user group identifiers of user groups that include the user as a member. For example, the set of user group identifiers can be user group identifiers in a user group list. The application 112 that presents the content or the trusted program can identify the set of user group identifiers, for example, by accessing the user group list from a secure storage of the client device 110.

[0064] The client device 110 generates a probabilistic data structure (208). The application 112 or trusted program can use the set of user group identifiers to generate the probabilistic data structure. In some embodiments, the probabilistic data structure is a cuckoo filter. For example, the client device 110 can use two hash functions F1 and F2 to generate a cuckoo filter having a table. Cuckoo hashing is a hashing method that uses two (or more) tables with a total of (1+\ε)N entries to store N items, such as user group identifiers, so that each entry will contain at most one item. In addition, each item, such as a user group identifier, will appear in one of the two entries defined by one of the two hash functions F1 and F2, whose output is the set [(1+\ε)N]. The item associated with key k will appear at position F1(k) in the first table or at position F2(k) in the second table. For a relatively large number N of items (e.g., N ≥ 100), it is sufficient to use \ε = 0.1, which means that N items can be hashed using cuckoo hashing, where the combined table size is 1.1 N. In these expressions, ε can be called a load factor.

[0065] To construct a sparse private information retrieval data structure using a cuckoo filter, up to N user group identifiers can be hashed into two (or more) tables using cuckoo hashing, which can have a combined size of 1.1N or another suitable size. All empty entries can be replaced with 0-bit strings. To query a user group identifier with key k, the user group identifier (if it exists in the data structure) will appear at entry F1(k) in the first table or F2(k) in the second table. Using a table size C = 1.1N will result in 1≤F1(ug_id),F2(ug_id)≤C.

[0066] The client device 110 can generate a cuckoo filter by using both hash functions F1 and F2 to calculate two possible positions of the user group identifier for each user group identifier in the user group identifier set. If at least one of the two possible positions is empty, the client device 110 can insert the element into the empty position, which can be in any table, to complete the insertion process for the user group identifier. If both positions are occupied, the client device 110 randomly selects a position and exchanges the item currently in the position with the item to be inserted. The client device 110 can then recalculate the two hash functions F1 and F2 and try to insert again. Repeat this process until, for each user group identifier in the user group identifier set, the insertion is successful or too many attempts have failed. After constructing the cuckoo filter, each user group identifier ug_id is stored in a specific index of the table.

[0067] In this example, client device 110 generates a distributed point function to transmit a list of user group identifiers to MPC cluster 130. This can ensure data security, user privacy, and reduce the size of the data transmitted. In other examples, a cuckoo filter or a secret share of a cuckoo filter can be provided to MPC cluster 130, as described below.

[0068] The client device 110 generates a distributed point function (210). The application 112 or trusted program can use the point function to generate a distributed point function, one distributed point function for each user group that includes the user as a member. The distributed point function represents a secret share of the point function. In general, the point function is a function f i :[N]→[N], where f(x)=0 when x!=i and f(i)=1. Point function f i The secret sharing is two functions g i :[N]→[N] and h i :[N]→[N], such that for all x in the set [N], f i (x) = g i (x)+h i(x). In addition, given the function h i or g i (but not both), it is not possible to recover the original function f i .

[0069] For each ug_id, a point function G is required ug_id , which can be split into distributed point functions g ug_id，1 and g ug_id，2 , so that for The following equations 1 and 2 are satisfied.

[0070] If i=F1(ug_id), then G ug_id (i) = g ug_id，1 (i)+g ug_id，2 (i) = ug_id, (1)

[0071] Otherwise G ug_id (i) = g ug_id，1 (i)+g ug_id，2 (i) = 0, (2)

[0072] Similarly, we need the point function H ug_id , which can be divided into distributed point functions h ug_id，1 and h ug_id，2 , so that for The following equations 3 and 4 are satisfied.

[0073] If i = F2(ug_id), then H ug_id (i) = h ug_id，1 (i)+h ug_id，2 (i) = ug-id (3)

[0074] Otherwise H ug_id (i) = h ug_id，1 (i)+h ug_id，2 (i)=0 (4)

[0075] That is, a distributed point function of a particular point function can be evaluated at multiple possible points (e.g., multiple possible user group identifiers), but the result is always zero except for the user group identifier ug_id of the user group that includes the user as a member and for which the distributed point function is generated. The distributed point function has a very small data size that can be transmitted over the network without using much bandwidth and with lower latency than sending other encrypted forms of the user group identifier.

[0076] For a given user group identifier ug_id, a point function F1 and a corresponding first table of cuckoo filters, the client device 110 generates a distributed point function g for the computing system MPC1. ug_id, 1 and the distributed function g for the computing system MPC2 ug_id，2 Similarly, for a given user group identifier ug_id, a point function F2 and a corresponding second table of cuckoo filters, the client device 110 generates a distributed point function h for the computing system MPC1. ug_id，1 and the distributed point function h for the computation system MPC2 ug_id，2 .

[0077] The client device 110 transmits a digital component request (212) including a distributed point function to the MPC cluster 130. The client device 110 can transmit a digital component request (212) including each distributed point function g to the computing system MPC1. ug_id，1 And each distributed point function h ug_id，1 The digital component request can include a first-level lookup key, such as SHA256(UG_Request_Key). Client device 110 can generate the first-level lookup key based on context signals of the digital component request. For example, client device 110 can generate the first-level lookup key by generating a composite message that includes context signals, such as the URL of the resource with which the selected digital component will be displayed, the location of client device 110 that submitted the digital component request, the spoken language of application 112 that will display the selected digital component, etc. Client device 110 can then apply a hash function, such as a SHA256 function, to the composite message to generate the first-level lookup key.

[0078] Similarly, the client device 110 can transmit to the computing system MPC2 a datagram including each distributed point function g ug_id，2 And each distributed point function h ug_id，2 The digital component request can also include a first-level lookup key, such as SHA256(UG_Request_Key). Since the context signal is the same, the first-level lookup key can be the same for the digital component requests sent to the two computing systems MPC1 and MPC2 in the MPC cluster 130.

[0079] The computing system MPC1 is able to create a vector of additive secret shares [M1]=[m 1，1 ,...m C，1 ], where for 1≤i≤C, m i，1 =∑ ug_id g ug_id，1 (i) Brackets are used herein to denote secret shares of a secret. Similarly, the computing system MPC2 can create a vector of additive secret shares [M2] = [m 1，2 ,...m C，2 ], where for 1≤i≤C, m i，2 =∑ug_ id g ug_id，2 (i). In this example, the secret share [m i，1 ] and [m i，2 ] is G ug_id (i), and [M1] and [M2] are two additive secret shares of M, i.e., vectors of dimension C, where M i =G ug_id (i). Shamir's secret sharing or another suitable secret sharing technique may be used to generate the secret shares. The computing systems MPC1 and MPC2 are capable of generating the secret shares for the point function h ug_id，1 (i) and h ug_id，1 (i) Generate similar vectors.

[0080] The MPC cluster 130 uses a distributed point function to perform a secure MPC process to select a digital component (214) based on a user group that includes the user of the client device 110 as a member. This can include identifying a set of digital components and their corresponding selection values that are eligible for use in the digital component selection process based on a context, such as using a first-level lookup key. This can also include identifying eligible digital components from the set of digital components that are candidates for selection based on one or more conditions for each digital component, such as based on (i) the digital component having a user group identifier that matches one of the user group identifiers of the user, and (ii) a pacing selector parameter pacing_selector having a specified value, such as a value of one. This can also include selecting a digital component from the candidate digital components based on the selection value of the digital component. All of this can be performed without the computing system MPC1 or MPC2 having access to the user group identifier in plain text. An example process for selecting a digital component using a secure MPC process is described in Figure 3 shown in and described below.

[0081] MPC cluster 130 transmits a selection process identifier and a secret share of the selection result to client device 110 (216). The selection process identifier can uniquely identify the digital component selection process for which the selection result was generated. For example, computing systems MPC1 and MPC2 can each generate a corresponding selection process identifier (SPID) for each digital component request, and computing systems MPC1 and MPC2 can perform a selection process for each digital component request to generate a selection result provided to client device 110. As described in more detail below, the selection process identifier (SPID) can be a random number.

[0082] MPC cluster 130 can also store data for selection values that are part of a selection process that is keyed by or otherwise linked to a SPID. For example, computing system MPC1 can store data for selection values and a table or other data structure based on a key for SPID1 generated by computing system MPC1 for the selection process. Similarly, computing system MPC2 can store data for selection values and a table or other data structure based on a key for SPID2 generated by computing system MPC2 for the selection process. This enables MPC cluster 130 to update active process variables based on data received from client device 110, as described in more detail below.

[0083] The selection result can be in the form of a byte array that includes information about the selected digital component. For example, the selection result can be a byte array that includes the value of the digital component in the second LUT (e.g., the selected value of the digital component and metadata for the digital component). Computing systems MPC1 and MPC2 can use a secure MPC process to determine a secret share of the selection result, as described in more detail below. Computing system MPC1 can transmit a first secret share of the selection result to client device 110, and computing system MPC2 can send a second secret share of the selection result to client device 110. In order to prevent computing systems MPC1 and MPC2 from knowing the selected digital component, computing systems MPC1 and MPC2 can be prevented from sharing their secret shares of the selection result with each other.

[0084] When using a two-table cuckoo filter, MPC cluster 130 can provide two secret shares of the selection results, one for each table. However, retrieving the selection values of two user groups from the two numerical components can lead to selection value abandonment. To mitigate this risk, MPC cluster 130 can use another secure MPC technique to return at most one selection result with the highest selection value, as described below.

[0085] Client device 110 determines a digital component corresponding to the selection result (218). For each selection result for which client device 110 receives two secret shares from computing systems MPC1 and MPC2, client device 110 can determine the selection result from the two secret shares. For example, using an additive secret share library as described in more detail below, client device 110 can add the two secret shares for the selection result together to obtain the selection result in plaintext. This enables client device 110 to access the selection value of the digital component and metadata for the digital component, such as the identity of the digital component, a location from which client device 110 can download the digital component, and the like.

[0086] The client device 110 can display the digital component (220). For example, the application 112 can display the digital component with the content received in step 204. In some embodiments, the client device 110 can display the digital component of the selection result. If two selection results are received, the client device 110 (e.g., the application 112) can select the digital component with the highest selection value and display the selected digital component.

[0087] In some embodiments, client device 110 can request digital components from MPC cluster 130 based on user group membership. Client device 110 can also request digital components based on context signals from SSP 170. These context signals can include the same context signals as described above, as well as optional additional context signals, such as the number of digital component slots for the resource, the types of digital component slots, the types and / or formats of digital components that can be displayed with the resource, etc. SSP 170 can select one or more digital components based on the context signals and the selection values of the digital components, and provide one or more of the selected digital components (or data identifying the digital components) and the selection values of the digital components to client device 110. Client device 110 can then select a digital component from a set of digital components that includes the digital components of the selection result received from MPC cluster 130 and the digital components selected by SSP 170 to display with the resource.

[0088] If the resource includes multiple digital component slots, client device 110 can request the corresponding digital component for each slot from MPC cluster 130 and from SSP 170. To reduce consumed bandwidth and latency, client device 110 can transmit the user's distributed point function for all digital component slots at once.

[0089] Client device 110 can transmit one or more event notifications (222) to MPC cluster 130. For example, assuming that a digital component of a selection result received from MPC cluster 130 is displayed by application 112 of client device 110, application 112 can transmit a presentation notification of the digital component in response to displaying the digital component. In another example, application 112 can transmit a user interaction notification in response to detecting a user interaction, such as a selection / click on a digital component.

[0090] For user interaction notifications, application 112 can generate a secret share for a click parameter, clicked. This click parameter is a Boolean parameter that can have a value of one if the user interacts with the digital component within a specified duration after the digital component is displayed, and a value of zero if the user does not interact with the digital component. Thus, in this example, any value indicates that the digital component is displayed, but a value of one can indicate that the user interacted with the digital component. Application 112 can send a first notification to computer system MPC1, including SPID1 received from computing system MPC1 and a first secret share [clicked1] for the click parameter. Similarly, application 112 can send a first notification to computer system MPC2, including SPID2 received from computing system MPC2 and a second secret share [clicked2] for the click parameter. In another example, the notification can separately indicate whether the digital component was displayed at client device 110, for example, using a secret share similar to the click parameter clicked.

[0091] MPC cluster 130 updates the process variables of the activity to which the digital component selected by MPC cluster 130 belongs (224). For example, computing system MPC1 can use SPID1 to obtain stored data for the selected process, and computing system MPC2 can use SPID2 to obtain stored data for the selected process. MPC cluster 130 can then execute a secure MPC process to update the process variables of the activity of the digital component displayed by application 112 (e.g., presentation rate, interaction rate, conversion rate, and / or resource consumption rate), as described in more detail below.

[0092] Although the steps used to generate the cuckoo filter and distributed point function are Figure 2 1 is shown as being executed after receiving the content, but the client device 110 can generate the cuckoo filter and distributed point function before receiving the content. For example, the client device 110 can generate and cache the cuckoo filter and distributed point function periodically or in response to the user's user group membership being updated.

[0093] Figure 3 is a swim lane diagram of an example process 300 for selecting digital components for distribution to client devices. The operations of process 300 can be implemented, for example, by computing systems MPC1 and MPC2 in MPC cluster 130. The operations of process 300 can also be implemented as instructions stored on one or more computer-readable media, which can be non-transitory, and whose execution by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 300.

[0094] The computing system MPC1 identifies eligible digital components and their corresponding selection values (302). The computing system MPC1 is capable of identifying eligible digital components for a digital component request received from the client device 110, for example, as described above with reference to Figure 2 For each user interface group that includes the user of the client device as a member, the digital component request can include a distributed point function g generated by the client device 110 using the hash function F1 for the user interface group identifier ug_id ug_id,1 If a two-table cuckoo filter is used, the digital component request can also include a distributed point function h generated by the client device 110 for the user interface group identifier ug_id using the hash function F2. ug_id,1 The digital component request can also include a first-level lookup key, such as SHA256(UG_Request_Key), generated based on the context signal of the digital component request.

[0095] The computing system MPC1 is capable of using the first-level lookup key of the digital component request to identify eligible digital components. The computing system MPC1 is capable of accessing the first-level LUT and using the first-level lookup key to identify rows of the second-level LUT that include information about digital components that are eligible to be displayed (e.g., have received a selection value for the digital component) for the context signal set represented by the first-level lookup key. For example, as described above, each row of the second-level LUT includes information about the digital component and a second-level lookup key based on the context signal set. Therefore, the computing system MPC1 is capable of using the first-level lookup key to identify rows of the second-level LUT that have a context signal set that matches the context signal set defined by the first-level lookup key received in the digital component request. These rows include information about digital components that are eligible to be displayed or have eligible selection values for the context defined by the first-level lookup key received in the digital component request.

[0096] The computing system MPC2 identifies eligible digital components and their corresponding selection values (304). The computing system MPC2 can identify eligible digital components for a digital component request received from the client device 110. For each user interface group that includes the user of the client device as a member, the digital component request can include a distributed point function g generated by the client device 110 using the hash function F1 for the user interface group identifier ug_id. ug_id,2 If a two-table cuckoo filter is used, the digital component request can also include a distributed point function h generated by the client device 110 for the user interface group identifier ug_id using the hash function F2. ug_id,2 The digital component request can also include a first level lookup key, such as SHA256(UG_Request_Key), generated based on the context signal of the digital component request.

[0097] The first level lookup key of the digital component request received by computing system MPC2 can be the same as the first level lookup key received by computing system MPC1. ug_id,2 can be based on the same distributed point function G as the corresponding distributed point function received by the computing system MPC1 ud_id That is, for a user group identifier ud_id of a user group including the user as a member, the client device 110 can use the hash function F1 to generate a distributed function g of the digital component request. ug_id,1 and g ug_id,2 Similarly, for a user group identifier ud_id of a user group including the user as a member, the client device 110 can use the hash function F2 to generate a distributed function h of the digital component request. ug_id,1 and h ug_id,2 .

[0098] For simplicity, the remaining steps of process 300 are described in terms of selecting a digital component for distribution to client device 110 in response to a digital component request based on a distributed point function of hash function F1. However, the same steps can be performed for a distributed point function of hash function F2. This can result in two selected digital components, and MPC cluster 130 can perform additional operations to select one of the two digital components, as described below.

[0099] Computing system MPC2 can use the first-level lookup key of the digital component request to identify an eligible select value. Computing system MPC2 can access the first-level LUT and use the first-level lookup key to identify a row of the second-level LUT that includes information about the digital component that is eligible to be displayed (e.g., has received a select value for the digital component) for the set of context signals represented by the first-level lookup key. As described above, each computing system MPC1 and MPC2 can maintain a corresponding two-level LUT that includes the same information.

[0100] For each eligible digital component, computing systems MPC1 and MPC2 determine, in response to the digital component request, whether the digital component and its selection value are candidates for selection for distribution to client device 110 (306). A candidate digital component is a qualified digital component that satisfies one or more conditions of the digital component. In this example, a candidate digital component is a qualified digital component that (i) has a user group identifier that matches the user's user group identifier, such as a user group identifier of a user group that includes the user as a member, and (ii) has a pacing selector parameter pacing_selector having a specified value (e.g., a value of one). As described above, each selection value and corresponding digital component included in a campaign can be linked to the campaign's user group identifier-universal campaign identifier pair {ug_id, universal_campaign_id}. In other examples, the user group membership condition can be replaced with another condition, such as a k-anonymity condition, a mute condition, etc.

[0101] For user group membership eligibility, if its user group identifier ug_id as part of the second-level lookup key and / or metadata associated with the numeric component of the row in the second-level LUT matches one of the user group identifiers of the user, and the pacing selector parameter pacing_selector has a specified value, such as a value of one, then the numeric component of the row is a candidate for selection. Conceptually, to determine whether the numeric component is a candidate based on the user group membership of the user representing the user group membership using a cuckoo filter of two tables, the computing system can determine whether the user group identifier ug_id of the second-level lookup key matches one of the two labels in one of the two cuckoo filter positions.

[0102] Computing systems MPC1 and MPC2 can use a secure MPC technique utilizing secret shares to identify candidate digital components, such that neither computing system MPC1 nor MPC2 knows which digital components are candidate digital components or the user group that includes the user as a member. To this end, computing system MPC1 calculates a first secret share, a user group-based candidate parameter is_dc_a_ug_candidate, for each eligible digital component. Similarly, computing system MPC2 calculates a second secret share, a user group-based candidate parameter is_dc_a_ug_candidate, for each eligible digital component. The candidate parameter is_dc_a_ug_candidate can be a Boolean value (e.g., zero or one) that indicates whether the digital component qualifies as a candidate based on a match between the digital component's user group and a user group identifier of a user group that includes the user as a member.

[0103] The first secret share of the user group-based candidate parameter is_dc_a_ug_candidate of the digital component and its selected value can be expressed as [is_dc_a_ug_candidate sv，1 ], and the second secret share of the user group-based candidate parameter is_dc_a_candidate of the selected value can be expressed as [is_dc_a_candidate sv，2 The subscript "sv" indicates that the secret share corresponds to a given selected value corresponding to a given numeric component. The first secret share of the user group based candidate parameter linked to the numeric component of the user group identifier ug_id is a Boolean The secret share is equal to ug_id==[g ug_id，1 (F1(ug_id))] The second secret share of the candidate parameter based on the user group identifier ug_id is a Boolean The secret share is equal to ug_id==[g ug_id，1 (F1(ug_id))]. The symbol "==" represents an equality test between a secret message represented as a secret share and a plaintext value or another secret message represented as a secret share, which is true (or 1) if the two values are equal and false (or 0) if the values are not equal.

[0104] The computing systems MPC1 and MPC2 are able to compute the secret share [is_dc_a_ug_candidate] of the hash function F1 using secure MPC techniques. sv，1 ] and [is_dc_a_ug_candidate sv，2 ], wherein one or more round trips are made between computing systems MPC1 and MPC2 to evaluate ug_id == [g ug_ia，1 (F1(ug_id))] and ug_id == [ug ug_id，1 That is, computing systems MPC1 and MPC2 can be based on the distributed point function g for each user group identifier received from client device 110 as part of the digital component request. ug_id，1 and g ug_id，2 , determine the secret share of each user group corresponding to the stored selected value of the digital component [is_dc_a_ug_candidate sv，1 ] and [is_dc_a_candidate sv，2 ].

[0105] Computing systems MPC1 and MPC2 can use a secret sharing technology or secret sharing library that supports the operations shown below in Table 3. One example secret sharing technology that supports these operations is Security through Private Information Aggregation (SEPIA).

[0106]

[0107] Table 3

[0108] The computing systems MPC1 and MPC2 can also be based on user group-based candidate parameters is_dc_a_ug_candidate including the activity of the digital component sv The secret share and pacing selector parameter pacing_selector sv The secret share is used to calculate the overall candidate parameter is_dc_overall_candidate for each qualified digital component sv The secret share of the digital component is_dc_overall_candidate sv Based on a user group identifier of the digital component and its corresponding user group that matches a user group of a user to which the selected digital component is to be provided, and based on a pacing parameter pacing_selector of an activity that includes the digital component sv , to limit whether the digital component and its selected value are ultimately eligible to be selected.

[0109] Conceptually, the overall candidate parameter for selecting a value is_dc_overall_candidate sv It can be calculated using the following relational expression 5.

[0110] is_dc_overall_candidate sv =is_dc_a_ug_candidate sv ×pacing_selector sv (5)

[0111] In the secret share, computing systems MPC1 and MPC2 can use round-trip remote procedure calls (RPCs) to calculate the overall candidate parameter is_dc_overall_candidate sv ]'s secret share [is_dc_overall_candidate sv，1 ] and [is_dc_overall_candidate sv，2 ]. The first secret share [is_dc_overall_candidate that can be held by the computing system MPC1 at the end of the computation sv，1] can be calculated using the following relation 6. Similarly, the second secret share [is_dc_overall_candidate] that can be held by the computing system MPC1 at the end of the computation sv，2 ] can be calculated using the following relation 7. These two relations can be calculated as part of the same MPC process using RPC by taking the four values on the right side of the relation and generating two secret shares [is_dc_overall_candidatesv, 1] and [is_dc_overall_candidatesv, 2].

[0112] [is_dc_overall_candidate sv，1 ]=[is_dc_a_ug_candidate sv，1 ]×[pacing_selector sv，1 ] (6)

[0113] [is_dc_overall_candidate sv，2 ]=[is_dc_a_ug_candidate sv，2 ]×[pacing_selector sv，2 ] (7)

[0114] These calculations convert the Boolean values true and false to the values zero and one, respectively. They also convert the Boolean AND operation into a multiplication operation, because secret sharing techniques can support integer operations but may not support Boolean operations.

[0115] Computing system MPC1 determines an order for the selection values of the digital components (308). Similarly, computing system MPC2 determines an order for the selection values of the digital components (310). The two orders should be identical because the inputs to the sorting process are the same on both computing systems MPC1 and MPC2. Each computing system MPC1 and MPC2 can determine an order for the selection values in its second-level LUT. The order can include all selection values in the second-level LUT, including candidate selection values and non-candidate selection values. The order can be from the highest selection value to the lowest selection value. In some embodiments, the selection values used for the order can be, for example, values that will be provided to the publisher of the resource to be displayed with the selected digital component after any sharing with DSP 150 and / or SSP 170. Because the selection values are in plain text, computing systems MPC1 and MPC2 do not have to perform any round-trip calculations to sort the selection values. Instead, each computing system MPC1 and MPC2 can independently sort the selection values of its second-level LUT. If the selected values are stored as secret shares at each computing system MPC1 and MPC2, where each computing system MPC1 and MPC2 has a corresponding secret share for each selected value, computing systems MPC1 and MPC2 can perform a secure MPC process using round-trip computation to sort the selected values. If there is a tie between two or more selected values, computing systems MPC1 and MPC2 can deterministically break the tie using other metadata corresponding to the digital components of the selected values.

[0116] Computing systems MPC1 and MPC2 determine a secret share of the cumulative value of each candidate digital component (312). Conceptually, the cumulative value of a given digital component represents the total number of eligible candidate digital components from the top of the sequence up to and including the selected value of the given digital component if the given digital component is a candidate. This concept is illustrated in Table 4 below.

[0117] Sorted selection values is_dc_overall_candidate Accumulated value (acc) Is the accumulated value equal to 1? Highest 0 0 0 Second highest 1 1 1 The third highest 0 1 1 fourth highest 1 2 0 … … … …

[0118] Table 4

[0119] In some embodiments, the cumulative value of a given numerical component represents the total number of candidate numerical components from the top of the order up to but not including the given numerical component. In this example, the fourth column would indicate whether the cumulative value is zero rather than one. In either case, the cumulative value of each numerical component indicates the position of the numerical component in the sorted order of candidate numerical components, which are candidates for selection based on the numerical components associated with the user group identifier that matches the user group identifier of the user.

[0120] Conceptually, in this Table 4, as one progresses from the top of the order to the bottom of the order, an accumulated value (acc) is incremented for each digital component for which the overall candidate parameter is_dc_overall_candidate is equal to one. As described below, the calculation of the accumulated value acc is performed in the secret share. For example, the accumulated value acc for the digital component with the highest selected value is zero because the overall candidate parameter is_dc_overall_candidate for the highest selected value is zero. The accumulated value acc for the second digital component is one because the overall candidate parameter is_dc_overall_candidate for the second digital component is one, and no overall candidate parameter is_dc_overall_candidate for a selected value higher than the second highest selected value is equal to one. Moving down the order, the overall candidate parameter is_dc_overall_candidate for the third highest selected value is zero, and therefore the accumulated value acc for the third digital component does not increment from the accumulated value acc for the second digital component. Since the overall candidate parameter is_dc_overall_candidate of the fourth highest selected value is one, the accumulated value acc of the fourth digital component is incremented by one from the accumulated value acc of the third highest selected value. Therefore, the accumulated value acc of the fourth digital component is equal to two because there are two digital components having the overall candidate parameter is_dc_overall_candidate from the highest selected value to the fourth highest selected value (including the highest selected value and the fourth highest selected value).

[0121] Using this table, computing systems MPC1 and MPC2 select digital components corresponding to selection values for which the overall candidate parameter is_dc_overall_candidate has a value of one and the accumulated value acc has a value of one for distribution to client device 110, as shown in the fourth column of Table 4. This represents the digital components with the highest ranked selection values corresponding to the overall candidate parameter is_dc_overall_candidate having a value of one. Since the overall candidate parameter is_dc_overall_candidate is in the secret shares of computing systems MPC1 and MPC2 to maintain user privacy and ensure that user data is not leaked, computing systems MPC1 and MPC2 determine the secret shares of the accumulated value acc for each digital component and use a round-trip calculation to determine which digital component has an accumulated value acc equal to one and an overall candidate parameter is_dc_overall_candidate equal to one.

[0122] In some embodiments depending on the secret sharing algorithm, the computing systems MPC1 and MPC2 can independently determine their secret shares of the accumulated value acc for each digital component without requiring any round trip computations. For example, for each digital component, the computing system MPC1 can determine a first share of the accumulated value acc by traversing all selected values in order from highest to lowest and summing the overall candidate parameters is_dc_overall_candidate of the selected values along the way [acc_overall_candidate]. ug_id,1 ], as described above with reference to Table 4. Similarly, for each digital component, the computing system MPC2 can determine a second share of the accumulated value acc by traversing all the selection values in order from highest to lowest and summing the overall candidate parameter is_dc_overall_candidate of the selection values along the way [acc ug_id,2 ].

[0123] The computing systems MPC1 and MPC2 determine, for each digital component, a secret share indicating whether the accumulated value has a specified value (314). The specified value can be a value of one, as shown in columns 3 and 4 of Table 4. As described above, a digital component whose accumulated value is one and whose overall candidate parameter is_dc_overall_candidate is one is the highest selected value among the selected values of the candidate digital components.

[0124] The computation systems MPC1 and MPC2 are capable of participating in multiple rounds of computation, e.g., multiple RPCs, as part of a secure MPC process to compute an equality operation acc based on the secret shares of each digital component. sv == 1. At the end of this process, for each digital component, the computing system MPC1 has the result acc sv = = 1, and for each digital component, the computing system MPC2 has the result acc sv === another secret share of 1.

[0125] The computing systems MPC1 and MPC2 determine the winner parameter is_dc_the_winner for each digital component sv The computing systems MPC1 and MPC2 are able to calculate the secret share of each digital component based on the accumulated value acc sv ==1 secret share and the overall candidate parameter is_dc_overall_candidate for each digital component sv The secret share to determine the winner parameter is_dc_the_winner sv The winner parameter for each digital component is_dc_the_winner svCan be a Boolean value that indicates whether the digital component is a winner of a selection process, eg, whether the digital component was selected for distribution to the client device 110 in response to the digital component request.

[0126] In some embodiments, computing systems MPC1 and MPC2 are capable of executing a secret share multiplication protocol to compute a winner parameter is_dc_the_winner in terms of secret shares for each selected value. sv ==(is_dc_a_candidate sv ×(acc sv = = 1)). This requires one RPC between computing systems MPC1 and MPC2 to multiply the two secret shares. At the end of this MPC process, computing system MPC1 has the result is_dc_the_winner sv A secret share of which is denoted as [is_dc_the_winner sv,1 ]=[is_dc_overall_candidate sv,1 ]x([acc sv,1 ]==1). Similarly, computing system MPC2 has the result is_dc_the_winner sv Another secret share, which is denoted as [is_dc_the_winner sv,2 ]=[is_dc_overall_candidate sv,2 ]x([acc sv,2 ] == 1). Note that for all numeric components, at most one numeric component has a winner parameter is_dc_the_winner equal to one sv , which is the digital component selected for distribution to the client device 110. All others are equal to zero.

[0127] The computing system MPC1 generates a selection process identifier SPID1 (318). The selection process identifier SPID1 uniquely identifies the current selection process for selecting a digital component in response to the received digital component request. The selection process identifier SPID1 can be a random number.

[0128] The computing system MPC2 generates a selection process identifier SPID2 (320). The selection process identifier SPID2 uniquely identifies the current selection process for selecting a digital component in response to the received digital component request. The selection process identifier SPID2 can be a random number.

[0129] The computing system MPC1 stores the first secret shares of the winning parameters keyed by the selection process identifier SPID1 (322). For example, the computing system MPC1 can store the first secret shares of the winning parameters in a table or other data structure using a key or other reference to the selection process identifier SPID1. The computing system MPC1 can also store, for each first secret share of the winning parameter, a reference to the numerical component and the corresponding selection value corresponding to the first secret share of the winning parameter.

[0130] Computing system MPC2 stores the second secret shares of the winning parameters keyed by selection process identifier SPID2 (324). For example, computing system MPC2 can store the second secret shares of the winning parameters in a table or other data structure using a key or other reference to selection process identifier SPID2. Computing system MPC2 can also store, for each second secret share of the winning parameter, a reference to the numerical component and the corresponding selection value corresponding to the second secret share of the winning parameter. Computing systems MPC1 and MPC2 can use selection process identifiers SPID1 and SPID2 and the secret shares of the winning parameters and update the measured process variables, such as references Figure 4 Described in more detail.

[0131] In some embodiments, computing systems MPC1 and MPC2 encrypt the secret share of the winning parameter using a secret key that is kept secret from MPC1 and MPC2, respectively. Computing systems MPC1 and MPC2 can then store the encrypted result in a response returned to application 112. Application 112 sends the encrypted result back to MPC cluster 130 in a show notification. This alternative embodiment should ensure that the encrypted secret share of the winning parameter is small enough to avoid wasting significant bandwidth.

[0132] The computing systems MPC1 and MPC2 calculate the selection result (326). The computing systems MPC1 and MPC2 can calculate the selection result based on the winner parameter of the selection value and the digital component information element dc_information_element of the selection value or the selection value itself. As described above, the digital component information element dc_information_element of the digital component can include the selection value of the digital component and other data of the digital component.

[0133] Conceptually, the computing systems MPC1 and MPC2 can use the following relation 8 to calculate the selection result result F1 .

[0134]

[0135] That is, computing systems MPC1 and MPC2 are able to determine the winner parameter isdc_the_winner across all digital componentssv and digital component information element dc_information_element sv In this example, if the user has a user group identifier that matches the user's user group identifier or has a value equal to is_dc_the_winner sv If the value of the digital component of the digital component information element dc_information_element of the selected digital component equal to one does not have a cached selected value, then the result is selected. F1 Will have a value of zero. In another example, the digital component information element dc_information_element can be replaced with a selected value of the digital component in relational equation 8. In this example, if the user has a user group identifier that matches the user group identifier of the user or will have a value equal to is_dc_the_winner sv If the numeric component of the selected value is equal to one and there is no cached selected value, then the selected result is result. F1 will have the value zero.

[0136] To perform a computation in a secret share, the computing system MPC1 retrieves all cached selection values and sets the digital component information element dc_information_element of the selection value to sv Multiply the first secret share by the winner parameter [is_dc_the_winner sv，1 ], the selected value can be in plain text. The computing system MPC1 can then determine the sum of these products and return the sum to the client device 110 that submitted the digital component request. That is, the computing system MPC1 can use the following relationship 9 to determine the sum as the resulting first share

[0137]

[0138] Computing system MPC2 can perform a similar calculation to determine a second share of the result using the following relation 10:

[0139]

[0140] The computing system MPC1 sends the first share of the selection result to the client device 110 and the selection process identifier SPID1 (328). Similarly, computing system MPC2 sends a second share of the selection result to client device 110 and select process identifier SPID2 (330). The application 112 can then use the two secret shares and For example, when an additive secret sharing algorithm is used, the sum of the secret shares can be determined to reconstruct the selection result in plain text. F1 If you select result F1 With a value of zero, the MPC cluster 130 has not identified a digital component of a user group that includes the user as a member. Otherwise, the result is selected. F1 With a value equal to the digital component information element dc_information_element, the application 112 can parse the digital component information element dc_information_element to obtain the selection value and metadata of the digital component. As described above, the application 112 can then display the digital component or perform a selection process using the digital component and other digital components received from the SSP 170.

[0141] In a two-table cuckoo filter implementation, application 112 can receive two selection results, one for each hash function F1 and F2. In this example, application 112 can select digital components from a set of digital components that includes both these digital components and any digital components received from SSP 170.

[0142] In some embodiments, application 112 can perform a final verification that the user group of the digital component selected by MPC cluster 130 matches the user group of which the user is a member. For example, the digital component information element dc_information_element of each digital component can include a user group identifier for the digital component. Application 112 can compare the user group identifier of the digital component information element dc_information_element with the user's user group list. If there is no match, application 112 can exclude the digital component from the selection process. If there is a match, application 112 can include the digital component in the selection process.

[0143] As described above, receiving two selection results from the MPC cluster 130 can facilitate selection value discarding. To reduce this risk, the MPC cluster 130 can execute a process that returns only one selection result.

[0144] In a cuckoo filter implementation for a table, each user group identifier ug_id can appear in two places, whose indices are F1(ug_id) and F2(ug_id). Let M denote a cuckoo filter for a table, and M i Represents the value of the i-th element in the table. If or The candidate parameter is_dc_a_ug_candidate with the numeric component of the user group identifier ug_id sv The MPC cluster 130 can use the following equations 11 or 12 to calculate the candidate parameter is_dc_a_candidate of the digital component. sv .

[0145]

[0146]

[0147] Relation 11 can include two equality tests that can be performed in parallel. Relation 12 can require one equality test and one multiplication. When using a secure MPC process to perform these operations on secret shares, the multiplication requires fewer computations and one round trip, but in a probabilistic solution, the equality test can require more computation and four round trips. Therefore, Relation 11 can require one fewer round trip than Relation 12, but requires more computation.

[0148] The computing system MPC1 can calculate the candidate parameter is_dc_a_candidate of the digital component on the secret share using the following relation 13 based on relation 11: sv The first secret share.

[0149] [is_dc_a_candidate sv，1 ]=(ug_id==[g ug_id，1 (F1(ug_id))])+(ug_id==[ug ug_id，1 (F2(ug_id))]) (13)

[0150] Similarly, the computing system MPC2 can calculate the candidate parameter is_dc_a_candidate of the digital component on the secret share based on the relation 12 using the following relation 14: sv The second secret share.

[0151] [is_dc_a_candidate sv，2 ]=(ug_id==[g ug_id，2 (F1(ug_id))])+(ug_id==[ug ug_id，2 (F2(ug_id))]) (14)

[0152] Alternatively, the computing system MPC1 can calculate the candidate parameter is_dc_a_candidate of the digital component on the secret share using the following relation 15 based on relation 12: sv The first secret share.

[0153] [is_dc_a_candidate sv，1 ]=(ug_id-[g ug_id，1 (F1(ug_id))])×(ug_id-[g ug_id，1 (F2(ug_id))])==0 (15)

[0154] The computing system MPC2 can calculate the candidate parameter is_dc_a_candidate of the digital component on the secret share using the following relation 16 based on relation 13: sv The second secret share.

[0155] [is_dc_a_candidate sv，2 ]=(ug_id-[g ug_ia，2 (F1(ug_id))])×(ug_id-[g ug_id，2 (F2(ug_id))])==0 (16)

[0156] The MPC cluster 130 can then use Figure 3 The secret share of the selection result result is calculated by a similar process to process 300. In particular, the computing systems MPC1 and MPC2 can calculate the secret share of the accumulation value acc for each digital component based on the order of the digital components and the candidate parameters of the digital components [acc sv，1 ] and [acc sv，2 ].

[0157] The computing systems MPC1 and MPC2 are capable of computing the secret share of the winner parameter is_dc_the_winner for each digital component based on the overall candidate parameters of the digital component and whether the accumulated value of the digital component is equal to one (or zero, depending on the implementation). sv，1 ] and [is_dc_the_winner sv，2 ].

[0158] The computing systems MPC1 and MPC2 can calculate the secret shares [result1] and [result2] of the selection result result using the following relations 17 and 18.

[0159] [result1]=∑ sv ([is_dc_the_winner sv，1 ]×dc_information_element sv )(17)

[0160] [result2]=∑sv ([is_dc_the_winner sv，2 ]×dc_information_element sv )(18)

[0161] Computing system MPC1 can return a first share of the selection result [result1] to application 112, and computing system MPC2 can return a second share of the selection result [result2] to application 112. Application 112 can then use the two secret shares to reconstruct the selection result result as described above.

[0162] The above description relates multiplication between secret shares of secret integers with values of 0 or 1 to the computer logic AND. It also relates 1 minus the secret share of a secret integer with values of 0 or 1 to the computer logic NOT. In some embodiments, alternative solutions can be employed to evaluate logical expressions involving secret shares. For example, to compute the logical AND of several additive secret shares of secret integers with values of 0 or 1, the MPC server can compare the sum of those additive secret shares with the number of secret shares. As another example, to compute any logical expression with secret shares as input, the MPC server can employ a truth table approach. Specifically, computing system MPC1 can construct a truth table containing one row for each possible combination of input secret shares held by MPC2. Computing system MPC1 randomly selects a result secret share, denoted as [result1]. For each row, computing system MPC1 can combine its input secret shares with the inferred input secret shares held by MPC2 to reconstruct the inputs of the logical expression in plaintext form, and then evaluate the result of the logical expression. For each row, computing system MPC1 splits the result into two secret shares, one of which is [result1] and the other is [result2]. Computing system MPC1 then writes [result2] to the row in the truth table. After computing system MPC1 completes building the truth table, computing system MPC2 can initiate the oblivious transfer extension (OTe) to extract the row in the truth table corresponding to the input secret share held by MPC2. The extracted result is [result2]. At the end of the above process, computing systems MPC1 and MPC2 hold [result1] and [result2], respectively, which are the secret shares of the result of the logical expression. Computing system MPC1 does not know the value of [result2], and computing system MPC2 does not know the value of [result1]. In some embodiments, computing systems MPC1 and MPC2 can evaluate the logical expression by constructing a garbled circuit to determine is_dc_a_candidate sv,1 and is_dc_a_candidatesv,2 .

[0163] Figure 4 is a swim lane diagram illustrating an example process 400 for determining a secret share for a pacing selector parameter using a feedback controller. The operations of process 400 can be implemented, for example, by computing systems MPC1 and MPC2 in MPC cluster 130. The operations of process 400 can also be implemented as instructions stored on one or more computer-readable media, which can be non-transitory, and whose execution by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 400. In this example, the feedback controller is a PID controller.

[0164] Generally speaking, a PID controller is a feedback controller that uses an error value, which is the difference between the target set point and the measured variable, to determine the output that drives the measured variable toward a set point. In the context of pacing the delivery of digital components to client devices, the set point for an activity can be the presentation rate, interaction rate, conversion rate, and / or resource consumption rate (e.g., the rate at which a budget is spent). Similarly, the measured variable can be the presentation rate, interaction rate, conversion rate, and / or resource consumption rate of the activity over a given time period. The given time period can be from the start time of the activity until the current time.

[0165] A PID controller uses tuning parameters to determine how to adjust the output based on a process variable measured over time. These tuning parameters include the proportional term, the integral term, and the derivative term, represented by P, I, and D, respectively. The proportional parameter, the integral parameter, and the derivative parameter can be displayed as K, respectively. p , K i and K d .

[0166] A PID controller can be implemented using a repeating loop where the following parameters are calculated for each time change dt:

[0167] Error = set point - measured variable (19)

[0168] Integral = Integral + Error × dt (20)

[0169]

[0170] Output = (K p × error)+(K i × integral)+(K d × differential) (22)

[0171] Previous Error = Error(23)

[0172] To protect user privacy and prevent access to user group membership information, the MPC cluster 130 can implement a PID controller for each activity using a secure MPC process and secret sharing.

[0173] The computing system MPC1 receives the tuning parameters of the PID controller for controlling the pacing of the digital components of the activity (402). Similarly, the computing system MPC2 receives the tuning parameters of the PID controller (404). The owner of the activity, such as the DSP of the digital component provider, can provide the tuning parameters K to the computing systems MPC1 and MPC2. p , K i and K d In another example, for example, if no customized tuning parameters are provided, MPC cluster 130 can use default tuning parameters. If the tuning parameters are sensitive such that they should not be disclosed to computing systems MPC1 and MPC2 or the entity that maintains computing systems MPC1 and MPC2, the owner can send a corresponding secret share for each tuning parameter to each computing system MPC1 and MPC2.

[0174] Computing system MPC1 receives setpoint data for the activity (406). Similarly, computing system MPC2 receives setpoint data for the activity (408). The setpoint data can include: a setpoint parameter setpoint, which can be a display rate, for example, SP impression =r impression (t),Interaction rate, e.g., SP interaction =r interaction (t), or the resource consumption rate, e.g., SP resource =r resource (t), and a time unit, e.g., N seconds. For example, a display rate set point can be 10 (or another number) displays of the digital component of the campaign per day (or other time period). As described above, each campaign can have a universal campaign identifier, campaign_uuid.

[0175] In some embodiments, the setpoint data for the campaign can include a total amount of digital component distribution resources, a target number of impressions of the campaign's digital components, and / or a target number of user interactions with the digital components of the campaign. The setpoint data can also include a specified time range for the campaign. In this example, the MPC cluster 130 can determine a setpoint rate (e.g., an impression rate).

[0176] In some embodiments, to prevent malicious parties from disrupting an activity, the owner of the activity can modify the set point data and / or tuning parameters K p , K i and K dIn this example, computing systems MPC1 and MPC2 can verify the digital signature before using the setpoint data and / or tuning parameters of the PID controller.

[0177] For simplicity, the remainder of process 400 is described in terms of display rate setpoints and measured variables. Thus, the setpoint parameter setpoint can be SP resource =r resource (t). A similar process can be used for interaction rate and resource consumption rate by replacing the set point and measurement variable.

[0178] The computing systems MPC1 and MPC2 initialize the PID controllers for the activity (410). To initialize the PID controllers, the computing system MPC1 can pass the first secret share of the previous error parameter of the activity [previous_error campaign,impression,1 ] is initialized to zero

[01] . The computing system MPC1 is also capable of setting the first secret share of the integral parameter of the activity [integral campaign,impression,1 ]Initialized to zero

[01] .

[0179] Similarly, the computing system MPC2 can convert the first secret share of the previous error parameter of the activity [previous_error campaign,impression,2 ] is initialized to zero

[02] . The computing system MPC2 is also capable of setting the first secret share of the integral parameter of the activity [integral campaign,impression,2 ]Initialized to zero

[02] .

[0180] Computing system MPC1 updates the measured process variables (412). Similarly, computing system MPC2 updates the measured process variables (414). Since the process for updating process variables can be different for different process variables, update processes are provided for presentation rate, interaction rate, and resource consumption rate. The process variables for presentation, user interaction, and resource consumption can be denoted as pv universal_campaign_id,impression 、pv universal_campaign_id,interaction and pv universal_ampaign_id,resource .

[0181] As mentioned above Figure 2As described above, after a digital component has been displayed on client device 110, client device 110 can provide a notification to MPC cluster 130. For the digital component, computing system MPC1 can receive a notification that includes a first secret share [clicked1] of a click parameter indicating whether a user interacted with the digital component, and a selection process identifier SPID1 of a selection process for selecting the digital component, received from computing system MPC1. Similarly, computing system MPC2 can receive a notification that includes a second secret share [clicked2] of a click parameter indicating whether a user interacted with the digital component, and a selection process identifier SPID2 of a selection process for selecting the digital component, received from computing system MPC2. Computing systems MPC1 and MPC2 can update active process variables each time a notification is received.

[0182] Computing systems MPC1 and MPC2 can use their respective selection process identifiers to obtain the stored secret shares of the winning parameters for a given selection process.If the process identifier of a notification does not match the process identifier of any secret share of the winning parameters, the notification can be considered fraudulent.

[0183] If the process variable is the resource consumption rate, the computing system MPC1 can assign to each activity a first secret share [pv campaign_uuid，resource，1 ]Incremental∑ sv [is_dc_the_winner sv，1 ]×[pre_shared_sv_amount sv，1 ], where the numeric component corresponding to the selection value sv is associated with the universal campaign identifier universal_campaign_identifier. In this relationship, before any sharing between the publisher, SSP and DSP, the parameter [pre_shared_sv_amount sv，1 ] is the first secret share of the selected value, for example, it is the amount that the digital component provider will provide for this display of the digital component. Splitting the selected value into secret shares protects the commercial confidentiality of the digital component provider and the DSP.

[0184] Similarly, the computing system MPC2 can assign to each activity a second secret share of its resource consumption process variable [pvuniversal _campaign_id，resource，2 ]Incremental∑ sv [is_dc_the_winner sv，2 ]×[pre_shared_sv_amount sv，2], where the numeric component corresponding to the selection value sv is associated with the universal campaign identifier universal_campaign_id. In this relationship, before any sharing between the publisher, SSP and DSP, the parameter [pre_shared_sv_amount sv，2 ] is a second secret share of a selected value, for example, it is the amount that the digital component provider will provide for such display of the digital component.

[0185] Using this process, computing systems MPC1 and MPC2 will increase the amount of resources expended for the activities of the winning digital component by the amount that the digital component provider will provide for the display of its digital component. Since the winner parameter of the non-winning selection value will be zero, the amount of resources expended for those activities will not be incremented.

[0186] If the process variable is the presentation rate, the computing system MPC1 can assign to each activity its first secret share of the presentation rate process variable [pv universal_campaign_id，impression，1 Update sv [is_dc_the_winner sv，1 ], wherein the numerical component corresponding to the selection value sv is associated with the universal campaign identifier universal_campaign_id. In this way, the computing system MPC1 increments the number of impressions of the campaign of the winning selection value by one.

[0187] Similarly, the computing system MPC2 can assign to each activity its first secret share of the presentation rate process variable [pv universal_campaign_id，impression，2 Update sv [is_dc_the_winner sv，2 ], wherein the numeric component corresponding to the selection value sv is associated with the universal campaign identifier universal_campaign_id. In this way, the computing system MPC2 increments the number of impressions of the campaign of the winning selection value by one.

[0188] If the process variable is the interaction rate, the computing system MPC1 can assign to each activity a first secret share [pv universal_campaign_uuid，interaction，1 ], update ∑ sv [is_dc_the_winner sv，1 ]×[clicked1], where the digital component corresponding to the selection value sv is associated with the universal campaign identifier universal_campaign_id. In this way, if the click parameter indicates that the digital component received a user interaction, the computing system MPC1 increments the number of interactions of the campaign winning the selection value by one.

[0189] Similarly, the computing system MPC2 can assign to each activity a second secret share of its interaction rate process variable [pv universal_campaign_id，interaction，2 Update sv [is_dc_the_winner sv，2 ]×[clicked2], where the digital component corresponding to the selection value sv is associated with the universal campaign identifier universal_campaign_id. In this way, if the click parameter indicates that the digital component received a user interaction, the computing system MPC1 increments the number of interactions of the campaign that won the selection value by 1.

[0190] Each update to the process variable requires a multiplication between the secret shares. The multiplication can be performed by the computing systems MPC1 and MPC2 using a secure MPC process, with one RPC between the two computing systems MPC1 and MPC2.

[0191] Computer systems MPC1 and MPC2 determine secret shares of active controller parameters (416). Computer systems MPC1 and MPC2 can use a secure MPC process to determine the controller parameters. The controller parameters can include an error (error), an integral parameter (integral), a derivative parameter (derivative), a temporary parameter (tmp), an output (output), and a previous error parameter (previous_error). Computer system MPC1 can use the MPC process to calculate first secret shares for these parameters using the following relationships 24 to 29.

[0192] [error1]=setpoint-[pv universal_campaign_id，impression，1 ] (twenty four)

[0193] [integral universal_campaign_id，impression，1 ]=[integral universal_campaign_id,impression，1 ]+[error1] (25)

[0194] [derivative1]=error1]-[previous_error universal_campaign_id，1 ] (26)

[0195] [tmp1]=(K p ×[error1])+(K i ×[integral universal_campaign_id，impression，1 ])+(K d ×[derivative1]) (27)

[0196] [output universal_campaign_id，impression，1 ]=[tmp1] (28)

[0197] [previous_error universal_campaign_id，1 ]=[error1] (29)

[0198] Similarly, computing system MPC2 can use an MPC process to calculate a first secret share for these parameters using relations 30 to 35 below.

[0199] [error2]=setpoint-[pv univerrsal_campaign_id，impression，2 ] (30)

[0200] [integral universal_campaign_id，impression，2 ]=[integral universal_campaign_id，impression，2 ]+[error2] (31)

[0201] [derivative2]=error2]-[previous_error universal_campaign_id，2 ] (32)

[0202] [tmp2]=(K p ×[error2])+(K i ×[integral universal_campaign_id，impression，2 ])+(K d ×[derivative2]) (33)

[0203] [output universal_campaign_id，impression，2 ]=[tmp2] (34)

[0204] [previous_error universal_campaign_id，2 ]=[error2] (35)

[0205] The output parameter represents a probability based on the difference between the set point and the measured variable. The probability can be used to determine whether the activity meets the pacing eligibility condition for the activity. For example, for a next digital component distribution process where the digital component of the activity is otherwise qualified, the probability can be the probability that the digital component will be included in the selection process. If the pacing eligibility condition is met, then the digital component in the activity also meets the pacing eligibility condition and will be eligible for the digital component selection process, for example, if all other conditions for the digital component are met. For example, if the digital component of the activity is displayed at a higher rate than the set point, the output will have a lower value, indicating a lower probability that the digital component will be selected for inclusion in the subsequent selection process, even though the digital component may otherwise be qualified. This lower probability drives the measured display rate downward toward the set point.

[0206] Computing systems MPC1 and MPC2 can repeatedly calculate active controller parameters, for example, periodically based on a specified time period. In another example, computing systems MPC1 and MPC2 can update active controller parameters each time a measured variable is updated based on a received notification. By updating controller parameters proactively rather than in response to a digital component request, latency in using controller outputs during the digital component selection process can be significantly reduced.

[0207] In some cases, the tuning parameters of the active controllers can be sensitive information. In such an example, the owner of the activity can provide a corresponding secret share of each tuning parameter to each computing system MPC1 and MPC2. For example, the owner can provide the computing system MPC1 with a first secret share [K] for the proportional, integral, and derivative parameters, respectively. p，1 ]、[K i，1 ] and [K d，1 ]. Similarly, the owner can provide the computing system MPC2 with the second secret shares of the proportional, integral and derivative parameters [K p，1 ]、[K i，2 ] and [K d，2 ].

[0208] When calculating temporary parameters, the computing systems MPC1 and MPC2 can use relations 36 and 37 instead of relations 27 and 33 .

[0209] [tmp1]=([K p，1 ]×[error1])+([K i，1 ]×[integral campaign_uuid，impression，1 ])+([K d，1 ]×[derivative1]) (36)

[0210] [tmp2]=([K p，2 ]×[error2])+([K i，2 ]×[integral campaign_uuid，impression，2 ])+([K d，2 ]×[derivative2]) (37)

[0211] The computing systems MPC1 and MPC2 determine the secret shares of the active pacing selector parameters (418). The computing systems MPC1 and MPC2 can collaboratively generate in plain text the secret shares of the active pacing selector parameters in [output min , output max ] is a uniformly distributed random number R within the range of ]. For example, the computing systems MPC1 and MPC2 can use the Diffie-Hellman key exchange (DHKE) technology to determine the random number.

[0212] Computing systems MPC1 and MPC2 can use the secret share of the output of the PID controller and the secret share of the random number to calculate the secret share of the pacing selector parameter using a secure MPC process. The use of the random number enables computing systems MPC1 and MPC2 to set the Boolean value of the pacing selector parameter using the probability represented by the output. Computing system MPC1 can calculate the first secret share of the pacing selector parameter pacing_selector using the following relation 38.

[0213] [pacing_selector campaign_uuid，1 ]=([output campaign_uuid，1 ]>R)×([pv campaign_uuid，resource，1 ]<total_resources campaign_uuid，1 ]) (38)

[0214] Similarly, computing system MPC2 can calculate the first secret share of the pacing selector parameter pacing_selector using the following relation 39.

[0215] [pacing_selector campaign_uuid，2 ]=([output campaign_uuid，2 ]>R)×([pv campaign_uuid，resource，2 ]<total_resources campaign_uuid，2 ]) (39)

[0216] In equations 38 and 39, the comparison with the total amount of resources of the activity ensures that the activity has remaining resources, such as a budget, for distributing digital components. The secret share of the activity's pacing selector can be used for each digital component in the activity in process 200. For example, for each digital component in the activity, the secret share [pacing_selector campiang_uuid，1 ] and [pacing_selector campiang_uuid，2 ] can replace [pacing_selector in equations 6 and 7 sv，1 ] and [pacing_selector sv，2 ].

[0217] Figure 5is a flow chart illustrating an example process 500 for selecting digital components for distribution to client devices. The operations of process 500 can be implemented, for example, by computing system MPC1 or computing system MPC2 in MPC cluster 130. The operations of process 500 can also be implemented as instructions stored on one or more computer-readable media, which can be non-transitory, and whose execution by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 500. For simplicity, process 500 is described as being performed by computing system MPC1.

[0218] Computing system MPC1 collaborates with one or more second computing systems (e.g., computing system MPC2) in the MPC system to initialize a feedback controller for each of one or more activities in a secret share using a secure MPC process (502). The feedback controller can be a PID controller with a set point based on a target rate for a given activity. For example, the set point can be a presentation rate, an interaction rate, or a resource consumption rate. Computing systems MPC1 and MPC2 can use the secure MPC process to initialize the secret shares of the controller's parameters, as described above with reference to Figure 4 As stated.

[0219] The computing system MPC1 updates the first secret share of the output of each feedback controller based on an error parameter of the feedback controller. The error parameter can represent the difference between the set point and the measured rate of a given activity (504). The output represents a probability that can be used to determine whether the activity meets the pacing eligibility condition of the activity. The computing systems MPC1 and MPC2 can update the output of the controller based on the updated measured process variables and the set point, as described above with reference to Figure 4 As stated.

[0220] The computing system MPC1 determines, based on the output first secret share, a first secret share of a given pacing selector parameter that defines whether the activity satisfies the pacing eligibility condition of the activity (506). Figure 4 As described, computing systems MPC1 and MPC2 can collaboratively generate a random number for each digital component request and compare the random number with the output to determine the pacing selector parameter.

[0221] The computing system MPC1 receives a digital component request from the client device 110 (508). The digital component request can include a secret share of a cuckoo filter or data that identifies one or more first user groups that include the user of the client device 110 as a member. For example, the digital component request can include one or more distributed point functions. Each distributed point function can represent a secret share of a point function that indicates whether the user of the client device is a member of a corresponding first user group identified by a corresponding first user group identifier. For example, the digital component request received by the computing system MPC1 can include a distributed point function g for each user group that includes the user of the client device 110 as a member. ug_id,1 .

[0222] The computing system cooperates with computing system MPC2 to perform a given digital component selection process (510) for a digital component request. For example, computing systems MPC1 and MPC2 can perform Figure 3 The process 300 is to generate a selection result identifying the selected digital component.

[0223] Computing system MPC1 provides a first secret share identifying a selection result of a given digital component to client device 110 (512). As described above, the selection result can identify the selected digital component and the selected value of the digital component. Client device 110 can also receive a corresponding secret share for the selection result from each of one or more additional MPC systems (e.g., computing system MPC2). As described above, client device 110 can use the secret share to reconstruct the selection result.

[0224] In some embodiments, rather than using a distributed point function, the cuckoo filter itself can be sent to the MPC cluster 130. In this example, the application 112 can use a pseudorandom function (PRF) parameterized by a user group identifier or a set of blocked identifiers and one of two random variables generated by the application 112. For example, assume that the three random variables generated by the application 112 are rand_var1a, rand_var1b, and rand_var2. Also assume that each entry in the bucket is a k-bit integer. In some embodiments, the application 112 and the MPC cluster 130 agree in advance on the PRF, where k is the number of bits per entry in the cuckoo filter's bucket. Each entry in the cuckoo filter's bucket can be occupied by a user group identifier or a blocked identifier, or be empty. For example, the application 112 can generate a cuckoo filter table whose entries are PRF(ug_id, rand_var1a), PRF(blocked_id, rand_var1b), or 0, where ug_id is an identifier of a user group generated by applying HMAC to a tag of the user group (e.g., a user group identifier) based on the domain of the content provider, and 0 represents an empty entry. This process is repeated for all user group identifiers and blocked identifiers.

[0225] The application 112 can generate a vector B based on a cuckoo filter table generated for the user group identifier and the blocked identifier. Each value B in the vector B i Can be represented as B i =(A i _PRF(rand_var2, i)) mod p, where A is the cuckoo filter table, and i is the vector B and the index of the cuckoo filter table A. When the application 112 initiates a request for a digital component of a digital component slot, the application transmits rand_var1a, rand_var1b, and rand_var2 as parameters of the request to the computing system MPC1. The application 112 also transmits vector B, rand_var1a, and rand_var1b as parameters of the request to the computing system MPC2. PRF(rand_var2, i) and B i It's Z p A in i The two additive secret shares are held by computing systems MPC1 and MPC2 respectively. Since neither computing system MPC1 nor MPC2 can access these two secret shares, neither computing system can reproduce the cuckoo filter table, thus protecting user privacy.

[0226] The computing system MPC1 determines whether each candidate selection value is associated with the user group specified in the request. The computing system MPC1 receives the equivalent of an array of secret shares of the cuckoo filter table M, denoted by [M1]. Each user group identifier present in M will be in one of N possible positions.

[0227] The computing system MPC1 calculates the candidate parameter [is_dc_a_candidate] based on the user group according to the following relation 40: x，1 ]:

[0228]

[0229] Where Π represents the multiplication of multiple terms. Here, ug_id(x) is a function for retrieving the user group identifier ug_id associated with the selected value x, {F1, ...F N} is a set of hash functions used to compute possible indices of entries within the cuckoo filter table A, and rand_valla is the random value received in the numeric component request. [M x，1 ] is the xth element in the array [M1]. == is the equality test between the plaintext integer and the secret share of the secret integer. The result of == is the secret share of the secret integer that is 0 (not equal) or 1 (equal). Here, [M i，1 ] value = [PRF(rand_val2a,i)1].

[0230] Similarly, the computing system MPC2 calculates the candidate parameter [is_dc_a_candidate] based on the user group according to the following relation 41. x，2 ]:

[0231]

[0232]

[0233] Here, [M i,2 ] = B i .

[0234] Figure 6 6 is a block diagram of an example computer system 600 that can be used to perform the operations described above. System 600 includes a processor 610, a memory 620, a storage device 630, and an input / output device 640. Each of components 610, 620, 630, and 640 can be interconnected, for example, using a system bus 650. Processor 610 can process instructions for execution within system 600. In some embodiments, processor 610 is a single-threaded processor. In another embodiment, processor 610 is a multi-threaded processor. Processor 610 can process instructions stored in memory 620 or on storage device 630.

[0235] Memory 620 stores information within system 600. In one embodiment, memory 620 is a computer-readable medium. In some embodiments, memory 620 is a volatile memory unit. In another embodiment, memory 620 is a non-volatile memory unit.

[0236] The storage device 630 can provide mass storage for the system 600. In some embodiments, the storage device 630 is a computer-readable medium. In various embodiments, the storage device 630 can include, for example, a hard disk device, an optical disk device, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other mass storage device.

[0237] Input / output device 640 provides input / output operation for system 600.In some embodiments, input / output device 640 can comprise one or more of the following: network interface device, such as Ethernet card; Serial communication device, such as RS-232 port; And / or wireless interface device, such as 802.11 card.In another embodiment, input / output device can comprise a drive device configured to receive input data and send output data to external device 660 (such as, keyboard, printer and display device).However, other embodiments can also be used, such as mobile computing device, mobile communication device, set-top box television client device etc.

[0238] Although already Figure 6 An example processing system is described in the specification, but the subject matter and implementation of the functional operations described in this specification can be implemented in other types of digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in a combination of one or more of them.

[0239] The subject matter and embodiments of the operations described in this specification can be implemented in digital electronic circuits, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in a combination of one or more thereof. The embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions, which are encoded on a computer storage medium (or media) for execution by a data processing device or for controlling the operation of the data processing device. Alternatively or in addition, the program instructions can be encoded on an artificially generated propagated signal, such as a machine-generated electrical, optical, or electromagnetic signal, which is generated to encode information for transmission to a suitable receiver device for execution by the data processing device. The computer storage medium can be a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more thereof or be included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more thereof. In addition, although a computer storage medium is not a propagated signal, a computer storage medium can be a source or destination of computer program instructions encoded in an artificially generated propagated signal. The computer storage medium can also be, or be included in, one or more separate physical components or media (eg, multiple CDs, disks, or other storage devices).

[0240] The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0241] The term "data processing apparatus" encompasses all types of apparatus, devices, and machines for processing data, including, for example, a programmable processor, a computer, a system on a chip, or a plurality or combination of the foregoing. The apparatus can include dedicated logic circuitry, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). In addition to hardware, the apparatus can also include code that creates an execution environment for the computer program in question, for example, code constituting processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or a combination of one or more of these. The apparatus and execution environment can implement a variety of different computing model infrastructures, such as network services, distributed computing, and grid computing infrastructures.

[0242] A computer program (also referred to as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and it can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program can be stored as part of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple collaborating files (e.g., files that store one or more modules, subroutines, or code portions). A computer program can be deployed to execute on one computer or on multiple computers located at one site or distributed across multiple sites and interconnected by a communications network.

[0243] The processes and logic flows described in this specification can be performed by one or more programmable processors executing one or more computer programs to perform actions by operating on input data and generating output. The processes and logic flows can also be performed by, and apparatus can be implemented as, special purpose logic circuitry, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit).

[0244] For example, processors suitable for executing computer programs include both general-purpose microprocessors and special-purpose microprocessors. Typically, a processor will receive instructions and data from read-only memory or random access memory, or both. The essential elements of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include or be operatively coupled to one or more mass storage devices for storing data, such as magnetic, magneto-optical, or optical disks, to receive data from or transfer data to, or both. However, a computer need not have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, personal digital assistant (PDA), mobile audio or video player, game console, global positioning system (GPS) receiver, or portable storage device (e.g., a universal serial bus (USB) flash drive), etc. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and storage devices, including, for example, semiconductor memory devices such as EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.

[0245] To provide for interaction with a user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, for displaying information to the user, and a keyboard and pointing device, such as a mouse or trackball, through which the user can provide input to the computer. Other types of devices can also be used to provide for interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including sound, voice, or tactile input. In addition, the computer can interact with the user by sending documents to and receiving documents from a device used by the user; for example, by sending a web page to a web browser on a user's client device in response to a request received from the web browser.

[0246] The embodiments of the subject matter described in this specification can be implemented in a computing system that includes a back-end component, such as a data server, or includes a middleware component, such as an application server, or includes a front-end component, such as a client computer with a graphical user interface or a web browser, through which a user can interact with the implementation of the subject matter described in this specification, or includes any combination of one or more such back-end components, middleware components, or front-end components. The components of the system can be interconnected by digital data communication (such as a communication network) of any form or medium. Examples of communication networks include local area networks ("LANs") and wide area networks ("WANs"), internets (such as the Internet), and peer-to-peer networks (such as self-organizing peer-to-peer networks).

[0247] A computing system can include a client and a server. The client and server are typically remote from each other and typically interact via a communication network. The relationship between the client and the server arises from the computer programs running on the respective computers, and they have a client-server relationship with each other. In some embodiments, the server transmits data (e.g., an HTML page) to the client device (e.g., in order to display data to a user interacting with the client device and receive user input from the user interacting with the client device). Data generated at the client device (e.g., the results of the user interaction) can be received from the client device at the server.

[0248] In addition to the above embodiments, the following embodiments are also innovative:

[0249] Embodiment 1 is a method comprising: for each of one or more activities: a first computing system in a plurality of multi-party computation (MPC) systems, in collaboration with one or more second computing systems in the MPC systems, initializing a feedback controller for the activity in a secret share using a secure MPC process, wherein the feedback controller includes a setpoint based on a target rate of the activity; updating, by the first computing system, a first secret share of an output of the feedback controller based on an error parameter representing a difference between the setpoint and a measured rate of the activity; and determining, by the first computing system, a first secret share of a pacing selector parameter that defines whether the activity satisfies a pacing eligibility condition for the activity based on at least the first secret share of the output; receiving, by the first computing system, a digital component request; performing, by the first computing system and the one or more second computing systems, a given digital component selection process for the digital component request, wherein the digital component selection process selects a given digital component from a set of candidate digital components, each candidate digital component in the set of candidate digital components satisfying one or more eligibility conditions, the one or more eligibility conditions including being in an eligible activity that satisfies the pacing eligibility condition; and sending, by the first computing system, a first secret share identifying a selection result of the given digital component to the client device.

[0250] Embodiment 2 is the method of embodiment 1, wherein the target rate for the activity comprises one of a target presentation rate for the activity, a target user interaction rate for the given activity, or a target resource consumption rate for the given activity.

[0251] Embodiment 3 is the method of embodiment 1 or 2, wherein the feedback controller comprises a proportional-integral-derivative (PID) controller.

[0252] Embodiment 4 is the method of any one of embodiments 1 to 3, wherein the digital component request includes a secret share of data identifying one or more first user groups including a user of the client device as a member.

[0253] Embodiment 5 is the method of embodiment 4, wherein the first computing system collaborates with the one or more second computing systems to perform the given digital component selection process for the digital component request, including: identifying a plurality of digital components, wherein each digital component corresponds to: (i) a corresponding selection value, (ii) a corresponding second user group identifier of a corresponding second user group to which the digital component is eligible for distribution, and (iii) a corresponding activity that includes the digital component; determining, for each selection value in the plurality of selection values, a first secret share of an overall candidate parameter, the overall candidate parameter indicating: (i) whether the second user group identifier corresponding to the selection value matches one of the one or more first user groups, and (ii) whether the pacing selector parameter of the corresponding activity indicates that the corresponding activity satisfies the pacing eligibility condition of the corresponding activity; and generating the first secret share of the selection result based on the corresponding selection value and the candidate parameter of each digital component in the plurality of digital components, wherein the given digital component is a specific digital component with a highest selection value from the set of eligible digital components.

[0254] Embodiment 6 is the method of embodiment 5, wherein each qualifying digital component is a digital component for which the overall candidate parameter has a specified value, wherein the specified value indicates that: (i) the second user group identifier corresponding to the digital component matches one of the one or more first user groups, and (ii) the corresponding pacing selector parameter of the activity including the digital component indicates that the activity satisfies the pacing eligibility condition.

[0255] Embodiment 7 is a method of any one of embodiments 1 to 6, wherein generating the first secret share of the selection result includes: generating an order of the multiple digital components based on the magnitude of each selection value; determining a first secret share of the cumulative value of each selection value based on the order of the digital components and the overall candidate parameters of each digital component; determining a first secret share of a winner parameter for each digital component based on (i) the overall candidate parameters of the selection value and (ii) a result of an equality test indicating whether the cumulative value of the selection value is a specific specified value; and determining, for each selection value, a first secret share of the sum of the products of the winner parameter of the selection value and the digital component information elements of the selection value as the first secret share of the selection result.

[0256] Embodiment 8 is the method of embodiment 7, wherein determining the first secret share of the cumulative value of each selection value includes: for each individual selection value, determining the number of selection values between the highest selection value and the individual selection value, including the highest selection value and the individual selection value, having a candidate parameter indicating that the second user group identifier corresponding to the selection value matches at least one of the one or more first user group identifiers.

[0257] Embodiment 9 is the method of embodiment 7 or 8, wherein the particular specified value is one or logically true.

[0258] Embodiment 10 is the method of any one of embodiments 7 to 9, further comprising: storing the first secret share of the winner parameter using a reference to a selection process identifier of the given digital component selection process; receiving a notification from the client device, the notification including the selection process identifier and the first secret share of data, the data indicating at least one of (i) whether the given digital component is displayed at the client device or (ii) whether the user interacted with the given digital component; and using the selection process identifier and the first secret share of the data to update the first secret share of the measurement rate of the feedback controller for activity including the given digital component, the data indicating at least one of (i) whether the digital component is displayed at the client device or (ii) whether the user interacted with the given digital component.

[0259] Embodiment 11 is the method of embodiment 10, further comprising: collaborating with the one or more second computing systems to update the first secret share of the corresponding pacing selector parameter of the given activity based on the updated first secret share of the measured rate and a corresponding second secret share of the measured rate maintained by each of the one or more second computing systems.

[0260] Embodiment 12 is the method of embodiment 11, wherein updating the first secret share of the corresponding pacing selector parameter of the given activity comprises: collaborating with the one or more second computing systems to update the first secret share of the output of the feedback controller for the given activity; and collaborating with the one or more second computing systems to update the first secret share of the pacing selector for the given activity based on the updated first secret share of the output of the feedback controller for the given activity and a corresponding updated second secret share of the output of the feedback controller for the given activity maintained by each of the one or more second computing systems.

[0261] Embodiment 13 is a system comprising: one or more processors; and one or more storage devices storing instructions, which, when executed by the one or more processors, cause the one or more processors to perform the method of any one of embodiments 1 to 12.

[0262] Embodiment 14 is a computer-readable storage medium carrying instructions, which, when executed by one or more processors, cause the one or more processors to perform the method of any one of embodiments 1 to 12.

[0263] Embodiment 15 is a computer program product comprising instructions, which, when executed by a computer, cause the computer to perform the steps of the method of any one of embodiments 1 to 12.

[0264] Although this specification contains many specific implementation details, these should not be interpreted as limitations on the scope of any invention or the scope that may be claimed, but rather as descriptions of features specific to specific embodiments of particular inventions. Certain features described in this specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, the various features described in the context of a single embodiment can also be implemented separately or in any suitable sub-combination in multiple embodiments. In addition, although features may be described above as working in certain combinations, and even initially claimed as such, one or more features from the claimed combination can in some cases be deleted from the combination, and the claimed combination may involve a variant of a sub-combination or a sub-combination.

[0265] Similarly, although operations are described in a particular order in the accompanying drawings, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order, or that all of the operations shown be performed, in order to obtain the desired results. In some cases, multitasking and parallel processing can be advantageous. Furthermore, the separation of various system components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0266] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential sequence shown to achieve the desired results. In certain embodiments, multitasking and parallel processing may be advantageous.

Claims

1. A computer-implemented method comprising: For each activity in one or more activities: Initializing, by a first computing system of a plurality of multi-party computation (MPC) systems in cooperation with one or more second computing systems of the MPC systems, a feedback controller for the activity in a secret share using a secure MPC process, wherein the feedback controller includes a setpoint based on a target rate for the activity, wherein each MPC system maintains parameters of the feedback controller in a secret share that encrypts the parameters, wherein the parameters include a measurement rate, an output parameter, and an error parameter; updating, by the first computing system in cooperation with each of the one or more second computing systems using an MPC protocol, a first secret share of the output parameter of the feedback controller based on the error parameter representing a difference between the set point and the measured rate of activity; and determining, by the first computing system based at least on the first secret share of the output parameter, a first secret share of a pacing selector parameter that defines whether the activity satisfies a pacing eligibility condition for the activity; receiving, by the first computing system, a digital component request; performing, by the first computing system in cooperation with the one or more second computing systems, a given digital component selection process for the digital component request, wherein the digital component selection process selects the given digital component from a set of candidate digital components, each candidate digital component in the set of candidate digital components satisfying one or more qualifying conditions, the one or more qualifying conditions comprising being in a qualifying activity that satisfies the pacing qualifying condition; and A first secret share identifying a selection result of the given digital component is sent by the first computing system to the client device.

2. The computer-implemented method of claim 1 , wherein: The target rate for the activity includes one of a target presentation rate for the activity, a target user interaction rate for the given activity, or a target resource consumption rate for the given activity.

3. The computer-implemented method of claim 1 , wherein: The feedback controller includes a proportional-integral-derivative (PID) controller.

4. The computer-implemented method of claim 1 , wherein: The digital component request includes a secret share of data identifying one or more first user groups that include a user of the client device as a member.

5. The computer-implemented method of claim 4, wherein: The first computing system and the one or more second computing systems cooperate to perform the given digital component selection process for the digital component request, including: identifying a plurality of digital components, wherein each digital component corresponds to: (i) a respective selection value, (ii) a respective second user group identifier of a respective second user group to which the digital component is eligible for distribution, and (iii) a respective campaign that includes the digital component; determining, for each selection value of the plurality of selection values, a first secret share of an overall candidate parameter, the overall candidate parameter indicating: (i) whether the second user group identifier corresponding to the selection value matches one of the one or more first user groups, and (ii) whether the pacing selector parameter of the corresponding activity indicates that the corresponding activity satisfies the pacing eligibility condition of the corresponding activity; and The first secret share of the selection result is generated based on the corresponding selection value of each digital component in the plurality of digital components and the candidate parameters, wherein the given digital component is a specific digital component with a highest selection value from a set of eligible digital components.

6. The computer-implemented method of claim 5, wherein: Each qualifying digital component is a digital component for which the overall candidate parameter has a specified value, wherein the specified value indicates that: (i) the second user group identifier corresponding to the digital component matches one of the one or more first user groups, and (ii) the corresponding pacing selector parameter of the activity including the digital component indicates that the activity satisfies the pacing eligibility condition.

7. The computer-implemented method of claim 1 , wherein: Generating the first secret share of the selection result includes: generating a sequence of the plurality of digital components based on a magnitude of each selected value; determining a first secret share of an accumulated value for each selected value based on the sequence of the digital components and the overall candidate parameter of each digital component; determining a first secret share of a winner parameter for each digital component based on (i) the overall candidate parameter for the selected value and (ii) a result of an equality test indicating whether the accumulated value of the selected value is a particular specified value; and For each selection value, a product of the winner parameter of the selection value and a digital component information element of the selection value is determined, and a first secret share of the sum of the products is determined as the first secret share of the selection result.

8. The computer-implemented method of claim 7, wherein: Determining the first secret share of the accumulated value for each selected value includes: For each individual selection value, a number of selection values between a highest selection value and the individual selection value, including the highest selection value and the individual selection value, having a candidate parameter indicating that the second user group identifier corresponding to the selection value matches at least one of the one or more first user group identifiers is determined.

9. The computer-implemented method of claim 7, wherein: The particular specified value is one or logically true.

10. The computer-implemented method of claim 7, further comprising: storing said first secret share of said winner parameter with a reference to a selection process identifier of said given digital component selection process; receiving a notification from the client device, the notification including the selection process identifier and a first secret share of data indicating at least one of (i) whether the given digital component is displayed at the client device or (ii) whether a user has interacted with the given digital component; as well as updating a first secret share of the measured rate of the feedback controller for activity including the given digital component using the selection process identifier and the first secret share of the data, the data indicating at least one of (i) whether the digital component is displayed at the client device or (ii) whether the user interacted with the given digital component.

11. The computer-implemented method of claim 10 , further comprising: and cooperating with the one or more second computing systems to update the first secret share of the corresponding pacing selector parameter of the given activity based on the updated first secret share of the measured rate and a corresponding second secret share of the measured rate maintained by each of the one or more second computing systems.

12. The computer-implemented method of claim 11, wherein: Updating the first secret share of the corresponding pacing selector parameter of the given activity includes: updating, in cooperation with the one or more second computing systems, the first secret share of the output parameter of the feedback controller for the given activity; and and cooperating with the one or more second computing systems to update the first secret share of the pacing selector of the given activity based on the updated first secret share of the output parameter of the feedback controller for the given activity and a corresponding updated second secret share of the output parameter of the feedback controller for the given activity maintained by each of the one or more second computing systems.

13. A system comprising: one or more processors; as well as One or more computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: For each activity in one or more activities: Initializing, by a first computing system of a plurality of multi-party computation (MPC) systems in cooperation with one or more second computing systems of the MPC systems, a feedback controller for the activity in a secret share using a secure MPC process, wherein the feedback controller includes a setpoint based on a target rate for the activity, wherein each MPC system maintains parameters of the feedback controller in a secret share that encrypts the parameters, wherein the parameters include a measurement rate, an output parameter, and an error parameter; updating, by the first computing system in cooperation with each of the one or more second computing systems using an MPC protocol, a first secret share of the output parameter of the feedback controller based on the error parameter representing a difference between the set point and the measured rate of activity; and determining, by the first computing system based at least on the outputted first secret share, a first secret share of a pacing selector parameter that defines whether the activity satisfies a pacing eligibility condition for the activity; receiving, by the first computing system, a digital component request; performing, by the first computing system in cooperation with the one or more second computing systems, a given digital component selection process for the digital component request, wherein the digital component selection process selects the given digital component from a set of candidate digital components, each candidate digital component in the set of candidate digital components satisfying one or more qualifying conditions, the one or more qualifying conditions comprising being in a qualifying activity that satisfies the pacing qualifying condition; and A first secret share identifying a selection result of the given digital component is sent by the first computing system to the client device.

14. The system according to claim 13, wherein: The target rate for the activity includes one of a target presentation rate for the activity, a target user interaction rate for the given activity, or a target resource consumption rate for the given activity.

15. The system according to claim 13, wherein: The feedback controller includes a proportional-integral-derivative (PID) controller.

16. The system of claim 13, wherein: The digital component request includes a secret share of data identifying one or more first user groups that include a user of the client device as a member.

17. The system according to claim 16, wherein: The first computing system and the one or more second computing systems cooperate to perform the given digital component selection process for the digital component request, including: identifying a plurality of digital components, wherein each digital component corresponds to: (i) a respective selection value, (ii) a respective second user group identifier of a respective second user group to which the digital component is eligible for distribution, and (iii) a respective campaign that includes the digital component; determining, for each selection value of the plurality of selection values, a first secret share of an overall candidate parameter, the overall candidate parameter indicating: (i) whether the second user group identifier corresponding to the selection value matches one of the one or more first user groups, and (ii) whether the pacing selector parameter of the corresponding activity indicates that the corresponding activity satisfies the pacing eligibility condition of the corresponding activity; and The first secret share of the selection result is generated based on the corresponding selection value of each digital component in the plurality of digital components and the candidate parameters, wherein the given digital component is a specific digital component with a highest selection value from a set of eligible digital components.

18. The system according to claim 17, wherein: Each qualifying digital component is a digital component for which the overall candidate parameter has a specified value, wherein the specified value indicates that: (i) the second user group identifier corresponding to the digital component matches one of the one or more first user groups, and (ii) the corresponding pacing selector parameter of the activity including the digital component indicates that the activity satisfies the pacing eligibility condition.

19. The system of claim 13, wherein: Generating the first secret share of the selection result includes: generating a sequence of the plurality of digital components based on a magnitude of each selected value; determining a first secret share of an accumulated value for each selected value based on the sequence of the digital components and the overall candidate parameter of each digital component; determining a first secret share of a winner parameter for each digital component based on (i) the overall candidate parameter for the selected value and (ii) a result of an equality test indicating whether the accumulated value of the selected value is a particular specified value; and For each selected value, a product of the winner parameter of the selected value and a digital component information element of the selected value is determined, and a first secret share of the sum of the products is determined as the first secret share of the selection result.

20. The system of claim 19, wherein: Determining the first secret share of the accumulated value for each selected value includes: For each individual selection value, a number of selection values between a highest selection value and the individual selection value, including the highest selection value and the individual selection value, having a candidate parameter indicating that the second user group identifier corresponding to the selection value matches at least one of the one or more first user group identifiers is determined.

21. The system of claim 19, wherein: The particular specified value is one or logically true.

22. The system of claim 19, wherein: The operations include: storing said first secret share of said winner parameter with a reference to a selection process identifier of said given digital component selection process; receiving a notification from the client device, the notification including the selection process identifier and a first secret share of data indicating at least one of (i) whether the given digital component was presented at the client device or (ii) whether a user interacted with the given digital component; and updating a first secret share of the measured rate of the feedback controller for activity including the given digital component using the selection process identifier and the first secret share of the data, the data indicating at least one of (i) whether the digital component is presented at the client device or (ii) whether the user interacted with the given digital component.

23. The system of claim 22, wherein: The operations include, in cooperation with the one or more second computing systems, updating the first secret share of the corresponding pacing selector parameter of the given activity based on the updated first secret share of the measured rate and a corresponding second secret share of the measured rate maintained by each of the one or more second computing systems.

24. The system of claim 23, wherein: Updating the first secret share of the corresponding pacing selector parameter of the given activity includes: updating, in cooperation with the one or more second computing systems, the first secret share of the output parameter of the feedback controller for the given activity; and and cooperating with the one or more second computing systems to update the first secret share of the pacing selector of the given activity based on the updated first secret share of the output parameter of the feedback controller for the given activity and a corresponding updated second secret share of the output parameter of the feedback controller for the given activity maintained by each of the one or more second computing systems.

25. One or more non-transitory computer-readable media storing instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising: For each activity in one or more activities: Initializing, by a first computing system of a plurality of multi-party computation (MPC) systems in cooperation with one or more second computing systems of the MPC systems, a feedback controller for the activity in a secret share using a secure MPC process, wherein the feedback controller includes a setpoint based on a target rate for the activity, wherein each MPC system maintains parameters of the feedback controller in a secret share that encrypts the parameters, wherein the parameters include a measurement rate, an output parameter, and an error parameter; updating, by the first computing system in cooperation with each of the one or more second computing systems using an MPC protocol, a first secret share of the output parameter of the feedback controller based on the error parameter representing a difference between the set point and the measured rate of activity; and determining, by the first computing system based at least on the outputted first secret share, a first secret share of a pacing selector parameter that defines whether the activity satisfies a pacing eligibility condition for the activity; receiving, by the first computing system, a digital component request; performing, by the first computing system in cooperation with the one or more second computing systems, a given digital component selection process for the digital component request, wherein the digital component selection process selects the given digital component from a set of candidate digital components, each candidate digital component in the set of candidate digital components satisfying one or more qualifying conditions, the one or more qualifying conditions comprising being in a qualifying activity that satisfies the pacing qualifying condition; and A first secret share identifying a selection result of the given digital component is sent by the first computing system to the client device.

26. The one or more non-transitory computer-readable media of claim 25, wherein: The target rate for the activity includes one of a target presentation rate for the activity, a target user interaction rate for the given activity, or a target resource consumption rate for the given activity.

27. The one or more non-transitory computer-readable media of claim 25, wherein: The feedback controller includes a proportional-integral-derivative (PID) controller.

28. The one or more non-transitory computer-readable media of claim 25, wherein: The digital component request includes a secret share of data identifying one or more first user groups that include a user of the client device as a member.

29. The one or more non-transitory computer-readable media of claim 28, wherein: The first computing system and the one or more second computing systems cooperate to perform the given digital component selection process for the digital component request, including: identifying a plurality of digital components, wherein each digital component corresponds to: (i) a respective selection value, (ii) a respective second user group identifier of a respective second user group to which the digital component is eligible for distribution, and (iii) a respective campaign that includes the digital component; determining, for each selection value of the plurality of selection values, a first secret share of an overall candidate parameter, the overall candidate parameter indicating: (i) whether the second user group identifier corresponding to the selection value matches one of the one or more first user groups, and (ii) whether the pacing selector parameter of the corresponding activity indicates that the corresponding activity satisfies the pacing eligibility condition of the corresponding activity; and The first secret share of the selection result is generated based on the corresponding selection value of each digital component in the plurality of digital components and the candidate parameters, wherein the given digital component is a specific digital component with a highest selection value from a set of eligible digital components.

30. The one or more non-transitory computer-readable media of claim 29, wherein: Each qualifying digital component is a digital component for which the overall candidate parameter has a specified value, wherein the specified value indicates that: (i) the second user group identifier corresponding to the digital component matches one of the one or more first user groups, and (ii) the corresponding pacing selector parameter of the activity including the digital component indicates that the activity satisfies the pacing eligibility condition.

31. The one or more non-transitory computer-readable media of claim 25, wherein: Generating the first secret share of the selection result includes: generating a sequence of the plurality of digital components based on a magnitude of each selected value; determining a first secret share of an accumulated value for each selected value based on the sequence of the digital components and the overall candidate parameter of each digital component; determining a first secret share of a winner parameter for each digital component based on (i) the overall candidate parameter for the selected value and (ii) a result of an equality test indicating whether the accumulated value of the selected value is a particular specified value; and For each selection value, a product of the winner parameter of the selection value and a digital component information element of the selection value is determined, and a first secret share of the sum of the products is determined as the first secret share of the selection result.

32. The one or more non-transitory computer-readable media of claim 31, wherein: Determining the first secret share of the accumulated value for each selected value includes: For each individual selection value, a number of selection values between a highest selection value and the individual selection value, including the highest selection value and the individual selection value, having a candidate parameter indicating that the second user group identifier corresponding to the selection value matches at least one of the one or more first user group identifiers is determined.

33. The one or more non-transitory computer-readable media of claim 31, wherein: The particular specified value is one or logically true.

34. The one or more non-transitory computer-readable media of claim 31 , wherein: The operations include: storing said first secret share of said winner parameter with a reference to a selection process identifier of said given digital component selection process; receiving a notification from the client device, the notification including the selection process identifier and a first secret share of data indicating at least one of (i) whether the given digital component was presented at the client device or (ii) whether a user interacted with the given digital component; and updating a first secret share of the measured rate of the feedback controller for activity including the given digital component using the selection process identifier and the first secret share of the data, the data indicating at least one of (i) whether the digital component is presented at the client device or (ii) whether the user interacted with the given digital component.

35. The one or more non-transitory computer-readable media of claim 34, wherein: The operations include, in cooperation with the one or more second computing systems, updating the first secret share of the corresponding pacing selector parameter of the given activity based on the updated first secret share of the measured rate and a corresponding second secret share of the measured rate maintained by each of the one or more second computing systems.

36. The one or more non-transitory computer-readable media of claim 35, wherein: Updating the first secret share of the corresponding pacing selector parameter of the given activity includes: updating, in cooperation with the one or more second computing systems, the first secret share of the output parameter of the feedback controller for the given activity; and and cooperating with the one or more second computing systems to update the first secret share of the pacing selector of the given activity based on the updated first secret share of the output parameter of the feedback controller for the given activity and a corresponding updated second secret share of the output parameter of the feedback controller for the given activity maintained by each of the one or more second computing systems.

Images