Methods and systems for selecting digital components using multi-party computation (MPC)

Abstract

This document relates to ways of selecting digital components using secure MPC to protect user privacy and the security of data involved in each party in the selection process. In one aspect, a method includes receiving, by a first computing system of a secure MPC system, a digital component request and a random number from a client device. The first computing system generates, based on the random number and a function, an array comprising shares of a Bloom filter, the share representing a user group identifier of a user group comprising a user of the client device as a member. For each of a plurality of user group identifiers, the first computing system collaborates with one or more second computing systems of the secure MPC system and uses the array to compute a respective first secret share of one or more user group membership condition parameters.

Description

TECHNICAL FIELD

[0001] The specification relates to cryptography and data security. BACKGROUND

[0002] Secure multi-party computation (MPC) is a family of cryptographic protocols that prevent access to data by distributing computation across multiple parties, such that no single party has access to another party’s data or intermediate computation values, and outputs are only released to designated parties. MPC computing systems often use secret shares or other encrypted forms of data to perform computations and to protect the exchange of information between parties. SUMMARY

[0003] In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include receiving, by a first computing system of a secure multi-party computation (MPC) system, a digital component request and a random number from a client device; generating, based on the random number and a function, an array comprising shares of a Bloom filter, the shares of the Bloom filter representing a user group identifier of a user group that includes a user of the client device as a member; for each of a plurality of user group identifiers, computing, in cooperation with one or more second computing systems of the secure MPC system and using the array, a respective first secret share of one or more user group membership condition parameters representing whether the user of the client device is a member of a user group identified by the user group identifier; for each of a plurality of digital components: identifying a given user group identifier corresponding to the digital component; and computing, by the first computing system in cooperation with each of the one or more second computing systems, a first secret share of a candidate parameter based at least on the respective first secret share of each user group membership condition parameter corresponding to a given user group identified by the given user group identifier and a second secret share of the user group membership condition parameter corresponding to the given user group identified by the given user group identifier held by each of the one or more second computing systems, wherein the candidate parameter indicates whether the digital component is an eligible candidate for the digital component request; generating, based on the first secret share of the candidate parameter for each digital component and a selection value for each digital component, a first secret share of a selection result representing a selected digital component; and sending, to the client device, the first secret share of the selection result. Other implementations of this aspect include corresponding apparatuses, systems, and computer programs configured to perform the methods encoded on computer storage devices.

[0004] These and other implementations can each independently include one or more of the following features. In some aspects, computing, in cooperation with the one or more second computers of the second MPC system, the first secret share of the user group membership condition parameter includes computing the first secret share of the user group membership condition parameter using one of a garbled circuit protocol or a Goldreich-Micali-Wigderson (GMW) protocol.

[0005] In some aspects, computing, in cooperation with each of the one or more second computers, the first secret share of the candidate parameter includes computing the first secret share of the candidate parameter based on respective secret shares of parameters for one or more additional conditions.

[0006] Some aspects include receiving an additional random number representing an additional Bloom filter of a set of blocked digital components; generating an additional array representing a share of the additional Bloom filter; and computing, in cooperation with the one or more second computing systems and using the additional array, a first secret share of a blocking condition parameter representing whether a digital component of the plurality of digital components is blocked at the client device. The candidate parameter for the digital component is based on the blocking condition parameter.

[0007] In some aspects, the first secret share of the selection result includes a result computed by performing a bitwise XOR operation between a secret share of the selection result and a second mask received from the client device. In some aspects, the first computing system includes a service pool including a set of processors and a load balancer balancing computational load among the set of processors. The first computing system can include a log processor pool including an additional set of processors that generate snapshots based on updates to a log including data related to completed digital component selection processes and provide the snapshots to the service pool.

[0008] The subject matter described in this specification can be implemented in particular embodiments so as to realize one or more of the following advantages. Using secure MPC processes performed by two or more MPC servers operated by different parties to select digital components based on shares of user information ensures that the user information cannot be accessed in plaintext by the MPC servers or another party without unauthorized collusion between the MPC servers. In this way, user data privacy is protected as long as at least one of the MPC servers is honest.

[0009] In the digital component selection process, the MPC servers can select from eligible digital components that satisfy one or more eligibility conditions while preventing parties from accessing user information in the clear. Eligibility conditions can include restrictions and guidelines regarding the manner or frequency of distribution of digital components and other factors. Conditions can include user group membership, frequency control, muting (e.g., user blocking), k-anonymity to prevent microtargeting of users, and / or pacing and budget constraints.

[0010] Because the selection of digital components is an online process that typically occurs at a client device as content is being loaded, it is important that the process be completed quickly, e.g., in a few milliseconds. The techniques described in this document improve the speed of selecting digital components by reducing the size of data transmitted between client devices and the MPC cluster, by reducing the computational resources required by the MPC cluster, and by reducing the number of roundtrip communications / computations performed by servers of the MPC cluster and the size of data transmitted between servers. The reduction in data size between client devices and servers also reduces network bandwidth consumption and battery consumption of the client devices, e.g., if the client devices are mobile devices that operate on battery power.

[0011] A client device of a user can generate a probabilistic data structure, e.g., a cuckoo filter or a Bloom filter, representing a user group that includes the user as a member, and can provide the probabilistic data structure or data representing the probabilistic data structure to servers of the MPC cluster. Using probabilistic data structures in this way protects user privacy and maintains data security by preventing access to the user’s group membership, and reduces the size of information provided to the MPC cluster because probabilistic data structures are compact representations of data sets. Data representing the probabilistic data structure can be generated and sent to the MPC servers such that no party that receives only a portion of the data can access the user’s user group membership without having other portions or cooperating with other MPC servers, e.g., using secure MPC processes. The reduction in data size reduces the amount of bandwidth consumed to transmit the information, reduces the latency to transmit the information, and reduces the amount of processing power and associated battery power of a device operating on a battery, e.g., a mobile device, required to transmit the information.

[0012] The MPC cluster can transmit secret shares that identify results of the selected digital components that the MPC cluster selected using the secure MPC process. By sending secret shares for the results of only the selected digital components, rather than information for all or a large set of digital components, latency and consumed bandwidth, processing power, and battery power are similarly reduced in transmitting and receiving the results. This also reduces the potential leakage of confidential information of the content platform that submits selection values for digital components to the MPC cluster by limiting the number of digital components from which information is provided to the client device.

[0013] Reducing latency of content presentation also reduces the number of errors that occur at user devices while waiting for such content to arrive. As content is typically required to be provided in milliseconds and to mobile devices connected over wireless networks, reducing latency in selecting and providing content is critical to preventing errors and reducing user frustration.

[0014] The secure MPC techniques described in this document are flexible and support different types of selection processes and / or additional selection process features, such as floor, tier, and / or boost. The secure MPC techniques described in this document implement such features while still protecting user privacy and data security. When tiers are used, multiple selection processes can be executed in parallel to reduce latency of selection of digital components, or sequentially to reduce unnecessary computation. Metrics that can be used to improve efficiency of the digital component selection process can be aggregated and reported to the appropriate parties in a manner that protects user privacy.

[0015] The details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the following description. Other features, aspects, and advantages of the subject matter will become apparent from the description, the drawings, and the claims. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 is a block diagram of an environment in which an MPC cluster executes a secure MPC process to select digital components for distribution to client devices.

[0017] Figure 2 shows Figure 1 exemplary data flow within the environment of

[0018] Figure 3 is a diagram of an exemplary process for selecting digital components for distribution to client devices.

[0019] Figure 4 is a diagram of an exemplary process for selecting digital components for distribution to client devices.

[0020] Figure 5is a diagram of an example process for selecting digital components for distribution to client devices.

[0021] Figure 6 is a diagram of an example process for determining a highest other selection value for a digital component in a digital component selection process.

[0022] Figure 7 is a flowchart of an example process for determining a difference between a first selection value of a real digital component selection process and a first selection value of an alternate digital component selection process.

[0023] Figure 8 is a flowchart of an example process for determining whether a user is a member of a group of users using a Bloom filter sent using secret shares.

[0024] Figure 9 is a block diagram of an example MPC computing system.

[0025] Figure 10 is a block diagram of an example computer system.

[0026] Like reference numbers and designations in various drawings indicate like elements. DETAILED DESCRIPTION

[0027] Generally, this document describes systems and techniques for selecting digital components using secure MPC to protect user privacy and the security of data involved in each party to the selection process. Enhancements to the selection process support multiple variations of the digital component selection process, providing flexibility for content publishers and content platforms that manage the selection of digital components while maintaining user privacy and data security. For example, the MPC clusters described in this document are capable of performing secure digital component selection processes that include tiers, selection value promotion, first value selection processes, second value selection processes, and / or combinations of one or more of these variations. The techniques described in this document allow for this flexibility, privacy protection, and data security while still providing digital components within a short period of time—e.g., within milliseconds—after receiving a request and while minimizing the size of data sent to and from client devices that display the digital components.

[0028] The MPC cluster can also generate information, such as metrics, based on the completed selection process that can be used to further enhance future digital component selection processes. This information can be generated using secure MPC so that user data and data of publishers and / or content platforms are not accessible without unauthorized collusion between the servers of the MPC cluster and / or other parties. The information can be reported to the appropriate parties in encrypted form, e.g., as secret shares, so that only the recipients can access the information in plaintext. To protect user privacy, in some implementations, the intended recipients can access the information in plaintext with applied differential privacy noise and / or in aggregated form. Plaintext is text that is in a form that can be viewed or used without the need for a key or other decryption device or other decryption process, that is not computationally marked, specially formatted, or written in code or data that includes binary files.

[0029] In this document, some computations performed by the MPC cluster on secret shares are shown as products or sums of secret share values. To improve the speed of performing these computations, multiplication can be performed in secret shares using an AND operation, e.g., a bitwise AND, and addition can be performed in secret shares using an XOR operation, e.g., a bitwise XOR operation. In some cases, when one plaintext integer is multiplied by a secret share representing zero or one in Z2 (i.e., the mod 2 sum of two shares is zero or one), no multiplication or bitwise AND is needed. Instead, each computing system can evaluate its share, and if its share is one, return the integer, and if its share is zero, return zero.

[0030] Figure 1 is a block diagram of an environment 100 in which the MPC cluster 130 performs a secure MPC process to select digital components for distribution to client devices 110. The MPC cluster 130 also generates information for the completed digital component selection process and provides the information to the appropriate parties.

[0031] The example environment 100 includes a data communication network 105, such as a local area network (LAN), a wide area network (WAN), the Internet, a mobile network, or a combination thereof. The network 105 connects the client devices 110, the secure MPC cluster 130, the publishers 140, the websites 142, and the content platforms, e.g., the supply-side platforms (SSPs) 170 and the demand-side platforms (DSPs) 150. The example environment 100 can include many different client devices 110, secure MPC clusters 130, publishers 140, websites 142, DSPs 150, and SSPs 170.

[0032] The websites 142 include one or more electronic resources 145. The resources 145 can be associated with a domain name and hosted by one or more servers. An example website is a collection of web pages formatted in HyperText Markup Language (HTML) that can contain text, images, multimedia content, and programming elements such as scripts. Each website 142 is maintained by a content publisher 140, which is an entity that controls, manages, and / or owns the website 142.

[0033] The resources 145 are any data that can be provided by the publisher 140 over the network 105 and that can be associated with a resource address. Resources include HTML pages, word processing documents and Portable Document Format (PDF) documents, images, videos, and feed sources, to name a few. The resources 145 can include content such as words, phrases, pictures, and so on, and can include embedded information (e.g., meta-information and hyperlinks) and / or embedded instructions, such as scripts.

[0034] The client devices 110 are electronic devices that can communicate over the network 105. Example client devices 110 include personal computers, mobile communication devices such as smart phones, and other devices that can send and receive data over the network 105. The client devices 110 can also include digital assistant devices that accept audio input through a microphone and output audio output through a speaker. When the digital assistant detects a "hotword" or "hotphrase" that activates the microphone to accept audio input, the digital assistant can be placed in a listening mode (e.g., ready to accept audio input). The digital assistant device can also include a camera and / or a display to capture images and visually present information. The digital assistant can be implemented in different forms of hardware devices, including a wearable device (e.g., a watch or glasses), a smart phone, a speaker device, a tablet device, or another hardware device. The client devices 110 can also include digital media devices, such as a streaming device that plugs into a television or other display to stream video to the television, a gaming system, or a virtual reality system.

[0035] The client devices 110 typically include applications 112, such as web browsers and / or native applications, to facilitate sending and receiving data over the network 105. A native application is an application developed for a particular platform or a particular device, e.g., for a mobile device with a particular operating system. The publishers 140 can develop and provide native applications to the client devices 110, e.g., to make them available for download. A web browser can request resources 145 from a web server that hosts a website 142 of a publisher 140, e.g., in response to a user of the client device 110 entering a resource address of a resource 145 in an address bar of the web browser or selecting a link that references the resource address. Similarly, a native application can request application content from a remote server of a publisher.

[0036] Some resources, application pages, or other application content can include digital component slots for displaying digital components with the resource 145 or application page. As used throughout this document, the phrase "digital component" refers to a discrete unit of digital content or digital information (e.g., a video clip, an audio clip, a multimedia clip, an image, text, or another unit of content). A digital component can be electronically stored in a physical memory device as a single file or in a collection of files, and a digital component can take the form of a video file, an audio file, a multimedia file, an image file, or a text file, and include advertising information such that an advertisement is a type of digital component. For example, a digital component can be content that is intended to supplement the content of a web page, application content (e.g., an application page), or other resource displayed by the application 112. More specifically, a digital component can include digital content that is related to the resource content, e.g., a digital component can relate to the same subject matter as the web page content, or to a related subject matter. Thus, the provision of a digital component can supplement and generally enhance the web page or application content.

[0037] When the application 112 loads a resource (or application content) that includes one or more digital component slots, the application 112 can request a digital component for each slot. In some implementations, a digital component slot can include code, e.g., one or more scripts, that when processed by the application 112, causes the application 112 to request a digital component for display to a user of the client device 110. As described below, the application 112 can request a digital component from the MPC cluster 130 and / or one or more SSPs 170.

[0038] Some publishers 140 use SSPs 170 to manage the process of obtaining digital components for their resource 145 and / or application 112 digital component slots. An SSP 170 is a technology platform, implemented in hardware and / or software, that automates the process of obtaining digital components for resources and / or applications. Each publisher 140 can have a corresponding SSP 170 or multiple SSPs 170. Some publishers 140 can use the same SSP 170.

[0039] Digital component providers 160 can create (or otherwise publish) digital components that are displayed in digital component slots of publishers' resources 145 and applications 112. For example, a digital component provider 160 can create a digital component that includes content related to the digital component provider 160. In a particular example, a digital component of a product manufacturer can include content related to a product.

[0040] The digital component providers 160 can use the DSPs 150 to manage the serving of their digital components for display in digital component slots. A DSP 150 is a technology platform implemented in hardware and / or software that automates the process of distributing digital components for display with resources and / or applications. The DSPs 150 can interact on behalf of the digital component providers 160 with multiple SSPs 170 to provide digital components for display with resources 145 and / or applications 112 of multiple different publishers 140. Generally, the DSPs 150 can receive a request for a digital component (e.g., from an SSP 170), generate (or select) a selection value for one or more digital components created by one or more digital component providers 160 based on the request, and provide data related to the digital component (e.g., the digital component itself or code that enables the digital component to be downloaded) and the selection parameter to the SSP 170. The selection value can indicate an amount that the digital component provider 160 is willing to provide for display with the digital component or for user interaction with the digital component. The SSP 170 can then select a digital component for display at the client device 110 and provide data that causes the client device 110 to display the digital component, e.g., by providing the digital component or code that enables the digital component to be downloaded, to the client device 110. As described in more detail below, the MPC cluster 130 can select digital components for the client device 110 to display in a manner that protects user privacy.

[0041] In some cases, it is beneficial to users to receive digital components related to web pages, application pages, or other electronic resources that the user previously accessed and / or interacted with. To distribute such digital components to users, users can be assigned to user groups, e.g., user interest groups of users interested in the same or similar topics, groups of similar users, or other group types involving similar user data. Users can be assigned to user groups when the user accesses a particular resource or performs a particular action at a resource (e.g., interacts with a particular item displayed on a web page or adds the item to a virtual shopping cart). The user groups can be generated and updated by the digital component providers 160. That is, each digital component provider 160 can assign users to its user groups when the users access the digital component provider’s 160 electronic resources. The user groups can also be created and / or updated by content platforms (e.g., by the DSPs 150 and / or SSPs 170).

[0042] To protect user privacy, for example, a user’s group membership can be maintained at the user’s client device 110 by one of the application 112, the operating system of the client device 110, or another trusted program, rather than by the digital component provider, content platform, or other party. In a particular example, a trusted program (e.g., a web browser or operating system) can maintain a list of user group identifiers for a user of the web browser or another application (e.g., a user logged into the browser, application, or client device 110) (“user group list”). The user group list can include a user group identifier for each user group of which the user is a member. A digital component provider 160 or content platform that creates a user group can specify a user group identifier for its user group. The user group identifier for a user group can be a description of the group (e.g., a gardening group) or a code representing the group (e.g., a non-descriptive alphanumeric sequence). A user’s user group list can be stored in secure storage at the client device 110 and / or can be encrypted when stored to prevent others from accessing the list.

[0043] When the application 112 displays a resource (e.g., web page), application content, or digital component related to the digital component provider 160, the resource, application content, or digital component can request that the application 112 add one or more user group identifiers to the user group list. In response, the application 112 can add the one or more user group identifiers to the user group list and securely store the user group list. For example, a web page that a user selects to view for more information about a particular item can add the user to a user group related to the particular item.

[0044] In some implementations, the MPC cluster 130 can use a user’s user group membership to select digital components that the user can be interested in or that are otherwise beneficial to the user / user device. For example, such digital components or other content can include data that improves the user experience, improves the operation of the user device, or is otherwise beneficial to the user or client device 110. However, the user group identifiers of the user’s user group list can be provided and used to select digital components in a manner that prevents the computing systems MPC1 and MPC2 of the MPC cluster 130 from accessing the user’s user group identifiers in plaintext, thereby protecting user privacy when using user group membership data to select digital components. The MPC cluster 130 can also use other conditions to select digital components, as described in more detail below.

[0045] The secure MPC cluster 130 includes two computing systems, MPC1 and MPC2, that perform a secure MPC process to select digital components for distribution to users' client devices based on the users' group membership, but without accessing the group membership or other user information or signals derived from such user information in plaintext. Although the example MPC cluster 130 includes two computing systems, more computing systems can be used as well, so long as the MPC cluster 130 includes more than one computing system. For example, the MPC cluster 130 can include three computing systems, four computing systems, or another suitable number of computing systems. Using more computing systems in the MPC cluster 130 can provide more security, but can also increase the complexity of the MPC process. Each computing system can be a server or other suitable type of computer. Figure 9 An example architecture of an MPC computing system is shown in FIG. 1.

[0046] The computing systems MPC1 and MPC2 can be operated by different entities. In this way, each entity can not have access in plaintext to the users' group membership, or other user information, or signals derived from such user information. For example, one of the computing systems MPC1 or MPC2 can be operated by a different trusted party than the users, the publishers 140, the DSPs 150, the SSPs 170, and the digital component providers 160. For example, an industry group, a government group, or a browser developer can maintain and operate one of the computing systems MPC1 and MPC2. The other computing system can be operated by a different one of these groups, such that a different trusted party operates each computing system MPC1 and MPC2. Advantageously, the different parties that operate the different computing systems MPC1 and MPC2 can not have the motivation to collude to compromise user privacy. In some implementations, the computing systems MPC1 and MPC2 are architecturally separated and monitored to not communicate with each other outside of performing the secure MPC process described in this document.

[0047] Each computing system MPC1 and MPC2 can store digital components (e.g., the creative of a digital component), selection values for digital components, and other information for digital components. For example, computing systems MPC1 and MPC2 can cache selection values previously received from SSP 170 and / or DSP 150 as part of a previous digital component selection process or otherwise provided to computing systems MPC1 and MPC2, e.g., pre-provisioned for use in a digital component selection process. In this way, MPC cluster 130 can use selection values to select digital components for distribution to client device 110 in response to future digital component requests received from client device 110. In this document, digital components for which selection values and other information are stored by MPC cluster 130 for digital component selection processes can be referred to as stored digital components. However, the digital components themselves are not necessarily stored by MPC cluster 130. Rather, MPC cluster 130 can store data for each stored digital component, e.g., code that references a network location from which the digital component can be downloaded. In some implementations, the digital components themselves are stored and returned directly by MPC cluster 130 to application 112. Such implementations reduce the need for application 112 to fetch digital components and / or other information for digital components in additional requests that can consume device battery and bandwidth and potentially leak additional signals for servers hosting the digital components themselves to track devices.

[0048] For each stored digital component, each computing system MPC1 and MPC2 can store a selection value or a vector of values that can be used by computing systems MPC1 and MPC2 to determine selection values for the digital component. Each computing system MPC1 and MPC2 can also store, for each digital component, condition data that defines condition(s) that must be satisfied for the digital component to be a qualified candidate for a given digital component selection process. A stored digital component can have zero or more corresponding conditions.

[0049] One example condition is that the user to which the selected digital component will be provided is a member of a user group corresponding to the stored digital component. This condition can be referred to as a user group membership condition. In this example, computing systems MPC1 and MPC2 can store, for a stored digital component, a set of one or more user group identifiers corresponding to the digital component. These user group identifiers identify the user groups for which the stored digital component can be provided. That is, the stored digital component is only a candidate for a digital component selection process that is performed to select a digital component to provide to a user that is a member of at least one of the user groups identified by the set of one or more user group identifiers for the stored digital component.

[0050] Another example condition for stored digital components is a frequency cap condition that indicates that a digital component or a particular category of digital components can only be provided to the same user a maximum number of times within a given duration. Another example condition for digital components is a blocked digital component condition that indicates that a digital component has been blocked by a user, e.g., muted. For these example conditions, the computing systems MPC1 and MPC2 can receive from storage, for each of the plurality of users, a probabilistic data structure, e.g., a cuckoo filter or a Bloom filter, that represents digital components that cannot be provided to the user. For example, the probabilistic data structure can represent universal identifiers of digital components that are directly blocked by the user or blocked by the user due to exceeding a frequency of the digital component being displayed to the user during a given duration.

[0051] The computing systems MPC1 and MPC2 can receive the probabilistic data structure from the user's client device 110, e.g., in encrypted form to prevent the computing systems MPC1 or MPC2 from accessing the identifiers in plaintext. For example, an application 112 running on the user's client device 110 can generate a Bloom filter that represents identifiers of blocked digital components that are blocked due to a frequency cap or blocked by the user. The application 112 can then provide data to each of the computing systems MPC1 and MPC2 that enables the computing systems MPC1 and MPC2 to collaboratively query the Bloom filter using a secure MPC process to determine for the user whether a given digital component is blocked. The computing systems MPC1 and MPC2 use the secure MPC process to compute a secret share of the blocked digital component condition. See Figure 8 Example processes for generating and querying a Bloom filter are described.

[0052] In some implementations, identifiers for blocked digital components can be included in the same probabilistic data structure as the user group identifier and queried using different hash functions. However, the target false positive rate for blocked digital components can be lower than the false positive rate for the user group identifier. Thus, a Bloom filter for blocked digital components can be generated and queried using fewer hash functions than the user group identifier. To reduce the data size of the Bloom filter for blocked digital components, the user group identifier can be represented by a different Bloom filter than the blocked digital components. This reduces latency for sending the Bloom filter over a network, reduces bandwidth consumed for sending the Bloom filter, and reduces battery power usage for sending the Bloom filter.

[0053] Another example condition for a stored digital component is a pacing condition that adjusts the pace at which a digital component is distributed over a duration of time. Computing systems MPC1 and MPC2 can be able to store data indicating a total number of times a digital component can be able to be provided over a duration of time and / or a maximum budget for the digital component over the duration of time. Computing systems MPC1 and MPC2 can use this information to adjust the pace at which a digital component can be a candidate for a digital component selection process based on this condition (e.g., all conditions for a digital component that a digital component that will be a candidate will have to satisfy). In some implementations, computing systems MPC1 and MPC2 can implement a feedback controller, e.g., a proportional-integral-derivative (PID) controller, to adjust the pace of stored digital components with a pacing condition using secret shares.

[0054] In this example, computing systems MPC1 and MPC2 can store a setpoint for a PID controller for a digital component and maintain a measured variable for the PID controller for the digital component. Generally, a PID controller is a feedback controller that uses an error value that is the difference between a target setpoint and a measured variable to determine an output that drives the measured variable toward the setpoint. In the context of adjusting the pace at which a digital component is distributed to client devices, the active setpoint can be an impression rate, an interaction rate, a conversion rate, and / or a resource depletion rate (e.g., a budget spend rate). Similarly, the measured variable can be an impression rate, an interaction rate, a conversion rate, and / or a resource depletion rate over a given duration of time. Computing systems MPC1 and MPC2 can also store a tuning parameter for each PID controller. The setpoint, the measured variable, and the tuning parameter can be stored in secret shares (each computing system MPC1 and MPC2 stores a corresponding share of each parameter) or in plaintext, depending on the target privacy / data security.

[0055] Another example condition is a k-anonymity condition. A k-anonymity condition can include a k-anonymity rule that requires a digital component to qualify (or will be selected) to be distributed to at least k users over a given duration of time. The concept of k-anonymity ensures that data for a particular user is indistinguishable from a threshold number k of other users’ data. The system can implement the k-anonymity rule, for example, by ensuring that a particular digital component is distributed to a client device 110 in response to a request for one or more digital components and the same digital component can have been or been displayed to a group of at least K users or by at least K applications 112 over a particular time period. In some implementations, each of the k applications 112 to which the digital component can have been or been distributed must be for a different user. In this example, computing systems MPC1 and MPC2 can store a value k for a digital component and maintain a number of users to which the digital component can have been distributed.

[0056] Determining the number of users for which a digital component can have been displayed can include performing an anti-factual digital component selection process in parallel with each actual digital component selection process. In this anti-factual digital component selection process, all digital components can be candidates if they satisfy all conditions except the k-anonymity condition. If a digital component is selected for at least k users or applications 112 in the anti-factual digital component selection process, the digital component would have been displayed to the k users if not for the k-anonymity condition. Once this occurs, digital components that satisfy the k-anonymity condition can be included in the actual digital component selection process (assuming other conditions for the digital component, if any, are satisfied), which does not include digital components with unsatisfied k-anonymity conditions.

[0057] In some implementations, each computing system MPC1 and MPC2 stores information for digital components in a data structure that maps digital components and their respective information to sets of contextual signals. For example, each digital component can be eligible for display in a presentation environment having a resource and / or application that includes a set of contextual signals. The contextual signals can include, for example, a topic of the resource, keywords found in the resource, a resource locator for the resource, a geographic location of the client device 110, a spoken language setting of the application 112, a number of digital component slots for the resource, types of digital component slots, and / or other appropriate contextual signals. Additionally, a digital component can have multiple corresponding selection values, each for each set of contextual signals. Using such a data structure enables the computing systems MPC1 and MPC2 to identify digital components that qualify for a digital component selection process. The computing systems MPC1 and MPC2 can then use conditions to identify, from these qualifying digital components, digital components that are actual qualifying candidates for selection in a digital component selection process. The sets of contextual signals used in determining whether a digital component qualifies can be in the form of lookup keys that enable the computing systems MPC1 and MPC2 to use contextual signals of a digital component request to look up qualifying digital components.

[0058] When digital components are associated with corresponding user group identifiers that identify qualifying groups of users for the digital components, a lookup table (LUT) can be used to store the information. Using a LUT can provide some performance advantages, but other appropriate data structures can also be used. The LUT maps sets of contextual signals or lookup keys derived from sets of contextual signals to sets of digital components that are eligible for display and / or for which selection values or vectors are qualified, subject to other conditions described in this document. In this way, the computing systems MPC1 and MPC2 can store multiple selection values for each digital component, e.g., each for each set of contextual signals.

[0059] In some implementations, the lookup key is a hash-based message authentication code (HMAC) of the contextual signals. For example, the lookup key can be HMAC(URL, HMAC(language, location)), where the parameter URL is the URL of the resource for which the digital component and selection value are eligible, the parameter language is the specified spoken language of the application 112 for which the digital component and selection value are eligible, and the parameter location is the geographic location for which the digital component and selection value are eligible. If the contextual signals requested by the digital component match these parameters, then the digital component and selection value mapped to the lookup key are eligible for the digital component selection process used to select a digital component in response to the request. Other contextual signals can be used in addition to or instead of the URL, location, and language.

[0060] To reduce the amount of bandwidth and latency consumed by transmitting digital component requests over the network 105, the application 112 can use the same HMAC to compute the lookup key instead of sending the contextual signals to the computing systems MPC1 and MPC2. This also reduces the amount of battery consumed by the client device 110 and the amount of data received by each computing system MP1 and MPC2.

[0061] In some implementations, a two-level LUT table is used, for example, when the digital component is conditioned on the user’s user group membership. The first level can be keyed by the request key (UG_Request_Key). The UG_Request_Key can be a lookup key in the form of a composite message based on a set of contextual signals, for example, the set of contextual signals for which the digital component request (e.g., URL, location, language, etc.) or the set of contextual signals for which the digital component is eligible for distribution. That is, the first level LUT can be keyed based on the set of contextual signals. The key of the first level can be, for example, a hash of the UG_Request_Key using a hash function such as SHA256. The key can be truncated to a specified number of bits, for example, 16 bytes, or another appropriate number of bits. The value for each key UG_Request_Key in the first level LUT can indicate a row of a second level LUT that includes data for digital components eligible for digital component requests for which the contextual signals included in the UG_Request_Key. An example first level LUT is shown in Table 1 below.

[0062] Key Value SHA256(UG_Request_Key) Line... … Line...

[0063] Table 1

[0064] The second stage LUT can be keyed based on a combination of the user group request key UG Request Key and the user group identifier in the first stage LUT. In some implementations, the second stage LUT can be an array or other suitable data structure. Each row in the second stage LUT can be for a particular selection value (or vector of values) of a particular digital component. For example, the DSP 150 can submit different selection values for the same digital component, with each selection value for a different set of contextual signals and / or a different user group identifier. Thus, the selection value of a digital component can vary based on the context and user group membership of the user performing the digital component selection process.

[0065] The DSP 150 or digital component provider 160 can associate — e.g., link or map — a digital component to a user group that the DSP 150 or digital component provider wants to display the digital component to. For example, the DSP 150 can want to display a digital component related to fly fishing to men who have shown an interest in fly fishing. In this example, the DSP 150 can provide data to the MPC cluster 130 indicating that the digital component corresponds to a user group identifier for a user group that includes men who have shown an interest in fly fishing.

[0066] In some implementations, the key for a row in the second stage LUT can be a hash or code generated based on a combination of the user group request key UG Request Key and the user group identifier for the digital component of the row. For example, the key can be an HMAC of the combination, which can be represented as HMAC SHA256 (UG Request Key, ug id). The user group identifier ug id can be based on a combination of an internal user group identifier for the user group and the domain of the owner of the user group (e.g., the DSP, SSP, or digital component provider that owns the user group). For example, the user group identifier ug id can be a digital digest of the eTLD+1 of the owner domain and the internal user group identifier of the owner of the user group for the user group. The eTLD+1 is the effective top-level domain (eTLD) plus one level more than the public suffix. An example eTLD+1 is "example.com," where ".com" is the top-level domain. The ug id can be truncated to 16 bytes or another suitable data size.

[0067] Continuing the previous fly fishing example, the second-level lookup key that includes the row of information to be displayed to the user in the men's fly fishing group for the digital component can be a combination of the user group request key UG_Request_Key and the user group identifier ug_id for the men's fly fishing group. Since the digital component can be presented in different contexts, the second-level lookup table can include multiple rows for the digital component associated with the user group identifier ug_id for the men's fly fishing group, each row having a different user group request key UG_Request_Key and a different value.

[0068] The value for each row of the second-level LUT can be a selection value (or vector of values) for the digital component and other data for the digital component, such as metadata identifying the digital component or a network location from which the digital component can be downloaded, etc. In some implementations, the row can contain the digital component itself ready for presentation by the application 112, e.g., in a web package format.

[0069] The value can be a digital component information element dc_information_element, which can be a byte array having the selection value and the metadata. The byte array can have a particular format that the application 112 or trusted program of the client device 110 and the computing systems MPC1 and MPC2 can parse to obtain the selection value and the metadata. In some implementations, the digital component information element can include the digital component itself. An example second-level LUT is shown in Table 2 below. When a vector is used to determine the selection value, the selection value can be replaced by the vector in Table 2.

[0070] Key Value HMAC(UG_Request_Key, UG_ID) {select value, metadata} … …

[0071] Table 2

[0072] The second-level LUT maps the selection value to a particular digital component, a particular user group identifier ug_id, and a particular set of context signals defined by the first-level lookup key UG_Request_Key. By doing so, the second-level LUT indicates that the selection value for the digital component is for a particular context of the digital component slot for which it qualifies. This allows the DSP 150 or the digital component provider 160 to specify different selection values for the same digital component for different contexts defined by the context signals and the group membership of the user. When a digital component request is received that indicates that the user to whom the digital component is to be displayed is a member of a particular user group identified by a particular user group identifier ug_id and that the digital component is to be displayed in a particular context defined by the context signals of the first-level lookup key, any digital component in the second-level LUT that has a matching user group identifier and a selection value that matches the first-level lookup key for that row is a candidate for selection for distribution in response to the request.

[0073] Further to the descriptions throughout this document, a user can be provided with controls (e.g., user interface elements with which the user can interact) that allow the user to make an election as to whether and when the collection of user information about the user’s social network, social actions or activities, profession, a user’s preferences, or a user’s current location are enabled, as well as whether the user is sent content or communications from a server that is likely to be of greater relevance to the user drawn from the user information. Additionally, certain data can be treated in one or more ways before it is stored or used, so that personally identifiable information is removed. As an example, a user’s identity can be treated so that no personally identifiable information can be determined for the user, or a user’s geographic location can be generalized where location information is obtained (such as to a city, postal code, or state level), so that a particular location of a user cannot be determined. Thus, the user can have control over what information is collected about the user, how that information is used, and what information is provided to the user.

[0074] Figure 2 An exemplary data flow within the environment 100 is shown. Figure 1 The description includes two types of selection values: selection values that are conditioned on sensitive user information such as user group membership or other business sensitive information, or selection values that are conditioned on parameters whose values can allow an unscrupulous party to infer sensitive information, or “conditional selection values”; and selection values that are not conditioned on sensitive information, or “unconditional selection values.” To protect user privacy, the conditions for “conditional selection values” are evaluated within the MPC cluster 130, rather than within the SSP 170 or the DSP 150, to determine whether the “conditional selection values” are candidates for the content selection process.

[0075] This structure allows the MPC cluster 130 to protect user privacy and business confidential information, and to demonstrate its trustworthiness to application providers, such as the provider of the application 112. In this example, the MPC cluster 130 relies on a secure two-party computation (2PC) architecture that applies cryptographic techniques to guarantee that there is no leakage of confidential user data or business confidential information if at least one of the two computing systems of the MPC cluster 130 is honest. If the MPC cluster 130 includes more than two computing systems, the current MPC protocol can be extended, or other MPC protocols can be used.

[0076] The MPC cluster 130 runs a secure 2PC protocol to evaluate and apply the conditions for selection candidate digital components, implements a selection process to select digital components based on selection values, and receives impression notifications to update parameters on which those conditions depend. All of these processes can be done using secret share techniques. Reference is made to Figure 3 The protocol is described in detail.

[0077] In Stage A, the application 112 sends a request for a digital component to the MPC cluster 130, for example in cooperation with a triggering element from a content platform such as the SSP 170. The application 112 can include multiple requests for digital components together as one combined request to fetch multiple digital components. The MPC cluster 130 can then independently service each of the requests in the combined request, or make one or more selection decisions holistically. In this example, the request is for a single digital component, and includes a request for a digital component selected based on sensitive information or a digital component not selected using sensitive information. The MPC cluster 130 can respond to the request by selecting a particular digital component that corresponds to a particular selection value from a set of selection values that are each mapped to a corresponding particular digital component. These selection values can be selection values previously cached or otherwise stored at the MPC cluster 130 and / or selection values generated by a platform such as the DSP 150 or SSP 170, just-in-time (JIT) selection values. JIT selection values are generated on the fly in response to a need, and improve efficiency and reduce waste because the selection value is only generated when the digital component is needed. For example, a JIT selection value can be generated when a digital component slot becomes available - which is indicated by the receipt of a request for a digital component. Thus, the MPC cluster 130 can select a digital component from a set of digital components that includes stored digital components whose information is stored at the MPC cluster 130 and digital components for which JIT selection values are received for a current digital component request.

[0078] In some implementations, two or more vectors can be used to determine a selection value for a digital component. The MPC cluster 130 can store, for a digital component, a first vector of values that can be used to determine a selection value for that digital component. The first vector of values can be specific to one or more user groups, for example, that can be used to determine a selection value for a digital component when selecting the digital component for a user that is a member of the one or more user groups. Thus, the first vector of values can also be referred to as a user group-based vector. The user group-based vector can include multiple elements across two or more dimensions, and each element can represent a particular characteristic of a digital component presentation opportunity. For example, a user group-based vector of values can include elements for a geographic location or region, a spoken language, an age or age range, a particular URL of a web page or other electronic resource, a particular product or service, whether a digital component slot is above or below the fold, a type of digital component slot, a size of a digital component slot, a number of digital component slots on an electronic resource, a time of day, a web property identifier, and / or other appropriate characteristics of a digital component presentation opportunity. In some implementations, for example in implementations employing neural networks, the user group-based vector of values can be an embedding of a user group in some abstract vector space.

[0079] The value of each element can reflect an amount by which the selection value of the digital component is increased or decreased based on the current digital component presentation opportunity having a characteristic corresponding to the element. For example, if the DSP 150 wants to display the digital component to users in Atlanta rather than users in Dallas, the value of the element for Atlanta can be a positive value higher than the value one, and the value of the element for Dallas can be a positive value lower than one, such as zero or a negative value. As described in more detail below, the values of the vector of user groups can be part of a vector dot product calculation to determine the selection value of the digital component.

[0080] The request contains information used in the digital component selection process, including potentially sensitive information, such as a user group identifier of a user group to which the application 112 is mapped or otherwise associated, and non-sensitive information, such as a contextual signal from the application 112 regarding the context of the digital component to be presented and / or displayed. As described in further detail below, the design of the system 110 improves protection of user data that can be sensitive or confidential.

[0081] The trigger element can be, for example, a tag that detects the presence of a digital component slot within an internet location accessed by the application 112. The trigger element can be placed, for example, at the internet location and can inform the application 112 of the presence of a digital component slot for which a digital component should be requested.

[0082] In Stage B, the MPC cluster 130 transmits a digital component request to the SSP 170 that is based on non-sensitive information, such as the contextual signal. This request is referred to as a “contextual request.” The contextual request can contain various contextual signals and non-sensitive user information that are collected directly by the internet location (e.g., content publisher) that triggered the request for the digital component. For example, the contextual signals can include analytics data, language settings, and other data that help the content publisher provide a good user experience. However, the contextual request provided to the SSP 170 does not include sensitive information, such as a user group identifier.

[0083] In Stage C, the SSP 170 forwards the contextual request to one or more DSPs 150. In this specific example, the SSP 170 forwards the contextual request to a single DSP 150 for simplicity. For example, the SSP 170 can forward the contextual request to the DSP 150. In this example, the DSP 150 has a digital component and a selection value mapped to the digital component, or can determine a selection value for the digital component using the contextual signal.

[0084] In stage D, the one or more DSPs 150 return selection values in response to the context request. For example, the DSPs 150 return one or more selection values that map to the digital component in response to the context request. The DSPs 150 can return any number of selection values in response to the context request. In some implementations, the DSPs 150 can additionally return selection values in response to the digital component request based on sensitive information such as user group information. These selection values are “conditional selection values” because they are conditioned on sensitive information, and thus on the MPC cluster 130 receiving a request that includes sensitive information that matches the sensitive information on which the selection values are conditioned. For each selection value provided by the DSPs 150, the DSPs 150 include information such as a time-to-live (TTL) parameter, i.e., a maximum time span for which the MPC cluster 130 can cache the selection value. The TTL parameter enables the MPC cluster 130 to cache the selection values received from the DSPs 150. In some implementations, without the TTL parameter, the MPC cluster 130 does not cache the received selection values, but instead discards the selection values after they have been used in the selection process, e.g., in the selection process corresponding to the digital component request transmitted in stages A, B, and C.

[0085] When vectors are used to determine selection values, the DSPs 150 can generate and return a second vector of values. The DSPs 150 can generate the second vector of values based on the context signals of the digital component requests transmitted in stages B and C. The second vector can be referred to as a context vector. The context vector can include the same elements corresponding to the same features as the user group-based vector. However, the DSPs 150 can determine the values of the context vector for the current digital component request based on the context signals of the digital component request. In contrast, the values of the user group-based vector of the DSPs 150 are stored with the MPC cluster 130 and determined in advance, e.g., based on the user group(s) corresponding to the user group-based vector.

[0086] For each DSP 150 that provides a context vector, the MPC cluster 130 can determine the selection values for each stored digital component of the DSP 150 by determining the dot product of the user group-based vector and the context vector provided by the DSP 150. If the DSP 150 has multiple user group-based vectors stored by the MPC cluster 130, e.g., each vector for a different digital component, then the MPC cluster 130 determines the dot product of the context vector and the user group-based vector for each user group-based vector.

[0087] In some implementations, a third vector can be used based on the user profile of the user for which the digital component request is submitted. This vector can have the same dimensions and features as the other vectors, but with values based on the user profile of the user.

[0088] For example, if the user is in Austin, the value for the location element for Austin in the user profile vector can have a positive value, or if the user is not in Austin, it can have a negative or zero value; if the publisher content currently being displayed to the user is highly relevant to Austin, the value for the same location element in the context vector can have a positive value; if the digital component is relevant to Austin, the value for the same location element in the user group based vector for the digital component is positive. To compute the dot product of the three vectors, the computing systems MPC1 and MPC2 first perform element-wise multiplication among the corresponding elements from each of the three vectors, and then sum the results. For example, assume the three vectors are V1 = {v 1,1 ...v 1,n}, V2 = {v 2,1 ...v 2,n}, and V3 = {v 3,1 ...v 3,n}, the dot product among the three vectors will be

[0089] In stage E, the SSP 170 applies the content selection rules to the digital component corresponding to the conditional selection values. As described above, these conditions can be based on user group identifiers, frequency controls, blocked (e.g., muted) digital components, pacing, and / or k-anonymity.

[0090] The SSP 170 also applies selection value rules to determine, for example, how the selection values affect the post-publication value for a particular content provider. The post-publication value can indicate, for example, the amount provided to the publisher 140 for displaying the digital component with the publisher’s 140 resources or application content. The SSP 170 then performs a selection process to determine the highest unconditional selection value, i.e., the unconditional selection value that yields the highest post-publication value. The unconditional selection values are not conditioned on sensitive information, and thus can be applied by the SSP 170, rather than by the MPC cluster 130, with content selection rules such as budget and pacing rules, advertiser and digital component exclusions. The SSP 170 then forwards to the MPC cluster 130 all selection values that enable caching in the MPC cluster 130 (selection values with TTL values) and all selection values with a post-publication value that is not less than the post-publication value of the highest unconditional selection value as JIT selection values.

[0091] In stage F, the MPC cluster 130 updates its cache with the received cache-enabled (i.e., with TTL values) JIT selection values. In addition, the MPC cluster 130 applies selection rules, such as user group membership rules, frequency controls, pacing rules, and rules to prevent a particular user from being precisely targeted to all selection values received in stage E and to previously cached selection values, to select valid candidates for the selection process. The rules can include, among other factors, limits and guidelines on the manner or frequency of distribution of digital components. The rules include frequency controls, muting, resource consumption, and pacing constraints. In some implementations, JIT digital components with conditions evaluated by the MPC cluster 130 can be ignored for the current digital component selection process. For example, ignoring these digital components for the current selection process can provide performance benefits, e.g., reduced latency in selecting and serving digital components. The MPC cluster 130 then runs a final selection process among all eligible candidates, selects a winning selection value, and then returns data for the digital component mapped to the winning selection value to the application 112 in response to the digital component request.

[0092] In stage G, the digital component mapped to the winning selection value is rendered by the application 112. The application 112 then provides an impression notification to the MPC cluster 130. The impression notification includes data that allows the MPC cluster 130 to update information related to update parameters that allow the MPC cluster 130 to enforce selection rules for future digital component requests received, e.g., in subsequent occurrences of stage A. In some implementations, the application 112 can send the impression notification G to the MPC cluster 130 by piggybacking on top of future component request A to reduce the number of network communications and battery / bandwidth consumption of the mobile device, as well as processing / computing cost of the MPC cluster 130.

[0093] Figure 3 is a swim lane diagram of an example process 300 for selecting a digital component for distribution to a client device. The operations of the process 300 can be implemented, for example, by the client device 110, the computing systems MPCi and MPC2 of the MPC cluster 130, and the DSP 150. The operations of the process 300 can also be implemented as instructions stored on one or more computer-readable media, which can be non-transitory, and execution of the instructions by one or more data processing apparatuses can cause the one or more data processing apparatuses to perform the operations of the process 300. Although the process 300 and other processes below are described in terms of two computing systems, the MPC cluster 130, a MPC cluster with more than two computing systems can also be used to perform similar processes. In addition, the operations of the process 300 can be implemented by the SSP 170.

[0094] The example process 300 can include variations, such as tiers, boosts, a first value selection process (e.g., a first price auction), a second value selection process (e.g., a second price auction), and a floor price. Reference is made to Figure 3 to Figure 5 Each of these variations is described.

[0095] In general, a boost is an amount by which a selected value of a digital component is adjusted. For example, when a digital component is selected for display with one of the publisher’s resources 145 or application content, the content publisher can instruct the SSP 170 to give a particular DSP 150 a boost of a specified amount “x.” If the DSP 150 submits a selection value of “y,” then the selection value used in the digital component selection process will be x + y. However, if the digital component is selected, then the DSP 150 will only be required to provide an amount no greater than y in the first or second selection value process. In the process 300, the MPC cluster 130 can apply boosts to selection values according to information provided by the SSP 170. For example, each SSP 170 can provide information mapping boosts to pairs of DSPs 150 and publishers 140. That is, the information can indicate that for a digital component selection process in which a digital component is being selected for display with content of a particular publisher, the selection value of a particular DSP should be boosted by a particular amount. In some implementations, the SSP / publisher can support a more granular level of boosts. For example, for each lookup key (e.g., for each set of contextual signals), the SSP / publisher can specify a boost.

[0096] The SSP 170 can instruct the secure MPC cluster 130 to divide the DSPs 150 into multiple tiers with different priorities. Rather than selecting a digital component in the digital component selection process that corresponds to the highest selection value among all candidate digital components, a digital component with the highest selection value in the highest priority tier is selected. To illustrate, consider an example in which there are two tiers - a highest tier and a lowest tier. If there is one or more candidate digital components in the highest tier, then the candidate digital component with the highest selection value in the highest tier will be selected, even if the candidate digital components in the lowest tier have selection values higher than the selection values of all of the candidate digital components in the highest tier.

[0097] The main difference between the first and second value selection processes is the clearing amount of the selected digital component. The clearing amount is the amount that needs to be provided by the DSP 150 to the publisher 140 and / or SSP 170 to display the digital component. The same digital component will be selected using both processes. In the first value selection process, the DSP 150 will be required to provide the publisher 140 and / or SSP 170 with an amount equal to the selection value submitted by the DSP 150. In the second value selection process, the DSP 150 will instead be required to provide an amount based on the next highest selection value. If the tier is used with the second selection value process, the next highest value will be the next highest value in the same tier as the selected digital component. If no such candidate digital component exists in the same tier, the next highest value can be the minimum value of the digital component selection process.

[0098] The selection value floor can indicate the minimum selection value that the publisher 140 is willing to accept to display a digital component. The publisher 140 can specify a selection value floor for various DSPs 150, for each category of digital component (e.g., one floor for digital components related to cars and another floor for digital components related to gardening), for each digital component provider 160, for each brand, for each page on the publisher’s site, for each digital component slot, for a group of digital component slots, and / or for other types of groups of digital components. In some implementations, the SSP 170 can set the floor in advance on behalf of the publisher 140, or request the setting of the floor for each digital component, e.g., for Tier A.

[0099] The DSP 150 provides the selection value and additional information (e.g., selection criteria such as conditions) for the digital component to the MPC cluster 130 (302). In some implementations, the DSP 150 provides the selection value and additional information to the MPC cluster 130 via an SSP (not shown in FIG. 3 for brevity). For example, the DSP 150 can provide the selection value and additional information in response to a digital component request, and specify the digital component corresponding to the selection value as a stored digital component that should be stored at the MPC cluster 130. Figure 3

[0100] The MPC cluster 130 can store the selection value and selection criteria for future digital component requests received from the client device 110. For each digital component, the DSP 150 can also upload additional data for the digital component, such as metadata. The additional information for the digital component can include one or more conditions (and parameters of the condition(s)) that must be satisfied in order for the digital component to be included in the digital component selection process. For example, the additional information can include one or more user group identifiers for a user group corresponding to the digital component.

[0101] ​The additional information for the digital component can include a context selection signal indicating a context for which the digital component is eligible, e.g., a location of the client device 110, a spoken language selected for the application 112, a URL of a resource at which the digital component can be presented, and / or an excluded URL of a resource at which the digital component cannot be presented. The additional information for the digital component can also identify the digital component, e.g., using a unique identifier, a domain from which the digital component can be obtained, and / or other appropriate data for the digital component. The additional information can be included as metadata for the digital component.

[0102] In some implementations, the MPC cluster 130 caches or otherwise stores selection values, selection criteria, and other information for digital components provided to the MPC cluster 130 for digital component requests. In this example, the context signal for the digital component and the selection value can include the context signal included in the digital component request. As described above, the selection values and metadata can be stored in a two-level LUT.

[0103] In some implementations, the DSP 150 can provide a user group-based value vector for a digital component instead of providing a static selection value for the digital component. In such an example, the user group-based value vector can be stored in place of the selection value.

[0104] The client device 110 receives content (304). For example, the client device 110 can receive an electronic resource (e.g., a web page) for display by a web browser or application content for display by a native application. The content can include one or more digital component slots that include computer-readable code, e.g., a script, that when executed causes the client device 110 to request a digital component for each slot. The client device 110 can render the content on a display of the client device 110.

[0105] The client device 110 identifies a set of user group identifiers (306). The set of user group identifiers can be user group identifiers of user groups of which the user is a member. For example, the set of user group identifiers can be user group identifiers in a user group list. The application 112 that renders the content or the trusted program can identify the set of user group identifiers, e.g., by accessing the user group list from a secure storage of the client device 110.

[0106] The client device 110 generates a probabilistic data structure (308). To securely and efficiently generate a digital component request based on sensitive information, the application 112 can use a probabilistic data structure, such as a cuckoo filter or a Bloom filter. In this example, the probabilistic data structure is a cuckoo filter. See Figure 8An example of using a Bloom filter is described. In general, a cuckoo filter includes an array of buckets, where each bucket can hold b fingerprints. A fingerprint of an item is a bit string derived from a hash of the item. A cuckoo filter uses n hash functions that allow an item to be placed in n different buckets in any of b locations. In general, a cuckoo filter is identified by the number of fingerprints in each bucket and the number of buckets. For example, a (2, 4) cuckoo filter has 2 buckets, and each bucket in the cuckoo array can store up to 4 fingerprints. Thus, the total capacity of the cuckoo filter is 2 x 4 or 8 fingerprints.

[0107] Depending on the configuration of the cuckoo filter, an item can be inserted into a cuckoo filter in one of N possible locations, e.g., N = 2. The application 112 uses N pseudo-random functions (PRFs) to determine all possible locations for an item to be inserted, parameterized by a user group identifier or an identifier from a set of blocked identifiers and by either of two random variables generated by the application 112. For example, assume that the two random variables generated by the application 112 are rand_varla and rand_varlb. In some implementations, the application 112 and the MPC cluster 130 agree on the PRF in advance, where PRF(x, y) e [0, 2 k -1], where k is the number of bits in each item in a bucket of the cuckoo filter.

[0108] Each location of the cuckoo filter can be occupied by a user group identifier or a blocked identifier, or be empty. A blocked identifier is an identifier of a digital component that the application 112 is controlling to be blocked, e.g., based on frequency, or an identifier of a digital component that the user selected to block for a user group. The application 112 can generate a cuckoo filter table whose elements are PRF(ug_id, rand_varla), PRF(blocked_uid, rand_varlb), and 0, where ug_id is an identifier of a user group generated by applying HMAC to a label of the user group based on the domain of the content provider, blocked_uid is an identifier from a set of blocked identifiers, and 0 represents an empty entry. The process is repeated for all user group identifiers. In some implementations, the same probabilistic data structure, e.g., a cuckoo filter or a Bloom filter, can store both user group identifiers and blocked identifiers. In other implementations, user group identifiers and blocked identifiers are stored in dedicated probabilistic data structures.

[0109] The application 112 can generate a vector B based on the cuckoo filter tables generated for user group identifiers and / or blocked identifiers. Each value B i in the vector B can be represented as Bi = (A i - PRF(rand_var2, i)) mod p, where A is the cuckoo filter table, and i is an index of vector B and the cuckoo filter table A. When the application 112 initiates a request for a digital component for a digital component slot, the application 112 transmits rand_varla, rand_varlb, and rand_var2 as parameters of the request to the computing system MPCi. The application 112 also transmits vector B, rand_varla, and rand_varlb as parameters of the request to the computing system MPC2. PRF(rand_var2, i) and B i are two additive secret shares of A p in A i held by the computing systems MPCi and MPC2, respectively. Because neither computing system MPCi nor MPC2 has access to both secret shares, neither computing system can recreate the cuckoo filter table, thereby protecting user privacy.

[0110] The client device 110 transmits a digital component request including parameters for a cuckoo filter to the MPC cluster 130 (310). For example, the client device 110 can transmit a digital component request including rand_varla, rand_varlb, and rand_var2 to the computing system MPCi. The client device 110 can also transmit a digital component request including vector B, rand_varla, and rand_varlb to the computing system MPC2. Both digital component requests can also include contextual signals, e.g., a URL of an electronic resource, a number of digital component slots for the resource, a geographic location of the client device 110, and / or other appropriate contextual signals that can be used to select a digital component, e.g., a lookup key.

[0111] The MPC cluster 130 transmits a contextual digital component request to the SSP 170 (312). The digital component request can include the contextual signals, but not sensitive user data such as a user group identifier identifying a user group including the user as a member. In some implementations, the contextual digital component request is generated by a tag of the SSP on a publisher page rendered on the client device 110. The application 112 sends the contextual digital component request to the SSP 170 via the MPC cluster 130 over the digital component request sent in operation 310. In some implementations, the application 112 encrypts the contextual digital component request using a public key of the SSP 170 and sends the encrypted contextual digital component request to the SSP 170 over the digital component request sent in operation 310, so that no one but the SSP 170 can decrypt the contextual digital component.

[0112] The SSP 170 transmits the contextual digital component request to one or more DSPs 150 (314). Each DSP 150 can respond to the request with one or more conditionally selected values for a digital component and / or one or more unconditionally selected values for a digital component. For each digital component, the response can include data identifying the digital component, a selection value for the digital component, and metadata (or other additional information) for the digital component. For example, the response can include a digital component information element dc_information_element for each digital component. Each DSP 150 can select one or more digital components to include in the digital component selection process based on the contextual signal and determine or identify a selection value for each selected digital component. In some implementations, the DSP 150 can generate a contextual vector for each of the one or more digital components based on the contextual signal.

[0113] Each DSP 150 can transmit its response to the SSP 170 (316). The SSP 170 can transmit the responses to the MPC cluster 130 (318). In some implementations, the SSP 170 can apply one or more floor prices to the digital component selection process before transmitting the responses to the MPC cluster 130. The SSP 170 can apply the floor price(s) based on the publisher 140 for which the digital components are being selected. As described above, the publisher 140 can specify floor prices for DSPs 150, categories of digital components, digital component providers 160, brands, and / or other types of groups of digital components.

[0114] The SSP 170 can identify floor prices specified by the publisher 140 and apply them to the selection values received from the DSPs 150. If a selection value is less than a corresponding floor price, the SSP 170 can remove the selection value from the digital component selection process, e.g., by not providing the selection value to the MPC cluster 130. For example, assume that the publisher 140 specified a floor price of five units for a given digital component provider 160. If a DSP 150 provides a selection value of four units for a digital component of the given digital component provider 160, the SSP 170 can filter the selection value from the digital component selection process.

[0115] As described above, the DSPs 150 can provide selection values for stored digital components that are to be stored for future use in digital component processing. If these selection values do not satisfy the corresponding floor price(s), the digital components and their associated selection values are not stored at the MPC cluster 130 because the SSP 170 does not forward them to the MPC cluster 130.

[0116] In some implementations, the MPC cluster 130, rather than the SSP 170, implements the floor price, or the MPC cluster 130 implements the floor price in addition to the SSP 170. When the MPC cluster 130 computes the dot product of vectors when the vectors are used to determine selection values, the MPC cluster 130 is able to implement the floor price on those selection values. The MPC cluster 130, rather than the SSP 170, is also able to implement the floor price on, for example, static selection values.

[0117] The MPC cluster 130 performs a secure MPC process to select a digital component to provide for display at the client device 110 (320). The selection can include, for example, identifying a set of digital components eligible for the digital component selection process and their corresponding selection values based on the contextual signals using a lookup key, such as the first-level lookup key described above with reference to FIG. 2. This can also include identifying candidate digital components from the set of digital components as candidates for selection. The candidate digital components can include unconditional digital components for which the DSP 150 provides selection values and conditional digital components that satisfy each of the conditions of the digital component. The conditional digital components are only considered candidates for the digital component selection process when all of the conditions of the digital component are satisfied. Figure 1

[0118] The MPC cluster 130 can select, from the candidate digital components, a digital component to provide to the client device 110 in response to the digital component request based on the selection values of the candidate digital components. For digital components with selection values determined using vectors, the MPC cluster 130 can determine the selection value of the digital component by determining the dot product of the vectors, for example, the user group vector, the contextual vector, and optionally the user profile vector.

[0119] In selecting the digital component, the MPC cluster 130 can also consider any tiers or boosts of the digital component. As described above, the publisher 140 can establish tiers and / or boosts for the DSP 150 and / or the digital component provider 160. When the publisher 140 for which the digital component is being selected has established a boost, the MPC cluster 130 (or the SSP 170) can adjust the selection value of the digital component of the DSP 150 and / or the digital component provider 160 using the corresponding boost specified by the publisher 140. If vectors are used to determine the selection value, the MPC cluster 130 can adjust the selection value after it is determined by computing the dot product of the vectors.

[0120] ​When using tiers, the MPC cluster 130 can perform the selection process for each tier sequentially or in parallel, e.g., from the highest priority tier to the lowest priority tier. The MPC cluster 130 can select the digital component, including at least one candidate digital component, with the highest selection value in the highest priority tier. For example, if none of the digital components in the highest priority tier are candidates, e.g., that satisfy all conditions for their inclusion in the digital component selection process, the MPC cluster 130 selects a candidate from the next highest priority tier that includes a candidate.

[0121] The MPC cluster 130 can perform the selection process for each tier in parallel to improve the speed of performing the selection process. In this way, if there are no candidates in the highest priority tier, the MPC cluster 130 has already begun and can have completed the selection process for each other tier so that a final digital component can be selected.

[0122] The MPC cluster 130 can perform the selection process sequentially from the highest priority tier to the lowest priority tier. If speed is less critical, this can reduce wasted computation performed for lower priority tiers if a higher priority tier includes a candidate digital component. An example process for selecting a digital component using secure MPC processes is shown in Figure 4 and described below.

[0123] The MPC cluster 130 sends the secret shares of the selection result to the client device 110 (322). In some implementations, the MPC cluster 130 can also send the selection process identifier for the digital component selection process to the client device 110. The selection process identifier can uniquely identify the digital component selection process for which the selection result was generated. For example, the computing systems MPCi and MPC2 can each request a respective selection process identifier SPID for each digital component for which the computing systems MPCi and MPC2 perform the selection process to generate the selection result to provide to the client device 110. In some implementations, the selection process identifier SPID can be a random number or an opaque alphanumeric or numeric sequence.

[0124] The MPC cluster 130 can also store data for the selection value as part of the selection process keyed by or otherwise linked to the SPID. For example, the computing system MPCi can store a table or other data structure including data for the selection value with a key based on the SPIDi generated by the computing system MPCi for the selection process. Similarly, the computing system MPC2 can store a table or other data structure including data for the selection value with a key based on the SPID2 generated by the computing system MPC2 for the selection process. This enables the MPC cluster 130 to update the process variable of the feedback controller based on data received from the client device 110.

[0125] The selection result can be in the form of a byte array that includes information about the selected digital component. For example, the selection result can be a byte array that includes the value of the digital component in the second LUT, e.g., the selection value of the digital component and the metadata of the digital component. Computing systems MPC1 and MPC2 can determine secret shares of the selection result using a secure MPC process, as described in more detail below. Computing system MPC1 can transmit a first secret share of the selection result to client device 110, and computing system MPC2 can transmit a second secret share of the selection result to client device 110. To prevent computing systems MPC1 and MPC2 from knowing the selected digital component, computing systems MPC1 and MPC2 can be prevented from sharing their secret shares of the selection result with each other.

[0126] Client device 110 determines the digital component corresponding to the selection result(s) (324). For each selection result that client device 110 receives from computing systems MPC1 and MPC2 as two secret shares, client device 110 can determine the selection result from the two secret shares. For example, using an additional secret share pool described in more detail below, client device 110 can add together the two secret shares of the selection result to obtain the selection result in plaintext. This gives client device 110 access to the selection value of the digital component and the metadata of the digital component, e.g., the identity of the digital component, the location from which client device 110 can download the digital component, etc.

[0127] Client device 110 displays the digital component (326). For example, application 112 can display the digital component with the content received in step 304. In some implementations, client device 110 can display the digital component of the selection result.

[0128] In some implementations, the client device 110 can request digital components from the MPC cluster 130 based on user group membership. The client device 110 can also request digital components from the SSP 170 based on contextual signals. These contextual signals can include the same contextual signals described above, as well as optionally additional contextual signals such as the number of digital component slots for the resource, the type of digital component slots, the type and / or format of digital components that can be displayed with the resource, etc. The SSP 170 can select one or more digital components based on the contextual signals and the selection values for the digital components, and provide the selected digital components (or data identifying the digital components) and one or more of the selection values for the digital component(s) to the client device 110. The client device 110 can then select digital components to display with the resource from a set of digital components that includes the digital components received from the MPC cluster 130 and the digital component(s) selected by the SSP 170. If the resource includes multiple digital component slots, the client device 110 can request a respective digital component for each slot from the MPC cluster 130 and from the SSP 170.

[0129] The client device 110 can transmit one or more event notifications to the MPC cluster 130 (328). For example, assuming the digital component of the selection result received from the MPC cluster 130 is displayed by the application 112 of the client device 110, the application 112 can transmit an impression notification for the digital component in response to displaying the digital component. In another example, the application 112 can transmit a user interaction notification in response to detecting a user interaction, e.g., a selection / click on the digital component.

[0130] For the user interaction notification, the application 112 can generate a secret share of a clicked parameter, which is a Boolean parameter that can have a value of one if the user interacted with the digital component, or a value of zero if the user did not interact with the digital component within a specified duration of time after the digital component was displayed. Thus, in this example, either value indicates that the digital component was displayed, but a value of one can indicate that the user interacted with the digital component. The application 112 can send a first notification to the computer system MPCi that includes the SPIDi received from the computing system MPCi and a first secret share of the clicked parameter [clickedi]. Similarly, the application 112 can send a second notification to the computer system MPC2 that includes the SPID2 received from the computing system MPC2 and a second secret share of the clicked parameter [clicked2]. In another example, the notification can separately indicate whether the digital component was displayed at the client device 110, e.g., using a secret share similar to the clicked parameter.

[0131] Impression and user interaction notifications enable the MPC cluster 130 to update process variables of a feedback controller that paces the distribution of digital components. For example, if the process variable is an impression rate, the MPC cluster 130 can use impression notifications to update a count of impressions of a digital component (or campaign that includes the digital component). If the process variable is a user interaction rate, the MPC cluster 130 can use click parameters to update a number of user interactions of a digital component (or campaign that includes the digital component). In a specific example, the computing system MPCi can use SPIDi to obtain stored data for the selection process, and the computing system MPC2 can use SPID2 to obtain stored data for the selection process. The MPC cluster 130 can then perform a secure MPC process to update a process variable (e.g., an impression rate, an interaction rate, a conversion rate, and / or a resource depletion rate) for a campaign of digital components displayed by the application 112. Similarly, the MPC cluster 130 can use notifications to update counts used to determine whether a digital component satisfies a k-anonymity condition.

[0132] Figure 4 is a swim lane diagram of an example process 400 for selecting a digital component for distribution to a client device. Operations of the process 400 can be implemented, for example, by the computing systems MPCi and MPC2 of the MPC cluster 130. Operations of the process 400 can also be implemented as instructions stored on one or more computer readable media, which can be non-transitory, and execution of the instructions by one or more data processing apparatuses can cause the one or more data processing apparatuses to perform the operations of the process 400.

[0133] The process 400 can be used for a first value selection process, a second value selection process, and / or a selection process that includes an uplift and / or a floor price. Each of these variants is described below. Figure 5 Another example process 500 shown in FIG. is capable of being used for a selection process that includes tiers. The process 500 can also support a first value selection process, a second value selection process, an uplift, and / or a floor price.

[0134] The computing systems MPCi and MPC2 determine and / or identify a selection value for a digital component (402). The computing systems MPCi and MPC2 can determine the selection value in response to a digital component request received from a client device 110. As referenced above, the selection value can be determined using a selection process that includes a first value selection process, a second value selection process, an uplift, a floor price, and / or tiers. Figure 3The described, computing system MPC1 can receive a digital component request from client device 110, the digital component request including a context signal and data for a probability data structure representing a user group identifier for a user of client device 110. The data for the probability data structure can include parameters rand varla, rand varlb, and rand var2. Similarly, computing system MPC2 can receive the context signal and parameters vector B, rand varla, and rand varlb from client device 110. The context signal can be in the form of a lookup key, e.g., with reference to Figure 1 The described first level lookup key (SHA256(UG_Request_Key)).

[0135] The selection value can include a selection value for the digital component stored by the storage at which each computing system MPC1 and MPC2 stores its data and a JIT selection value received from SSP 170 for the digital component selection process. For cases in which the selection value is determined using a vector, each computing system MPC1 and MPC2 can determine the selection value by determining a dot product of the vector for the digital component. Computing systems MPC1 and MPC2 can also apply any uplift for which a digital component has been established by publisher 140 or SSP 170 and / or implement any floor price established by publisher 140 or SSP 170.

[0136] Computing system MPC1 identifies eligible digital components (404). Computing system MPC1 can identify eligible digital components for the digital component request received from client device 110, e.g., with reference to Figure 3 The described. Eligible digital components are digital components that are eligible for selection based on the context signal of the digital component request. For example, eligible digital components can be digital components that have a set of context signals that match the context signal of the digital component request, e.g., digital components that have a lookup key that matches the lookup key of the request.

[0137] In implementations that use a two-level LUT, computing system MPCi can use the first-level lookup key requested by the digital component to identify eligible digital components. Computing system MPCi can access the first-level LUT and use the first-level lookup key to identify rows of the second-level LUT that include information for digital components that are eligible to be displayed — e.g., for which a selection value has been received — for the set of contextual signals represented by the first-level lookup key. For example, as described above, each row of the second-level LUT includes information for a digital component and a second-level lookup key based on a set of contextual signals. Thus, computing system MPCi can use the first-level lookup key to identify rows of the second-level LUT that have a set of contextual signals that match the set of contextual signals defined by the first-level lookup key received in the digital component request. These rows include information for digital components that are eligible to be displayed or have an eligible selection value for the context defined by the first-level lookup key received in the digital component request.

[0138] Computing system MPC2 identifies eligible digital components (406). Computing system MPC2 can identify eligible digital components for the digital component request received from client device 110. Computing system MPC2 can identify eligible digital components in a similar manner as computing system MPCi. In implementations in which the MPC cluster 130 implements reserve prices, each MPC computing system MPCi and MPC2 can filter from eligible digital components any eligible digital components that have selection values that do not satisfy — e.g., that do not satisfy or exceed — their corresponding reserve price.

[0139] For each eligible digital component, computing systems MPCi and MPC2 determine whether the digital component and its selection value are a candidate for selection for distribution to client device 110 in response to the digital component request (408). If the digital component is a conditional digital component, the candidate digital component is an eligible digital component that satisfies all of the one or more conditions of the digital component. Each unconditional digital component that is context eligible is also a candidate digital component. Computing systems MPCi and MPC2 can determine candidate digital components using a secure MPC process such that neither computing system MPCi or MPC2 can identify candidate digital components in plaintext.

[0140] For the user group membership condition, computing systems MPCi and MPC2 can compute for each eligible digital component “i” a respective secret share of the user group membership condition parameter ug_check i The first secret share of the user group membership condition parameter ug_check i maintained by computing system MPCi can be represented as [ug_check i,1 ], while the user group membership condition parameter ug_check iThe second secret share of the second secret can be expressed as [ug_check i,2 ]. Parentheses are used to denote secret shares of parameters.

[0141] For embodiments in which the cuckoo filter is used to represent user group membership for a user, computing system MPC1 collaborates with computing system MPC2 to compute [ug_check i,1 ] according to the following relation 1:

[0142] and

[0143]

[0144] In relation 1, ∏ denotes multiplication of multiple terms. Here, ug id(x) is a function used to retrieve a user group identifier ug id associated with a selection value x, {F1,... F N} is a set of hash functions used to compute possible indices of terms within the cuckoo filter table A, and rand val la is a random value received in the digital component request. [M x,1 ] is the xth element in the array [M1]. == is an equality test between a plaintext integer and a secret share of a secret integer. The result of == is a secret share of a secret integer that is either 0 (not equal) or 1 (equal). Here, [M i,1 ] has a value = [PRF(rand val 2a, i) 1].

[0145] Similarly, computing system MPC2 collaborates with computing system MPC2 to compute [ug_check i,2 ] according to the following relation 2:

[0146] and

[0147]

[0148] Here, [M i,2 ] has a value = B i .

[0149] For digital components that are conditioned on user group membership for a user for which the digital component is being selected, computing systems MPC1 and MPC2 can compute a secret share of the user group membership condition parameter ug_check i [ug_check i,1 ] and [ug_check i,2The combination of the two secret shares can be a Boolean value that indicates whether the user is a member of the user group corresponding to the digital component. For example, a value of one can indicate that the user is a member, and a value of zero can indicate that the user is not a member. For digital components that are not conditioned on the user’s user group membership, computing systems MPCi and MPC2 can use default values for secret shares [ug_check i,1 ] and [ug_check i,2 ] such that the combination has a value (e.g., one) that indicates that the user is a member of the user group corresponding to the digital component.

[0150] In implementations in which a Bloom filter is used to represent the user’s user group membership, computing systems MPCi and MPC2 can query the Bloom filter as described with reference to Figure 8 The result is that computing system MPCi has a first secret share of the user group membership condition parameter [ug_check i,1 ] for each hash function of the Bloom filter. Similarly, computing system MPC2 has a second secret share of the user group membership condition parameter [ug_check i,2 ] for each hash function of the Bloom filter. For digital components that satisfy the user group membership condition, the user group membership condition parameter, ug_check i , for each hash value of the Bloom filter will need to have a Boolean value of true or one. The secret share for each hash value can be included in the final computation of the secret share of the candidate parameter for the digital component.

[0151] Computing systems MPCi and MPC2 can also collaborate to compute respective secret shares [blocked_check i,1 ] and [blocked_check i,2 ] of a blocked digital component parameter blocked_check i for each digital component i that is conditioned on frequency control or muting. The combination of the two secret shares can be a Boolean value that indicates whether the digital component satisfies the blocked digital component condition based on frequency control (e.g., the digital component has not been served to the user more than a threshold number of times during a period of time) and / or based on whether the user has opted not to have the digital component displayed to the user. For example, a Boolean value of true or a value of one can indicate that the digital component can be displayed to the user based on these factors, and a Boolean value of false or a value of zero can indicate that the digital component cannot be displayed to the user based on these factors.

[0152] To determine the secret shares of the blocked digital component parameter, the computing systems MPC1 and MPC2 can use shares, e.g., arrays, of a Bloom filter representing the identifiers of the blocked digital components. The application 112 can generate a Bloom filter representing the identifiers of the blocked digital components and send data representing the Bloom filter to the computing systems MPC1 and MPC2, as described with reference to Figure 8 The computing systems MPC1 and MPC2 can then use the arrays representing the Bloom filter to query the Bloom filter to obtain secret shares [blocked_check i,1 ] and [blocked_check i,2 ], as described with reference to Figure 8

[0153] The computing systems MPC1 and MPC2 can also collaborate to compute respective secret shares [pacing_check i ] and [pacing_check i,1 ] of the pacing control check parameter pacing_check i,2 for each digital component i that is being throttled, e.g., using a feedback controller. The combination of the two secret shares can be a Boolean value representing, e.g., based on the output of the feedback controller, whether the digital component satisfies a pacing condition. For example, if the digital component is being provided too frequently relative to a target impression rate, the output of the feedback controller can indicate that the digital component fails the pacing condition for that digital component selection process. A Boolean value of true or a value of one can represent that the digital component satisfies the pacing condition, e.g., is not being throttled for that selection process, while a Boolean value of false or a value of zero can indicate that the digital component does not satisfy the pacing condition, e.g., is being throttled for that selection process.

[0154] To enforce the resource exhaustion (e.g., budget) and pacing rules, the computing systems MPC1 and MPC2 can use the probabilities determined with the feedback controller and the resource exhaustion condition to randomly block digital components from participating in the digital component selection process. If the campaign including the digital component does not have any additional resources, the probability is set to one. Otherwise, if the campaign is ahead of the delivery schedule, the probability is set to high (e.g., higher than zero and close to one), making it more likely that the computing systems MPC1 and MPC2 block the digital component from the digital component selection process, e.g., by computing secret shares [pacing_check i,1 ] and [pacing_check i,2 ] such that the pacing control check parameter pacing_check i has a value of zero. If the campaign is behind the delivery schedule, the probability is lower.

[0155] ​The computing systems MPC1 and MPC2 can periodically compute a pacing selector parameter pacing selector for each campaign in additive secret shares using a feedback controller. Conceptually, the pacing selector parameter is a throttling probability scaled by a factor of the maximum range.

[0156] For each digital component request and for each digital component, the computing systems MPC1 and MPC2 compute a secret number uniformly distributed in [0, maximum range]. If the random number is less than or equal to the pacing selector parameter pacing selector, the computing systems MPC1 and MPC2 prevent the digital component from participating in the digital component selection process, for example, by computing secret shares [pacing_check i,1 ] and [pacing_check i,2 ] such that the pacing control check parameter pacing check i has a value of zero.

[0157] To protect the user privacy and confidential information of the participants in the digital component selection process, both the random number and the pacing selector parameter are in additive secret shares. The comparison between two secret shares can be performed using a garbled circuit protocol. By limiting the two secret shares to six or seven bits, the comparison protocol can be conducted in one or two rounds of communication between the computing systems MPC1 and MPC2.

[0158] To determine the pacing selector parameter for a campaign, the computing systems can compute the amount of resources used for each campaign as resources used campaign =∑(clearing value x is dc the winner), where the sum is across all digital component selection processes that include digital components of the campaign, the parameter clearing value is the clearing value of the digital component selection process, and is dc the winner is a winner parameter for the digital component in the digital component selection process. This computation can be performed in secret shares such that each computing system MPC1 and MPC2 holds a secret share of the amount of resources used. The computing systems MP1 and MPC2 can then compute a resource exhausted parameter resources exhausted for the campaign by determining whether the amount of resources used, i.e., resources used campaign, is greater than the total amount of resources allocated to the campaign in secret shares.

[0159] The computing systems MPC1 and MPC2 can compute a pacing selector parameter for each campaign, pacing selector, as pacing selector = resources exhausted x maximum range + (1 - resources exhausted) x output, where the parameter output is the output of the feedback controller. This computation can use one RPC between the computing systems MPC1 and MPC2 to compute the multiplication in secret shares. However, the computation can be performed periodically offline to prevent any added latency.

[0160] The computing systems MPC1 and MPC2 can also cooperate to compute respective secret shares of a k-anonymity check parameter, [kanonymity check i ] and [kanonymity check i,1 ], for each digital component i that must satisfy a k-anonymity condition, in some implementations, this can apply to all digital components. The combination of the two secret shares can be a Boolean value representing whether the digital component satisfies the k-anonymity condition. For example, a value of one can represent that the digital component satisfies k-anonymity, while a value of zero can represent that the digital component does not satisfy k-anonymity and should be prevented from proceeding with the digital component selection process. i,2

[0161] The computing systems MPC1 and MPC2 can periodically process the log (as described with reference to Figure 9 ) to identify digital component selection processes in which the application 112 has shown (or can have shown) a winner digital component, e.g., has received a corresponding selection process identifier in an impression notification. Among these selection processes, the computing systems MPC1 and MPC2 count the number of impressions shown (or can have been shown) by the user's application 112 as impression show i =∑(is dc the winner i). Here, i can represent a digital component or a campaign. The computation is performed in secret shares so that each computing system MPC1 and MPC2 has a secret share of the number of impressions, impression show i . The computing systems MPC1 and MPC2 can then determine whether the number of impressions exceeds a value k, e.g., by comparing the number of impressions to the secret share of k.

[0162] ​For each condition of each conditional digital component (e.g., digital components with at least one condition), each computing system MPC1 and MPC2 can store a corresponding secret share of the parameter for each condition of the digital component. In this way, neither computing system MPC1 and MPC2 knows the value of the parameter in plaintext so long as at least one MPC computing system is honest. Each digital component can be conditioned on zero or more conditions. For a given digital component selection process, some digital components can have different conditions and / or a different number of conditions than other digital components.

[0163] Although some example conditions are provided above, other conditions can also be used. In general, computing systems MPC1 and MPC2 can use secure MPC procedures to compute secret shares of the condition parameters. The criteria and techniques for determining the condition parameters can vary. In some implementations, secret shares of the condition parameters can be received from another computing system, e.g., such that computing systems MPC1 and MPC2 do not compute the condition parameters.

[0164] Computing systems MPC1 and MPC2 can use the secret shares of the condition parameters to determine whether a conditional digital component is a candidate for the digital component selection process. Computing systems MPC1 and MPC2 can use the secret shares of the condition parameter(s) for a conditional digital component to compute a secret share of a candidate parameter is_dc_a_candidate i for each conditional digital component i. In general, if a conditional digital component is conditioned on each of the conditions above, the following relation 3 can be used to compute the candidate parameter for digital component i:

[0165] is_dc_a_candidate i = ug_check i AND blocked_check i AND pacing_check i AND kanonymity_check i

[0166] Since the value of each condition parameter is in a secret share, computing systems MPC1 and MPC2 can collaborate in a secure MPC procedure using round-trip remote procedure calls (RPCs) to use the secret shares of the condition parameters to determine a corresponding secret share of the candidate parameter for digital component i [is_dc_a_candidate i,1 ] and [is_dc_a_candidate i,2] can be determined using any suitable secret share algorithm for determining a logical AND operation. The secret share of the candidate parameter for digital component i [is_dc_a_candidate i,1 ] and [is_dc_a_candidate i,2 ]. Computing systems MPC1 and MPC2 can determine the secret share of the candidate parameter using only the secret shares of the conditional parameters for those conditions. At the end of this secure MPC process, computing system MPC1 holds the first secret share of the candidate parameter for each conditional digital component [is_dc_a_candidate i,1 ], while computing system MPC2 holds the second secret share of the candidate parameter for each conditional digital component [is_dc_a_candidate i,2 ].

[0167] In some embodiments, computing systems MPC1 and MPC2 evaluate relation 3 for each digital component using a garbled circuit protocol. In this example, one of computing systems MPC1 or MPC2 can construct the garbled circuit. For this example, assume that computing system MPC1 constructs the garbled circuit. Computing system MPC1 knows its own secret share, and also knows the only possible bit pattern that the secret share of computing system MPC2 must hold in order for the candidate parameter of the digital component to become true or one. With this property, computing system MPC1 only needs up to 50 gates to construct the garbled circuit, e.g., if there are a total of about 50 Boolean parameters in relation 3.

[0168] In relation 3, there is only one user group membership condition parameter ug_check i . However, if a Bloom filter is used to represent user group membership for users, relation 3 can include a corresponding user group membership condition parameter ug_check i for each hash function of the Bloom filter. Similarly, if a Bloom filter is used to represent blocked digital components, relation 3 will include a corresponding blocked digital component parameter blocked_check i for each hash function of the Bloom filter. In relation 3, there is a pacing_check i only when the owner of the digital component has enabled pacing checks.

[0169] The computing system MPC1 determines an order of the digital components based on the selection values (410). Similarly, the computing system MPC2 determines an order of the digital components based on the selection values (412). These two orders should be identical because the inputs to the ordered process are identical on both computing systems MPC1 and MPC2. Each computing system MPC1 and MPC2 is able to determine an order of the digital components. Each order can include the candidate digital components and other digital components that were evaluated for eligibility in step 408. For example, the order can include all available digital components available for the digital component selection process, all eligible digital components for the digital component selection process (e.g., based on context signal eligibility), or, if used, all digital components in the second-level LUT. The order can be from the digital component with the highest selection value to the digital component with the lowest selection value. In some implementations, the selection values used for the order can be the values that would be provided to the publisher 140 of the resource with which the selected digital component would be displayed, e.g., after any shared with the DSP 150 and / or SSP 170 plus any applicable uplift.

[0170] Because the selection values are in the clear, the computing systems MPC1 and MPC2 do not have to perform any round-trip computations to determine the order of the digital components. Instead, each computing system MPC1 and MPC2 is able to independently sort the selection values. If the selection values are stored as secret shares at each computing system MPC1 and MPC2, with each computing system MPC1 and MPC2 having a respective secret share of each selection value, then the computing systems MPC1 and MPC2 can use round-trip computations to perform a secure MPC process to sort the selection values. If there is a tie between two or more selection values, then the computing systems MPC1 and MPC2 can use other metadata for the digital components corresponding to these selection values to deterministically break the tie.

[0171] The computing systems MPC1 and MPC2 determine secret shares of an accumulated value for each candidate digital component (414). Conceptually, the accumulated value for a given digital component represents the total number of candidate digital components from the top of the order to the selection value of the given digital component, not including the given digital component even if it is a candidate. That is, the accumulated value represents the number of candidate digital components that are more eligible for selection than the given digital component. This concept is illustrated in Table 3 below.

[0172] Ordered select value is_dc_a_candidate Accumulator value (acc) Accumulator value equals 0? Highest 0 0 1 Second highest 1 0 1 Third highest 0 1 0 Fourth highest 1 1 0 … … … …

[0173] Table 3

[0174] In some implementations, the cumulative value for a given digital component represents the total number of candidate digital components from the top of the order to the given digital component, including the given digital component if the given digital component is a candidate. In this example, the fourth column would represent whether the cumulative value equals one, not zero. For brevity, the remaining discussion will be in terms of the first example, where the cumulative value for a given digital component represents the total number of candidate digital components from the top of the order to the given digital component, not including the given digital component if the given digital component is a candidate.

[0175] Conceptually, in Table 3, for each digital component with a candidate parameter is dc a candidate equal to one, the cumulative value (acc) is incremented because it advances from the top of the order to the bottom of the order. As described below, the calculation of the cumulative value acc is performed in a secret share. For example, the cumulative value acc for the digital component with the highest selection value is zero because the candidate parameter is dc a candidate for the highest selection value is equal to zero. The cumulative value acc for the second highest digital component is also zero because the candidate parameter is dc a candidate for the second highest digital component is equal to one, but none of the selection values above the second highest digital component have a candidate parameter is dc a candidate equal to one. Moving down the order, based on the candidate parameter is dc a candidate for the second highest selection value having a value of one, the cumulative value acc for the third highest selection digital component is incremented by a value of one. Since the candidate parameter is dc a candidate for the third highest digital component is zero, the cumulative value acc for the fourth digital component is not incremented and has a value of zero like the third highest digital component.

[0176] Using Table 3, the computing systems MPC1 and MPC2 will select the digital component corresponding to the selection value with a total candidate parameter is dc a candidate having a value of one and a cumulative value acc having a value of zero to distribute to the client device 110, as shown in the fourth column of Table 3. This represents the digital component corresponding to the highest ordered selection value with a candidate parameter is dc a candidate having a value of one. Since the candidate parameter is dc a candidate is in a secret share by the computing systems MPC1 and MPC2 to maintain user privacy and ensure user data is not leaked, the computing systems MPC1 and MPC2 determine a secret share of the cumulative value acc for each digital component and use a round-robin calculation to determine which digital component has a cumulative value acc equal to zero and a candidate parameter is dc a candidate equal to one.

[0177] In some implementations, computing systems MPC1 and MPC2 can independently determine, according to a secret share algorithm, a secret share of an accumulated value acc for each digital component without any roundtrip computation. For example, computing system MPC1 can determine a first share of the accumulated value acc for each digital component i by traversing all digital components in order from highest to lowest and summing the candidate parameters is dc a candidate of the digital components along that path, as described above with reference to Table 3. Similarly, computing system MPC2 can determine a second share of the accumulated value acc for each digital component i by traversing all digital components in order from highest to lowest and summing the candidate parameters is dc a candidate of the digital components along that path. i,1 ] as described above with reference to Table 3. Similarly, computing system MPC2 can determine a second share of the accumulated value acc for each digital component i by traversing all digital components in order from highest to lowest and summing the candidate parameters is dc a candidate of the digital components along that path. i,2 ] as described above with reference to Table 3. Similarly, computing system MPC2 can determine a second share of the accumulated value acc for each digital component i by traversing all digital components in order from highest to lowest and summing the candidate parameters is dc a candidate of the digital components along that path.

[0178] Computing systems MPC1 and MPC2 determine a secret share of a result for each digital component that indicates whether the accumulated value has a specified value (416). The specified value can be a zero value, as shown in columns 3 and 4 of Table 3. As described above, a digital component for which the accumulated value is zero and the total candidate parameter is dc a candidate is one is the digital component with the highest selection value among the candidate digital components.

[0179] Computing systems MPC1 and MPC2 can participate in multiple rounds of computation, e.g., multiple RPCs, as part of a secure MPC process to compute the equation acc i == 0 according to the secret shares for each digital component i. The equation is used to determine whether the accumulated value acc i for a digital component i has a zero value. At the end of the process, computing system MPC1 has one secret share of the result acc i == 0 for each digital component i, and computing system MPC2 has another secret share of the result acc i == 0 for each digital component.

[0180] Computing systems MPC1 and MPC2 determine a secret share of a winner parameter is dc the winner i for each digital component i (418). Computing systems MPC1 and MPC2 can determine the winner parameter is dc the winner i based on the secret share of the accumulated value acc i == 0 for each digital component i and the secret share of the candidate parameter is dc a candidate for each digital component i. The winner parameter is dc the winner i for each digital component i is determined as follows: iis_dc_the_winner, which indicates whether digital component i is a winner of the selection process, e.g., whether digital component i was selected to be distributed to client device 110 in response to the digital component request.

[0181] In some implementations, computing systems MPCi and MPC2 can perform a secret share multiplication protocol to compute a winner parameter is_dc_the_winner for each selection value from the secret shares. i == (is_dc_a_candidate i x (acc i == 0)). This can include one RPC between computing systems MPCi and MPC2 to multiply the two secret shares. At the end of this MPC process, computing system MPCi has one secret share of a result is_dc_the_winner i,1 that is represented as [is_dc_the_winner i,1 ] = [is_dc_a_candidate i,1 ] x ([acc i ] == 1). Similarly, computing system MPC2 has another secret share of the result is_dc_the_winner i,2 that is represented as [is_dc_the_winner sv,2 ] = [is_dc_a_candidate i,2 ] x ([acc i ] == 0). Note that for all digital components, at most one digital component has a winner parameter is_dc_the_winner i equal to 1, which is the digital component that was selected for distribution to client device 110. All other digital components will be equal to zero.

[0182] For the first value selection process, computing systems MPCi and MPC2 can perform a similar process to determine a winner parameter is_dc_the_winner for each digital component i. i For example, computing systems MPCi and MPC2 can perform a secret share equality test to determine a secret share of a first selection value parameter maybe_first_sv i == (acc i == 0). The first selection value parameter maybe_first_sv imay be a Boolean value that indicates whether the selection value for the digital component can be the highest among the candidate digital components. If the digital component corresponding to the selection value is actually a candidate digital component, then the selection value will be the highest selection value among the candidate digital components. Thus, the first selection value parameter maybe_first_sv i indicates whether the digital component will have the highest selection value if the digital component is actually a candidate digital component. At the end of this equality test, computing system MPC1 has a first secret share of the first selection value parameter maybe_first_sv i for digital component i [maybe_first_sv i,1 ], and computing system MPC2 has a second secret share of the first selection value parameter maybe_first_sv i for digital component i [maybe_first_sv i,2 ].

[0183] Then, computing systems MPC1 and MPC2 can use the following relationship 4 to compute the winner parameter is_dc_the_winner i for each digital component i based on the secret shares: i is_dc_the_winner i = TRUE) AND (maybe_first_sv i = TRUE))

[0184] Computing systems MPC1 and MPC2 determine the selection result (420). In some embodiments, computing systems MPC1 and MPC2 can compute the selection result based on the winner parameter for the digital component and the digital component information element dc_information_element for the digital component. As described above, the digital component information element dc_information_element for the digital component can include the selection value for the digital component and other data for the digital component.

[0185] Conceptually, computing systems MPC1 and MPC2 can use the following relationship 5 to compute the selection result parameter “result”:

[0186] result =∑ i is_dc_the_winner i x dc_information_element i

[0187] That is, computing system MPC1 and MPC2 are able to determine the sum of the product of the winner parameter is dc the winner i and the digital component information element dc information element i across all digital components. In this example, the selection result will have a value of zero if no candidate digital component exists, or the selection result will have a value equal to the digital component information element dc information element of the selected digital component that has a winner parameter is dc the winner i equal to one. In another example, the digital component information element dc information element can be replaced with the selection value of the digital component in relation 5. In this example, the selection result will have a value of zero if no candidate digital component exists, or the selection result will have a value equal to the selection value of the selected digital component that has a winner parameter is dc the winner i equal to one.

[0188] To perform the computation in secret shares, computing system MPC1 takes all digital components and is able to multiply the digital component information element dc information element i of the digital component in clear text with the first secret share of the winner parameter [is dc the winner i,1 ] of the digital component. Then, computing system MPC1 is able to determine the sum of these products and return the sum to the client device 110 that submitted the digital component request. That is, computing system MPC1 is able to determine the sum as the first secret share of the result [result1] using the following relation 6:

[0189] [result1] =∑ i ([is dc the winner i ] x dc information element i )

[0190] Computing system MPC2 is able to perform a similar computation to determine the second secret share of the result [result2] using the following relation 7:

[0191] [result2] =∑ i ([is dc the winner i ] x dc information element i )

[0192] The computing system MPC1 sends a first share of the selection result [resultl] to the client device 110 (422). Similarly, the computing system MPC2 sends a second share of the selection result [result2] to the client device 110 (424). The application 112 can then reconstruct the selection result result in plaintext using the two secret shares [resultl] and [result2], for example, by determining the sum of the secret shares in the case of an additive secret share algorithm. If the selection result has a value of zero, the MPC cluster 130 does not identify a digital component for distribution to the client device 110. Otherwise, the selection result has a value equal to the digital component information element dc_information_element. The application 112 can parse the digital component information element dc_information_element to obtain the selection value and metadata for the digital component. The application 112 can then display the digital component or use the digital component and other digital components received from the SSP 170 to perform a selection process, as described above.

[0193] In some implementations, a mask is used to send the selected digital component to the client device 110 to prevent the computing system MPC1 or MPC2 from being able to access the selected digital component in plaintext and to reduce latency in sending the digital component to the client device 110. In this example, the application 112 can request a selection nonce for each digital component request and send the nonce with the digital component request. The application 112 can send the nonce to one of the computing systems MPC1 or MPC2. For purposes of example, assume that the nonce is sent to the computing system MPC2.

[0194] Both the application 112 and the computing system MPC2 can independently compute a mask of the same size as the most creative digital component with the same algorithm and the same input. For example, the i-th bit of the mask can be represented as PRF(nonce, i), where PRF represents a pseudo-random function. Both the application 112 and the computing system MPC2 can keep the nonce and the mask secret from the computing system MPC1.

[0195] To send the selected digital component to the application 112, the computing system MPC2 can send [result2] XOR the mask to the computing system MPC1 bit by bit. The computing system MPC1 then sends [resultl] XOR ([result2] XOR the mask) to the application 112 bit by bit as the selection result, for example, as a response to the digital component request.

[0196] The application 112 can compute [resultl] bitwise XOR ([result2] bitwise XOR mask) bitwise XOR mask as the creativity of the digital component. This is equivalent to [resultl] bitwise XOR [result2]. This reduces the required bandwidth to the size of the maximum creativity, while preserving the private information retrieval guarantee. As described above, this reduces the bandwidth of the response relative to sending two secret shares of the selection result. In this way, there is little or no additional latency or bandwidth consumption in this privacy preserving technique relative to sending the digital component creativity as in other processes.

[0197] For the second value selection process, the computing systems MPC1 and MPC2 can compute a second selection value parameter maybe_second_sv i for each digital component. The second selection value parameter for digital component i can be a Boolean value representing whether the selection value of the digital component can be the second highest selection value among the candidate digital components. If the digital component corresponding to the selection value is actually a candidate digital component, then the selection value will be the second highest selection value among the candidate digital components. Thus, the second selection value parameter for digital component i, maybe_second_sv i , represents whether the digital component will have the second highest selection value if the digital component is actually a candidate digital component. The computing systems MPC1 and MPC2 can perform a secret share equality test to determine the secret shares of the second selection value parameter maybe_second_sv i = (acc i == 1).

[0198] At the end of this equality test, the computing system MPC1 has a first secret share of the second selection value parameter maybe_second_sv i for digital component i, [maybe_second_sv i,1 ], and the computing system MPC2 has a second secret share of the second selection value parameter maybe_second_sv i for digital component i, [maybe_second_sv i,2 ].

[0199] The computing systems MPC1 and MPC2 can then determine is_dc_a_candidate i AND maybe_second_sv iThe result is a Boolean value of true or one that determines the candidate digital component that has the second highest selection value according to the secret share. That is, the computing systems MPC1 and MPC2 are able to determine which digital component is the candidate digital component and has a second selection value parameter maybe_second_sv i .

[0200] In concept, the computing systems MPC1 and MPC2 are able to compute the second highest selection value among the candidates using the following relation 8:

[0201] second_selection_value = ∑ i (selectionvalue i x(is_dc_a_candidate i ANDmaybe_second_sv i ))

[0202] In relation 8, the parameter "selectionvalue i " is the selection value (with any promotion) for digital component i, and the parameter "second_selection_value" is the value of the second highest selection value among the candidate digital components. Using the relation, the second selection value is the selection value of the digital component that is a candidate, and has a second selection value parameter of Boolean value true. The Boolean value in this relation can be treated as a value of one (true) or zero (false).

[0203] In the secret share, the computing systems MPC1 and MPC2 compute the result is_dc_a_candidate i AND maybe_second_sv i with secret share, and represent the result as two additive secret shares in the Z2 space (e.g., add then mod 2). Furthermore, the selection value is in the clear. The relation 8 can be simplified by replacing the multiplication with a bitwise logical AND operation between each bit of the selection value in the clear and the 1-bit secret share of the result is_dc_a_candidate i AND maybe_second_sv i held by each computing system MPC1 and MPC2. In addition, the summation can be replaced with a bitwise XOR operation.

[0204] Figure 5is a swim lane diagram of an example process 500 for selecting digital components for distribution to client devices. The operations of process 500 can be implemented, for example, by computing systems MPCi and MPC2 of MPC cluster 130. The operations of process 500 can also be implemented as instructions stored on one or more computer-readable media, which can be non-transitory, and execution of the instructions by one or more data processing apparatus can cause the one or more data processing apparatus to perform the operations of process 500. As described above, process 500 can be used for selection processes that include tiers.

[0205] Computing systems MPCi and MPC2 determine selection values for digital components (502). Computing systems MPCi and MPC2 can obtain or determine the selection values in response to receiving digital component requests from client devices 110. Computing system MPCi identifies eligible digital components that are eligible for the digital component selection process (504). Computing system MPC2 also identifies eligible digital components that are eligible for the digital component selection process (506). For each eligible digital component, computing systems MPCi and MPC2 determine whether the digital component is a candidate for the digital component selection process (508). Steps 502-508 can be the same or similar to steps 402-408 of process 400, shown above. Figure 4

[0206] Computing system MPCi groups the digital components into tiers (510). As described above, a publisher can establish tiers for DSPs 150 and / or digital component providers 160. The publisher’s tiers can include a highest priority tier, a lowest priority tier, and optionally one or more tiers between the highest priority tier and the lowest priority tier.

[0207] Computing system MPCi can determine the tier for each digital component based on the DSP 150 or digital component provider 160 that, for example, provided the selection value or value vector for the digital component. Computing system MPCi can then group the digital components into their respective tiers. Similarly, computing system MPC2 can group the digital components into their respective tiers (512). For both computing systems MPCi and MPC2, the groups of digital components for the tiers should be the same. In some implementations, SSP 170 explicitly determines the tiers and then encodes the tiers into the metadata for each selection value to be stored, for example, cached in MPC cluster 130.

[0208] ​Then, computing systems MPC1 and MPC2 can perform a separate selection process for each of one or more layers to select the digital component to be provided in response to a digital component request (513). In some embodiments, computing systems MPC1 and MPC2 perform the selection process for the layers in parallel. In some embodiments, computing systems MPC1 and MPC2 perform the selection process sequentially, starting from the highest priority layer and moving down layer by layer until the selection process has been performed for all layers. In some embodiments, computing systems MPC1 and MPC2 can stop once a candidate is found in a layer, but this may pose a risk of leaking user-sensitive information to computing systems MPC1 and MPC2. The steps in the dashed box are performed for each layer for which a separate selection process is performed.

[0209] Computing system MPC1 sorts the digital components grouped into layers by selection values ​​(514). The selection values ​​can be sorted first by layer priority, and then by selection values ​​within the same layer. Similarly, computing system MPC2 sorts the digital components grouped into layers by selection values ​​(516). For each layer, these steps 514 and 516 are similar. Figure 4 Steps 410 and 412 of process 400 are shown. However, the sequence only includes the digital components included in the layer.

[0210] The computing systems MPC1 and MPC2 collaborate to determine the accumulated value acc of each digital component in the layer. i The secret share (518). As described above, the accumulated value of a given digital component can represent the total number of candidate digital components from the top of the order to the selected value of the given digital component, excluding the given digital component even if it is a candidate. The computing systems MPC1 and MPC2 can be referenced as above. Figure 4 The process 400, step 414, describes a similar method for determining the accumulated value of the digital components in the layer.

[0211] In some implementations, computation systems MPC1 and MPC2 can independently determine the secret share of the accumulated value acc for each digital component, depending on the secret share algorithm, without any round-trip computation. For example, computation system MPC1 can determine the first share of the accumulated value acc for each digital component i by traversing all digital components in the layer in descending order and summing the candidate parameter is_dc_a_candidate of the digital component along that path. i,1 As described in Table 3 above. Similarly, the computing system MPC2 can determine the second share of the accumulated value acc for each digital component i by traversing all digital components in the layer in descending order and summing the candidate parameter is_dc_a_candidate of the digital components along that path.i,2 ]。

[0212] The computing systems MPC1 and MPC2 determine, for each candidate digital component in the layer, a secret share of a result that indicates whether the accumulated value is equal to a specified value (520). The specified value can be the value zero, as shown in columns 3 and 4 of Table 3. Within the layer, the accumulated value is zero and the total candidate parameter is_dc_a_candidate has a Boolean value of true or one for the digital component that, if any, has the highest selection value among the candidate digital components in the layer.

[0213] The computing systems MPC1 and MPC2 can participate in multiple rounds of computation, e.g., multiple RPCs, as part of a secure MPC process to compute the equality acc i == 0 for each digital component i according to the secret shares. The equality is used to determine whether the accumulated value acc i for a digital component i has the value zero. At the end of the process, the computing system MPC1 has one secret share of the result acc i == 0 for each digital component i in the layer, and the computing system MPC2 has another secret share of the result acc i == 0 for each digital component in the layer.

[0214] The computing systems MPC1 and MPC2 determine secret shares of a winner parameter for each digital component in the layer (522). The computing systems MPC1 and MPC2 can determine the winner parameter is_dc_the_winner i for each digital component i in the layer based on the secret share of the accumulated value acc i == 0 and the secret share of the candidate parameter is_dc_a_candidate i for each digital component i in the layer. The winner parameter is_dc_the_winner i for each digital component i can be a Boolean value that indicates whether the digital component i is a winner of the selection process for the layer, e.g., whether the digital component i is a candidate digital component and has the highest selection value among the candidate digital components in the layer. In some implementations, the computing systems MPC1 and MPC2 can perform a secret share multiplication protocol to compute the winner parameter is_dc_the_winner i = (is_dc_a_candidate i x (acc i == 0)) for each selection value according to the secret shares.

[0215] Computational systems MPC1 and MPC2 determine the selection result (524). Computational systems MPC1 and MPC2 are able to determine the winner by including the winning parameter is_dc_the_winner. i The highest level of the digital components determines the selection result, and the winning parameter is_dc_the_winner. i A value (e.g., Boolean true or 1) indicates that the numeric component is the winner of that layer. This numeric component is the winner of the entire numeric component selection process. Computation systems MPC1 and MPC2 are able to use the accumulated value to determine the highest layer with a winner parameter equal to true or one. For example, computation systems MPC1 and MPC2 can identify the highest layer where the accumulated value of all numeric components in that layer is not zero.

[0216] Computing system MPC1 provides a first secret share (526) of the selection result to client device 110, which receives the digital component request from it. Computing system MPC2 provides a second secret share (528) of the selection result to client device 110, which receives the digital component request from it.

[0217] In the second value selection process involving layers, if the numeric component is in the same layer as the selected numeric component, the selection value for the numeric component is only eligible to provide a second selection value for the selection process. To determine the second selection value, computation systems MPC1 and MPC2 are able to compute the winning layer parameter `maybe_winning_tier` for each layer `t`. t The winning tier parameter may_winning_tier t This indicates whether layer t includes digital components selected for distribution to client device 110. Conceptually, computing systems MPC1 and MPC2 can calculate the winning tier parameter (maybe_winning_tier) for each layer t using the following relation 9. t :

[0218]

[0219] In relation 9, the parameter "T" represents all layers with a higher priority than layer t. Therefore, the winning layer parameter may_winning_tier is used for the layer. t This indicates whether any higher priority layer includes candidate number components. If not, then if layer t includes at least one candidate number component, then layer t is the winning layer.

[0220] RPCs between the computing systems MPC1 and MPC2 can also be used to compute and equality tests with the value zero. Multiple RPCs for various computations can be grouped together into fewer RPCs to reduce latency and network bandwidth consumption between the computing systems MPC1 and MPC2.

[0221] The computing systems MPC1 and MPC2 can then determine whether the second selection value is set by the selection value for the given digital component based on a combination of the candidate parameter is_dc_a_candidate i for the given digital component i (which can be computed as described above with reference to Figure 4 the winning tier parameter maybe_winning_tier t for tier t that includes the given digital component. For example, the second selection value is set by the selection value for the given digital component when is_dc_a_candidate i AND maybe_second_sv i AND maybe_winning_tier t has a Boolean value of true or one.

[0222] The computing systems MPC1 and MPC2 can then determine the second selection value using the selection value for the given digital component. For example, the second selection value can be equal to the selection value for the given digital component or the selection value for the given digital component plus a specified amount.

[0223] The DSPs 150 and digital component providers 160 can generally benefit from knowing the highest other selection values for the digital component process so that they can optimize or improve the selection values they provide for digital components in similar selection processes. For example, a DSP 150 whose digital component was selected can benefit from knowing how much higher its selection value was than the next highest value. Similarly, a DSP 150 whose digital component was not selected can benefit from knowing how much higher the selection value would need to be for the digital component to be selected. When the DSPs 150 and / or digital component providers 160 provide selection values based on this information, the DSPs 150 are more likely to achieve their goals, e.g., avoid wasting money due to a too-high selection value, or avoid missing digital component presentation opportunities due to a low selection value.

[0224] For a DSP 150 or digital component provider 160 whose digital component was selected, the highest other selection value is the second highest selection value. For all other selection values, the highest other selection value is the highest selection value. This is the same for both the first value selection process and the second value selection process.

[0225] Figure 6 is a diagram of an example process 600 for determining a highest other selection value for a digital component in a digital component selection process. The operations of process 600 can be implemented, for example, by computing systems MPCi and MPC2 of MPC cluster 130. The operations of process 600 can also be implemented as instructions stored on one or more computer-readable media, which can be non-transitory, and execution of the instructions by one or more data processing apparatus can cause the one or more data processing apparatus to perform the operations of process 600.

[0226] Computing systems MPCi and MPC2 perform a digital component selection process to select a digital component for distribution to a client device (602). Computing systems MPCi and MPC2 can use secure MPC processes to collaborate to select a digital component, as described above with reference to Figure 3 to Figure 5 .

[0227] Computing systems MPCi and MPC2 determine a first selection value for the digital component selection process (604). The first selection value can be a selection value of a digital component selected for distribution to a client device 110. For example, the first selection value can be a highest selection value of a candidate digital component. If tiers are used, the first selection value can be a highest selection value of a candidate digital component in a highest priority tier that includes at least one candidate digital component.

[0228] Computing systems MPCi and MPC2 can collaborate to determine the first selection value using secure MPC processes. Conceptually, computing systems MPCi and MPC2 can use the following relationship 10 to determine the first selection value:

[0229] first selectionm value =∑(selection_value i x(is_dc_a_candidate i ANDmaybe_first_sv i ))

[0230] The summation can be across all digital components included in the digital component selection process. The selection value for each digital component i (selection_value i ) can be in the clear. As described above, computing systems MPCi and MPC2 can compute secret shares of the candidate parameter is_dc_a_candidate i and the first selection value parameter maybe_first_sv i . Computing system MPCi can store the candidate parameter is_dc_a_candidate iThe first share [is_dc_a_candidate] i,1 ] and the first choice value parameter maybe_first_sv i The first share [maybe_first_sv] i,1 Similarly, the computing system MPC2 is able to store the candidate parameter is_dc_a_candidate for each digital component i. i The second share [is_dc_a_candidate] i,2 ] and the first choice value parameter maybe_first_sv i The second share [maybe_first_sv] i,2 ].

[0231] Computing systems MPC1 and MPC2 determine a second selection value (606) for the digital component selection process. The second selection value can be the next highest selection value after the selection value of the digital component selected for distribution to client device 110. For example, the second selection value can be the second highest selection value of a candidate digital component. If a layer is used, the second selection value can be the second highest selection value of a candidate digital component in the highest priority layer that includes at least one candidate digital component.

[0232] Computing systems MPC1 and MPC2 can collaborate to determine a second selection value using a secure MPC process. Conceptually, computing systems MPC1 and MPC2 can determine the second selection value using the following relation 11:

[0233] second selection value=∑(selection_value i x(is_dc_a_candidate i ANDmaybe_second_sv i ))

[0234] This summation enables the selection of all digital components across the digital component selection process. As described above, computing systems MPC1 and MPC2 are capable of calculating the candidate parameter is_dc_a_candidate. i The second choice value parameter may_second_sv i The secret share. The computing system MPC1 is able to store the second choice value parameter maybe_second_sv for each digital component i. i First share

[0235] [maybe_second_sv i,1Similarly, computing system MPC2 can store a second selection value parameter maybe_second_sv i of the second share

[0236] [maybe_second_sv i,2 ].

[0237] In relations 10 and 11, the Boolean values true and false can be treated as one and zero, respectively. In secret shares, computing systems MPC1 and MPC2 compute the result of an AND operation of both relations 10 and 11 using secret shares (e.g., using RPCs between the computing systems), and represent the result as two additive secret shares in Z2 space (e.g., add then mod 2). Thus, each computing system can store secret shares of the first selection value and the second selection value. For example, computing system MPC1 can store a first share of the first selection value and a first share of the second selection value. Similarly, computing system MPC2 can store a second share of the first selection value and a second share of the second selection value. The sum (e.g., add then mod 2) of the two shares of the first selection value is equal to the first selection value, and the sum (e.g., add then mod 2) of the two shares of the second selection value is equal to the second selection value.

[0238] The relations 10 and 11 can be simplified by replacing the multiplication with a bitwise AND operation between each selection value in selection_value i and a 1-bit secret share of the result of an AND operation between the candidate parameter and the first selection value parameter (or the second selection value parameter) held by each computing system MPC1 and MPC2. Furthermore, the summation of relations 10 and 11 can be replaced with a bitwise XOR operation.

[0239] For each digital component, computing systems MPC1 and MPC2 compute the highest other selection value (608). Computing systems MPC1 and MPC2 can compute the highest other selection value for a digital component using a two-step process in secret shares. Computing systems MPC1 and MPC2 can compute a winner parameter is_dc_the_winner i for digital component i. Computing systems MPC1 and MPC2 can compute the winner parameter is_dc_the_winner i using a secret share of the candidate parameter is_dc_a_candidate i and a secret share of the first selection value parameter maybe_first_sv i , e.g., is_dc_the_winner i = is_dc_a_candidatei AND maybe_first_sv i .

[0240] Then, computing systems MPCi and MPC2 can use relationship 12 to compute the highest other selection value (HOSV i ) for digital component i:

[0241] HOSV i = (is_dc_the_winner i x second selection value) + ((1 - is_dc_the_winner i ) x first selection value)

[0242] Because the winner parameter, the first selection value, and the second selection value are held by computing systems MPCi and MPC2 in secret shares, computing systems MPCi and MPC2 cooperatively determine the highest other selection value using RPCs between the two computing systems MPCi and MPC2.

[0243] At the end of this process, computing system MPCi stores the first share of the highest other selection value for digital component i [HOSV i,1 ], and computing system MPC2 stores the second share of the highest other selection value for digital component i [HOSV i,2 ].

[0244] Computing system MPCi sends the first share of the highest other selection value for each digital component to, for example, the DSP 150 or digital component 160 corresponding to the digital component (610). Similarly, computing system MPC2 sends the second share of the highest other selection value for each digital component to, for example, the DSP 150 or digital component 160 corresponding to the digital component (612). In some embodiments, computing systems MPCi and MPC2 provide the shares to an aggregation service that aggregates the information for each DSP 150 and / or each digital component provider 160.

[0245] The recipients of the two secret shares can combine the shares to derive the highest other selection value for a digital component in the digital component selection process. For example, if an additive secret share algorithm is used, the recipients can derive the highest other selection value by adding the two shares together.

[0246] The computing systems MPC1 and MPC2 can transmit additional data with the highest other selection values. For example, the computing systems MPC1 and MPC2 can transmit the contextual signals of the digital component selection processes, e.g., lookup keys, that have shares of the highest other selection values. In this way, the landscape of selection values for digital component selection processes with the same or similar context can be computed using the highest other selection values for digital component selection processes with the same or similar context.

[0247] In some implementations, to improve performance, the computing systems MPC1 and MPC2 can compute the highest other selection values asynchronously after providing the selection results of the digital component selection processes to the client device 110. This reduces the latency of transmitting and displaying the digital components. In some implementations, the computing systems MPC1 and MPC2 can compute the highest other selection values when the load on the computing systems MPC1 and MPC2 is below a baseline load.

[0248] For selection processes that include a floor for selection values, additional steps can be taken to accurately compute the highest other selection values. The computing systems MPC1 and MPC2 can compute the highest other selection values as described with reference to Figure 6 Then, the computing systems MPC1 and MPC2 can adjust the highest other selection values to account for the floor, e.g., so that no selection value is less than the applicable floor.

[0249] Let H represent the computed highest other selection values, and F represent the applicable floor. The final highest other selection values will be (H > F) x H + (1 - H > F), which is equivalent to F + (H > F) x (H - F).

[0250] To protect user privacy, H is in the form of a secret share. Each computing system MPC1 and MPC2 holds one of the secret shares [H1] and [H2], respectively. The computing system MPC1 can use relation 13 to compute the first share of the final highest other selection value in the secret share:

[0251] [HOSV1] = F + ([H1] > F) x ([H1] - F) Similarly, the computing system MPC2 can use relation 14 to compute the second share of the final highest other selection value in the secret share:

[0252] [HOSV2] = F + ([H2] > F) x ([H2] - F) The process for computing the highest other selection values for digital component processes that include a floor can employ three or more rounds of RPC for comparison tests, and one round for multiplication.

[0253] When tiers and / or boosts are used in the digital component selection process, the first selection value - e.g., the selection value for the selected digital component - can be lower than the highest selection value among the candidate digital components. For example, if a candidate digital component in a highest priority tier has a lower selection value than a candidate digital component in a lower priority tier, the candidate digital component in the higher priority tier can be selected, despite having a lower selection value. Similarly, a digital component can receive a boost that makes the selection value used in the digital component selection value higher than unboosted (or less boosted) digital components, such that the publisher receives fewer digital components than it would have had if the unboosted digital components were selected. The MPC cluster 130 is able to determine the difference between the two values, enabling the publisher to analyze the opportunity cost associated with tiers and / or boosts.

[0254] Figure 7 is a flowchart of an example process 700 for determining a difference between a first selection value of a real digital component selection process and a first selection value of an counterfactual digital component selection process. The operations of process 700 can be implemented, for example, by computing systems MPCi and MPC2 of MPC cluster 130. The operations of process 700 can also be implemented as instructions stored on one or more computer-readable media, which can be non-transitory, and execution of the instructions by one or more data processing apparatus can cause the one or more data processing apparatus to perform the operations of process 700.

[0255] Computing systems MPCi and MPC2 perform a real digital component selection process (702). Computing systems MPi and MPC2 can perform a real digital component selection process to select a digital component to provide to a client device 110 in response to a digital component request. The real digital component selection process can include tiers for digital components and / or boosts for one or more of the digital components included in the digital component selection process. For example, the real digital component process should be the same or similar to Figure 3 to Figure 5 the process of process 400.

[0256] Computing systems MPCi and MPC2 perform a counterfactual digital component selection process (704). The steps of the counterfactual digital component process can be similar to the steps of the real digital component selection process. However, in the counterfactual digital component selection process, the tiers and / or boosts of the real digital component selection process are removed. If the real digital component selection process includes tiers (e.g., as in process 400 of Figure 4 ), the counterfactual digital component selection process groups all of the digital components in one group (e.g., as in process 500 of Figure 5If the real digital component selection process includes boosting the selection values of one or more digital components, those boosts are removed in the counterfactual digital component selection process. That is, the selection values in the counterfactual digital component selection process can be the received selection values, not the boosted selection values.

[0257] The computing systems MPC1 and MPC2 determine a clearing value for the real digital component selection process (706). The clearing value can be based on the selection values of the selected digital components. For example, the clearing value can be the amount of the selection values that will actually be provided to the publisher for display of the selected digital components. If the selection values of the digital components are boosted, the amount of the boost will only affect the order of the selection values when determining the aggregate values for each candidate digital component in operation 414.

[0258] For the second value selection process, the clearing value will be based on the next highest selection value after the selection value of the selected digital component. If tiers are used with the second selection value process, the next highest value will be the next highest value in the same tier as the selected digital component. If there is no such candidate digital component in the same tier, the next highest value can be the minimum value used for the digital component selection process.

[0259] The computing systems MPC1 and MPC2 determine a clearing value for the counterfactual digital component selection process (708). The clearing value can be based on the digital components selected in the counterfactual digital component selection process. For the second value selection process, the clearing value will be based on the next highest selection value after the selection value of the selected digital component, similar to the clearing value for the real digital component selection process.

[0260] The computing systems MPC1 and MPC2 determine a difference between the two clearing values (710). The computing systems MPC1 and MPC can determine the difference by subtracting the clearing value for the counterfactual digital component selection process from the clearing value for the real digital component selection value.

[0261] The computing systems MPC1 and MPC2 provide the difference to the recipient (712). For example, one of the computing systems can provide the difference to the publisher that displays the digital components in the resource or application content after selection. In another example, one of the computing systems can provide the difference to an aggregation server that aggregates the differences for the publishers. In either example, the computing systems can provide data indicating the difference, a context signal for the real digital component selection process such as a lookup key, and data identifying the publisher if sent to an aggregation server.

[0262] The aggregation server can aggregate the differences reported for each publisher and provide data indicating the opportunity cost of using the layer and / or the lift, for example, in the form of an interactive user interface. In some implementations, the computing system MPC1 or MPC2 can also provide the selection results for each real digital component selection process to the aggregation server. In this way, the aggregation server can aggregate the opportunity cost for each DSP 150 and / or digital component provider 160.

[0263] To reduce the latency of providing the selected digital component of the real digital component selection process to the client device 110, some or all of the steps 704-712 of the process 700 can be performed asynchronously, for example, after providing the selection results to the client device 110.

[0264] Figure 8 is a flowchart of an example process 800 for determining whether a user is a member of a group of users using a Bloom filter sent using secret shares. The operations of the process 800 can be implemented, for example, by the application 112 running on the client device 110 and the computing systems MPC1 and MPC2 of the MPC cluster 130 of Figure 1 . The operations of the process 800 can also be implemented as instructions stored on one or more computer-readable media, which can be non-transitory, and execution of the instructions by one or more data processing apparatus can cause the one or more data processing apparatus to perform the operations of the process 800.

[0265] Sending data representing the group membership of a user using a Bloom filter can reduce the amount of data being sent and protect user privacy because the data identifying the group of users of the user is not sent in the clear. To prevent the computing systems MPC1 and MPC2 from being able to access the group membership of the user in the clear, the application 112 can send each computing system 112 a respective share, for example, a secret share of a Bloom filter, instead of sending the full Bloom filter to each computing system MPC1 and MPC2. However, this can require sending data equivalent to sending two Bloom filters, one to each computing system MPC1 and MPC2. To prevent this and further reduce the amount of data sent from the client device 110 across the network 105 to the computing systems MPC1 and MPC2, the application 112 can send to one of the computing systems, for example, the computing system MPC1, a first array generated using a random number and the original Bloom filter created by the application 112 and only send the random number to the other computing system MPC2. In this way, only one array is sent from the client device 110. Since the random number can be small, for example, 16 bytes, this greatly reduces the amount of data sent from the client device 110, which reduces the bandwidth consumption, latency, and battery consumption of the client device 110.

[0266] Although process 800 is described in terms of a Bloom filter representing user membership in a user group, a similar process can be used to generate a Bloom filter representing blocked digital components and to query whether a digital component is blocked. In this example, the Bloom filter will represent identifiers of blocked digital components rather than identifiers of user groups.

[0267] The configuration of the Bloom filter can be adapted to transmission and / or processing by computing systems MPC1 and MPC2. Parameters of the Bloom filter include the number of user groups that can be represented by the Bloom filter, the desired false positive rate of the Bloom filter, the number of hash functions used to generate the Bloom filter and to test whether an element is included in the Bloom filter, and the size of the Bloom filter.

[0268] By reducing the number of hash functions, the computational burden on computing systems MPC1 and MPC2 is reduced when querying whether a user is a member of a user group. However, if the size of the Bloom filter remains constant, this can increase the false positive rate. If there is a target false positive rate, reducing the number of hash functions can result in a larger Bloom filter size, which can increase the amount of bandwidth consumed. Thus, the parameters of the Bloom filter can be selected using a tradeoff between bandwidth / battery consumption and computational burden on computing systems MPC1 and MPC2.

[0269] Application 112 generates a Bloom filter (802). Application 112 can generate a Bloom filter using a user group identifier for a user group that includes users of application 112 as members. To do so, application 112 uses each hash function of the Bloom filter to map the user group identifier to one of the locations in the Bloom filter. Application 112 can perform this operation for each user group identifier for a user. When constructing a Bloom filter for blocked digital components, application 112 can apply each hash function of the Bloom filter for blocked digital components to an identifier for each blocked digital component. The Bloom filter is an array of bits A of size N, each bit of the Bloom filter is zero or one, i.e., A[i] e {0, 1}.

[0270] Application 112, as well as computing systems MPC1 and MPC2, can agree on a pseudo-random function (PRF) in advance. The PRF can take two parameters and generate a PRF number in {0, 1}, which includes 0 and 1.

[0271] Application 112 selects a random number (804). For each digital component request, application 112 can select a random number to share with only one of computing systems MPC1 or MPC2, e.g., randomly or pseudo-randomly. In this example, the random number is shared with computing system MPC2.

[0272] The application 112 computes a first array A1 using the Bloom filter and the random number (806). The application 112 can compute the first array A1 using an agreed PRF. For example, the application 112 can compute the first array A1 using relation 15:

[0273] A1[i] = A[i] XOR PRF(nonce, i)

[0274] In relation 15, the XOR operation is a bitwise XOR operation.

[0275] The application 112 sends the first array to the computing system MPC1 (808). The application 112 also sends the random number to the computing system MPC2 (810).

[0276] The computing system MPC2 computes a second array A2 using the random number (812). The computing system MPC2 can compute the second array A2 using the random number and a PRF. For example, the computing system MPC2 can compute the second array A2 using relation 16:

[0277] The computing systems MPC1 and MPC2 use the first array A1 and the second array A2 to determine whether the user is a member of one or more user groups (814). In general, a Bloom filter can be queried by applying each hash function of the Bloom filter to a user group identifier to determine the element of the Bloom filter corresponding to the hash function and the user group identifier. If the element of each hash function has a value of one for the user identifier, this would indicate that the user is a member of the group. Of course, due to the nature of Bloom filters, there can be some false positives.

[0278] Since neither of the computing systems MPC1 and MPC2 has access to the complete Bloom filter (rather, each has only a secret share of the Bloom filter), the computing systems MPC1 and MPC2 can use a cryptographic protocol to determine whether the user is a member of a user group identifier using the user group identifier. Some example cryptographic protocols that can be used include garbled circuits and Goldreich-Micali-Wigderson (GMW) protocols.

[0279] In either algorithm, the input to the algorithm (conceptually) is the secret shares of the Bloom filter, i.e., the first array A1 and the second array A2. The output is a secret share of a set of Boolean messages, one for each numerical component, i.e., whether the user is a member of the user group associated with the corresponding numerical component.

[0280] In the GMW protocol, one of the MPC computing systems, e.g., computing system MPC1, creates a truth table, one row for each possible bit pattern of the secret share owned by computing system MPC2. Computing system MPC1, for example, randomly selects its own secret share for the result and computes the secret share for computing system MPC2 for each row based on its own secret share for the result and the possible secret share of computing system MPC2 corresponding to the row. After the truth table is constructed, computing system MPC2 uses an oblivious transfer protocol to take one and only one row from the table based on its own secret share. In this protocol, one computing system transfers one of multiple pieces of information to the other computing system, but does not know which piece, if any, was transferred. This oblivious transfer protocol guarantees that the process does not leak any information to either party.

[0281] The result of querying the Bloom filter for a given user group identifier is a secret share of the user group membership condition parameter for each hash function. The secret share of the user group membership condition parameter can be used in the digital component selection process to determine whether a digital component corresponding to the user group is a candidate for the digital component selection process. For example, if 10 hash functions are used, computing system MPC1 will have 10 first secret shares of the user group membership condition parameter for each user group identifier. Similarly, computing system MPC2 will have 10 second secret shares of the user group membership condition parameter for each user group identifier.

[0282] If the Bloom filter represents identifiers for blocked digital components, computing systems MPC1 and MPC2 can reconstruct the second array and query the Bloom filter in a similar manner. The result of querying this Bloom filter for a given digital component is a blocked condition parameter for each hash function. The secret share of the blocked condition parameter can be used in the digital component selection process to determine whether a digital component is a candidate for the digital component selection process.

[0283] Figure 9 is a block diagram of an example MPC computing system 900. Any of the MPC computing systems described in this document can be implemented using MPC computing system 900. Alternatively, the MPC computing systems can be implemented as one or more servers. However, the architecture and configuration of MPC computing system 900 provides a number of performance improvements over using a general-purpose server arrangement.

[0284] MPC computing system 900 includes a load balancer 910, a pool of services 920, and a pool of log processors 940. Computing system 900 also generates, updates, and otherwise maintains a log 930 and a snapshot 950.

[0285] In some implementations, the MPC computing systems 900 are deployed in various geographic regions to reduce latency in selecting digital components and providing digital components to client devices 110. For example, a cluster of MPCs with two or more MPC computing systems 900 can be deployed in each region of a set of regions. If each MPC cluster includes two MPC computing systems, e.g., MPC1 and MPC2, then each region can include a pair of MPC computing systems 900 operated by different parties. Each instance of MPC1 across all regions can be operated by a first party, and each instance of MPC2 across all regions can be operated by a second party different from the first party.

[0286] The MPC cluster in a region can perform the digital component selection process for digital component requests generated by client devices 110 in that region. For example, instructions for a digital component slot— e.g., a tag— sent to a client device 110 in a particular region can include a reference to a network location of an MPC computing system 900 in the particular region. In this way, the application 112 sends digital component requests and notifications to the MPC computing system 900 in the appropriate region. In another example, a domain name service (DNS) or load balancer 910 selects the MPC computing system 900 that is closest in physical distance to the client device 110.

[0287] MPC1 in a region can collaborate with MPC2 in the same region to select digital components and update the log based on received requests. This reduces latency and consumed bandwidth when performing collaborative computations that require round trips between MPC computing systems 900, as the distance between the MPC computing systems 900 is reduced. This also reduces latency and consumed bandwidth for data transfers— e.g., digital component requests, digital component responses, and impression notifications— between client devices 110 and the MPC computing systems 900.

[0288] In some implementations, the pool of log processors 940 is only enabled in a proper subset of regions for creating snapshots and publishing them to MPC computing systems 900 in other regions. For example, there can be a first MPC computing system MPC1 in each region operated by a first party. A subset of these first MPC computing systems can create snapshots for all of the first MPC computing systems and publish the snapshots to other first MPC computing systems. Similarly, there can be a second MPC computing system MPC2 in each region operated by a second party. A subset of these second MPC computing systems can create snapshots for all of the second MPC computing systems and publish the snapshots to other second MPC computing systems. Importantly, the first MPC computing systems do not share logs or snapshots with the second MPC computing systems, and vice versa, to protect user privacy. However, the first and second computing systems do perform secure MPC processes to process data in the logs, as at least some of the data is sensitive and / or confidential and should not be accessed in plaintext by either computing system. To do so efficiently and without added latency or bandwidth consumption, a subset of the first MPC computing systems and a subset of the second MPC computing systems can be in the same region.

[0289] The load balancer 910 receives requests from the application 112 running on the client device 110. These requests, which can include digital component requests and notifications in the form of HTTP requests in some examples, can include an impression notification that notifies the MPC computing system 900 that a digital component was displayed at the client device 110 and optionally whether the user interacted with the digital component. The impression notification can also include additional information, such as a selection process identifier that identifies the digital component selection process that displayed the displayed digital component. For k-anonymity conditions, the impression notification can also include data that identifies the winner of the actual digital component process and the winner of the counterfactual selection process, so that the MPC computing system 900 can update the impression count for each digital component.

[0290] The load balancer 910 can assign requests to processors of the service pool 920 in a way that balances the load between the processors in the service pool 920. For example, the load balancer 910 can alternate between processors in an order, or monitor the load of each processor and assign requests based on the current load.

[0291] The service pool 920 includes multiple processors, each of which can be implemented as, for example, one or more microprocessors, one or more server-level computers, and / or one or more application-specific integrated circuits (ASICs). The processors of the service pool process incoming requests, which are typically latency sensitive. For example, the processors of the service pool 920 can cooperate with the processors of another MPC computing system 900 to perform a digital component selection process. The processors of the service pool 920 can also update the log 930 based on completed digital component processes and / or received notifications.

[0292] The processors of the service pool 920 can maintain a current database of stored digital components. This database can include current values of parameters and / or conditions for the digital components. For example, for each stored digital component, the database can include selection value(s) or vector, secret shares of parameters for at least some of the conditions, e.g., for conditions that can be computed offline such as k-anonymity and cadence, remaining budget, number of impressions (e.g., for k-anonymity conditions), and / or other data for the digital component used in the digital component selection processes described in this document.

[0293] In some implementations, the database of the service pool is a snapshot. For example, each snapshot can have a version identifier that identifies the version of the snapshot. Both MPC systems should use the same version of the snapshot to operate.

[0294] The log 930 can include multiple types of logs that store various information related to digital components stored by the MPC cluster. For example, the log 930 can include a log for storing digital components and their corresponding data, e.g., selection values, selection value vectors, lookup keys, corresponding user group identifier(s), conditions, and / or other appropriate information.

[0295] The log 930 can include a log of information for completed digital component requests. Such a log can include a selection process identifier for each digital component selection process, a clearing value for the digital component selection process, and parameters for each digital component included in the digital component selection process. These parameters can include, for example, secret shares of candidate parameters, winning parameters, selection values, and / or accumulated values for the digital component.

[0296] The logs 930 can include logs for parameters that determine whether conditions for a digital component are satisfied. For example, for each digital component, such logs can include the number of impressions, the number of selections, the number of conversions, the total budget, the remaining budget, and / or the number of times the digital component can have been presented (e.g., the number of times selected in a counterfactual selection process for k-anonymity). To protect user privacy and the confidentiality of sensitive user data, in some implementations, the logs 930 contain secret shares of the above information.

[0297] The log processor pool 940 can include processors (e.g., microprocessors, servers, or ASICs) that process the logs 930 and generate snapshots 950 based on the logs. Each snapshot includes updates to the databases maintained by the processors of the service pool 920. For example, if a digital component is selected and displayed at a client device 110, the snapshot can include an updated remaining budget for the digital component and an updated number of impressions for the digital component. The log processor pool 940 can generate snapshots based on the update data in the logs 930 and publish the snapshots to the processors of the service pool 920. The processors of the log processor pool 900 can also publish the snapshots to other MPC computing systems operated by the same party, e.g., if the log processor pool 940 is only enabled at some MPC computing systems 900.

[0298] To reduce the latency in responding to requests, the processors of the service pool 920 can process these requests immediately after receiving the requests. Processes that are less time sensitive can be processed by the processors of the log processor pool 940. For example, the service pool 920 can perform any processes on the critical path of selecting a digital component and providing it to a client device 110. The log processor pool 940 can perform any processes that are not on the critical path. However, updates to the databases should occur quickly to ensure that the latest information is being used to select digital components. Thus, using different sets of processors provided by the architecture as shown by Figure 9 provides that both the digital component selection process and updates to the databases can be performed very quickly.

[0299] Figure 10 is a block diagram of an example computer system 1000 that can be used to perform the operations described above. The system 1000 includes a processor 1010, a memory 1020, a storage device 1030, and an input / output device 1040. Each of the components 1010, 1020, 1030, and 1040 can be interconnected, for example, using a system bus 1050. The processor 1010 can process instructions for execution within the system 1000. In some implementations, the processor 1010 is a single-threaded processor. In another implementation, the processor 1010 is a multi-threaded processor. The processor 1010 can process instructions stored in the memory 1020 or on the storage device 1030.

[0300] Memory 1020 stores information within system 1000. In one implementation, memory 1020 is a computer-readable medium. In some implementations, memory 1020 is a volatile memory unit or units. In another implementation, memory 1020 is a non-volatile memory unit or units.

[0301] Storage 1030 provides mass storage for system 1000. In some implementations, storage 1030 is a computer-readable medium. In various implementations, storage 1030 can include, for example, a hard disk device, an optical disk device, a storage device that is shared over a network by multiple computing devices (e.g., a cloud storage device), or some other large capacity storage device.

[0302] Input / output devices 1040 provide input / output operations for system 1000. In some implementations, input / output devices 1040 can include one or more of a network interface device, e.g., an Ethernet card, a serial communication device, e.g., an RS-232 port, and / or a wireless interface device, e.g., an 802.11 card. In another implementation, input / output devices can include driver devices configured to receive input data and send output data to external devices 1060, e.g., keyboard, printer and display devices. Other implementations, however, can also be used, such as mobile computing devices, mobile communication devices, set-top box television client devices, etc.

[0303] Although an exemplary computing system has been described in Figure 10 implementations of the subject matter and the functional operations described in this specification can be implemented in other types of digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them.

[0304] Embodiments of the subject matter and the operations described in this specification can be implemented in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a computer storage medium for execution by, or to control the operation of, data processing apparatus. Alternatively or additionally, the program instructions can be encoded on an artificially generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal, that is generated to encode information for transmission to suitable receiver apparatus for execution by a data processing apparatus. The computer storage medium can be a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of them. Moreover, while a computer storage medium is not a propagated signal, a computer storage medium can be a source or destination of computer program instructions encoded in an artificially generated propagated signal. The computer storage medium can also be, or be included in, one or more separate physical components or media (e.g., multiple CDs, disks, or other storage devices).

[0305] The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0306] The term "data processing apparatus" encompasses all kinds of apparatus, devices, and machines for processing data, including by way of example a programmable processor, a computer, a system on a chip, or multiple ones of the same. The apparatus can include special purpose logic, e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit). The apparatus can also include, in addition to hardware, code that creates an execution environment for the code of the specification, e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or a combination of one or more of them. The apparatus and execution environment can realize various different computing model architectures, such as web services, distributed computing and grid computing architectures.

[0307] A computer program, which can also be referred to or be part of a program, software, software applications, scripts, or code, can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and it can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program can be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store one or more modules, sub programs, or portions of code). A computer program can be deployed to be executed on one computer or on multiple computers that are located at one site or distributed across multiple sites and

[0308] The processes and logic flows described in this specification can be performed by one or more programmable processors executing one or more computer programs to perform actions by operating on input data and generating output. The processes and logic flows can also be performed by, and apparatus can also be implemented as, special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit).

[0309] Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors. Generally, a processor will receive instructions and data from a read-only memory or a random access memory or both. The essential elements of a computer are a processor for performing actions in accordance with instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto-optical disks, or optical disks. However, a computer need not have such devices. Moreover, a computer can be embedded in another device, e.g., a mobile telephone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a Global Positioning System (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), to name just a few. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including by way of example semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.

[0310] To provide for interaction with a user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device, e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, for displaying information to the user and a keyboard and a pointing device, e.g., a mouse or a trackball, by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback, e.g., visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including acoustic, speech, or tactile input. In addition, a computer can interact with a user by sending documents to and receiving documents from a device that is used by the user; for example, by sending web pages to a web browser on a user’s client device in response to requests received from the web browser.

[0311] Embodiments of the subject matter described in this specification can be implemented in a computing system that includes a back end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front end component, e.g., a client computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the subject matter described in this specification, or any combination of one or more such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network ("LAN") and a wide area network ("WAN"), an inter-network (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks).

[0312] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. In some embodiments, a server transmits data (e.g., an HTML page) to a client device (e.g., for purposes of displaying data to and receiving user input from a user interacting with the client device). Data generated at the client device (e.g., a result of the user interaction) can be received from the client device at the server.

[0313] While this specification contains many specific implementation details, these should not be construed as limitations on the scope of any inventions or of what can be claimed, but as descriptions of particular embodiments of specific inventions. Certain features that are described in this specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented separately or in any suitable subcombination. Moreover, although features can be described above as acting in certain combinations and even initially claimed as such, one or more features from a claimed combination can in some cases be excised from the combination and the claimed combination can be directed to a subcombination or variation of a subcombination.

[0314] Similarly, while operations are depicted in the drawings in a particular order, this should not be understood as requiring such order nor that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing can be advantageous. Moreover, the separation of various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems are generally integrable in a single software product or packaged into multiple software products.

[0315] Thus, particular embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, actions recited in the claims can be performed in a different order and still achieve desirable results. Additionally, the process depicted in the accompanying figures does not necessarily require the particular order shown, or sequential order, to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous.

Claims

1. A computer-implemented method for selecting digital components using multi-party computation (MPC), comprising: The first computing system of the secure multi-party computation system receives digital component requests and random numbers from the client device; An array including shares of a Bloom filter is generated based on the random number and function, wherein the shares of the Bloom filter represent user group identifiers of user groups that include users of the client device as members; For each of a plurality of user group identifiers, one or more second computing systems in cooperation with the secure multi-party computation system use the array to compute a corresponding first secret share of one or more user group membership criterion parameters representing whether the user of the client device is a member of the user group identified by the user group identifier. For each of the multiple digital components: Identify a given user group identifier corresponding to the digital component; and In cooperation with each of the one or more second computing systems, a first secret share of a candidate parameter is calculated based at least on a first secret share of a membership condition parameter corresponding to a given user group identified by the given user group identifier and a second secret share of the membership condition parameter corresponding to the given user group identified by the given user group identifier held by each of the one or more second computing systems, wherein the candidate parameter indicates whether the digital component is a qualified candidate requested by the digital component; Based on the first secret share of the candidate parameters for each digital component and the selection value for each digital component, a first secret share representing the selection result of the selected digital component is generated; and The first secret share of the selection result is sent to the client device.

2. The computer-implemented method according to claim 1, wherein, The first secret share of the user group membership qualification parameters is calculated in cooperation with the one or more second computing systems, including using either a scrambled circuit protocol or a Goldreich-Micali-Wigderson GMW protocol to calculate the first secret share of the user group membership qualification parameters.

3. The computer-implemented method according to claim 1, wherein, The first secret share of the candidate parameter is calculated in collaboration with each of the one or more second computing systems, including calculating the first secret share of the candidate parameter based on the corresponding secret share of the parameter for one or more additional conditions.

4. The computer-implemented method according to claim 1, further comprising: Receive additional random numbers for an additional Bloom filter on the set representing the blocked digital components; Generate an additional array representing the share of the additional Bloom filter; as well as For one or more of the plurality of digital components, in cooperation with the one or more second computing systems, the additional array is used to compute a first secret share of a blocking condition parameter indicating whether the digital component is blocked at the client device, wherein the candidate parameter for the digital component is based on the blocking condition parameter.

5. The computer-implemented method according to claim 1, wherein, The first secret share of the selection result includes a result calculated by performing a bitwise XOR operation between the secret share of the selection result and a second mask received from the client device.

6. The computer-implemented method according to claim 1, wherein, The first computing system includes a service pool, which includes a set of processors and a load balancer that balances the computing load among the set of processors.

7. The computer-implemented method according to claim 6, wherein, The first computing system includes a log processor pool, which includes an additional set of processors that generate snapshots based on updates to logs containing data related to the completed digital component selection process, and provide the snapshots to the service pool.

8. A system for selecting digital components using multi-party computation (MPC), comprising: One or more processors; as well as One or more storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform the method according to any one of claims 1-7.

9. A computer-readable storage medium carrying instructions that, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 7.

10. A computer program product comprising instructions that, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 7.

Images