Flexible content selection process using secure multi-party computation

Abstract

This document relates to ways of selecting digital components using secure MPC to protect user privacy and the security of data involved in each party in the selection process. In one aspect, a method includes receiving, by a first server of a secure MPC system, a digital component request from a client device. The first server identifies a selection value and a priority tier for each digital component in a set. For each tier, the first server cooperatively determines, with one or more second servers of the secure MPC system, a first secret share of a winner parameter for each digital component in the priority tier using a secure MPC process. The first server identifies that a given digital component has a highest tier of the winner parameter that indicates that the given digital component is a winning digital component.

Description

Technical Field

[0001] This manual covers cryptography and data security. Background Technology

[0002] Secure multi-party computation (MPC) is a family of cryptographic protocols that prevents access to data by distributing computation across multiple parties, ensuring that no single party can access another party's data or intermediate computational values, while the output is released only to the designated party. MPC computation systems typically use secret shares or other encrypted forms of data to perform computations and securely exchange information between the parties. Summary of the Invention

[0003] Typically, an innovative aspect of the subject matter described in this specification can be embodied in a method comprising: receiving a digital component request from a client device by a first server of a secure multi-party computation (MPC) system; for each digital component in a set of digital components, identifying a selection value for the digital component and a priority level of the digital component; for each of a plurality of priority levels: using a secure MPC process in cooperation with one or more second servers of the secure MPC system to determine a first secret share of a winner parameter for each digital component in the priority level, including: for each digital component in the priority level, determining a first secret share of a candidate parameter indicating whether the digital component is a candidate for selection; and determining a secret share of a winner parameter for each digital component in the priority level based on (i) a first secret share of the value of the candidate parameter for each digital component in the priority level, (ii) one or more second secret shares of the candidate parameter for each digital component in the priority level, and the selection value of each digital component in the priority level; identifying the highest level in the plurality of levels where a given digital component has a winner parameter, the winner parameter indicating that the given digital component is the winning digital component of the level; and providing the client device with the first secret share of the identified selection result of the given digital component. Other embodiments of this aspect include corresponding apparatus, systems, and computer programs configured to perform aspects of methods encoded on computer storage devices.

[0004] These and other implementations can each optionally include one or more of the following features. In some aspects, using a secure MPC process in cooperation with one or more second servers of the secure MPC system to determine the first secret share of the winner parameter for each digital component in a priority tier includes determining the first secret share of the winner parameter for each digital component in each priority tier in parallel. This embodiment is particularly advantageous because it can increase the speed of performing the entire digital content selection process.

[0005] In some aspects, using a secure MPC process in cooperation with one or more second servers of a secure MPC system to determine the first secret share of the winner parameter for each digital component in a priority hierarchy includes: determining the first secret share of the winner parameter for each digital component in each priority hierarchy in a sequence from the highest priority hierarchy to the lowest priority hierarchy. This embodiment is particularly advantageous when processing speed is not critical. Conversely, if higher priority hierarchies include winning digital components, this particular embodiment uses computational resources efficiently by avoiding wasted computation on lower priority hierarchies.

[0006] In some aspects, for each digital component in the priority hierarchy, determining the first secret share of a candidate parameter indicating whether the digital component is a candidate for selection includes: collaborating with each of one or more second servers to determine the first secret share of a candidate parameter for a particular digital component based on a secret share of one or more conditions of the particular digital component.

[0007] In some aspects, for each digital component in the set of digital components, identifying the selection value of the digital component includes: for a given content platform, identifying the enhancement established by the publisher or content platform of the electronic resource that receives the digital component request for it; and using the enhancement to adjust the selection value of each digital component of the content platform.

[0008] Some aspects include: identifying a lower limit for selection values ​​established by the publisher of an electronic resource that receives a request for its digital components; and filtering one or more digital components from the set of digital components that have selection values ​​below the lower limit. Those digital components filtered from the set of digital components may correspond to unnecessary and / or irrelevant digital components (because they have selection values ​​below the lower limit). Therefore, filtering out unnecessary digital components in this way can reduce network bandwidth and computing resource usage, thereby making the entire content selection process more efficient.

[0009] In some aspects, determining the secret share of the winner parameter for each digital component in a priority tier includes: sorting the digital components in the priority tier based on the selection value of each digital component in the priority tier; determining a first secret share of the accumulated value of each digital component in the tier based at least on the sorting and a first secret share of the candidate parameters of each digital component in the priority tier, wherein the accumulated value of the digital component indicates the number of candidate digital components in the priority tier that have a higher selection value than the digital component; and for each digital component in the priority tier, determining the first secret share of the winner parameter of the digital component based on the first secret share of the candidate parameters of the digital component, each of one or more second secret shares of the candidate parameters of the digital component, and the accumulated value of the digital component. Some aspects include determining a second selection value corresponding to the second value selection process, including: for each priority level, determining a first secret share of a winning level parameter indicating whether a given digital component is included in the priority level; for each digital component in the set of digital components, determining a first secret share of a second selection value parameter indicating whether the selection value of the digital component is likely to be the second highest selection value in the set of candidate digital components; identifying the selection value of a digital component that holds true for it as the second selection value: (i) the candidate parameter of the digital component indicates that the digital component is a candidate for selection, (ii) the winning level parameter indicates that a given digital component is included in the winning level, and (iii) the second selection value parameter indicates that the selection value of the digital component is likely to be the second highest selection value in the set of candidate digital components.

[0010] The subject matter described in this specification can be implemented in specific embodiments to achieve one or more of the following advantages. Using a secure MPC process performed by two or more MPC servers operated by different parties to select digital components based on a share of user information ensures that neither the MPC server nor another party can access user information in plaintext unless there is unauthorized collusion between the MPC servers. In this way, user data privacy is protected as long as at least one MPC server is honest.

[0011] During the digital component selection process, the MPC server can choose from qualified digital components that meet one or more eligibility criteria, while preventing parties from accessing user information in plaintext. Eligibility criteria can include restrictions and guidelines regarding the method or frequency of digital component distribution, as well as other factors. Criteria can include user group membership, frequency control, muting (e.g., user blocking), k-anonymity to prevent micro-targeting of users, and / or pacing, and budget constraints.

[0012] Since the selection of digital components is an online process that typically occurs while content is loading on the client device, it is important to complete this process quickly (e.g., within milliseconds). The techniques described in this document enhance the speed of digital component selection by reducing the amount of data transferred between the client device and the MPC cluster, by reducing the computing resources required by the MPC cluster, and by reducing the number of round-trip communications / computations performed by the servers in the MPC cluster and the amount of data transferred between the servers. The reduction in the amount of data between the client device and the server also reduces network bandwidth consumption and battery consumption on the client device, for example, if the client device is a mobile device operating on battery power.

[0013] A user's client device can generate a probabilistic data structure (e.g., a Cuckoo filter or a Bloom filter) representing a user group that includes the user as a member, and can provide this probabilistic data structure or data representing it to the MPC cluster's server. Using the probabilistic data structure in this way protects user privacy and maintains data security by preventing access to the user's group membership, and reduces the size of the information provided to the MPC cluster because the probabilistic data structure is a compact representation of the dataset. The ability to generate data representing the probabilistic data structure and send it to the MPC server ensures that no party receiving only a portion of the data can access the user's group membership without other parts or cooperation with other MPC servers (e.g., using a secure MPC process). The reduced data size decreases the amount of bandwidth consumed in transmitting information, reduces transmission latency, and reduces the amount of processing power required by battery-powered devices (e.g., mobile devices) and associated battery power for transmitting information.

[0014] MPC clusters can transmit a secret share of the results identifying the selected digital components chosen by the MPC cluster using a secure MPC process. By sending only the secret share of the results for the selected digital components, rather than information about all digital components or a large set of digital components, latency in transmitting and receiving results and the bandwidth, processing power, and battery power consumed are similarly reduced. This also reduces the potential leakage of confidential information from the content platform that submits the selection values ​​of digital components to the MPC cluster by limiting the number of digital components that provide their information to client devices.

[0015] Reducing content presentation latency also reduces the number of errors occurring on the user's device while waiting for such content to arrive. Since content typically needs to be delivered to wirelessly connected mobile devices within milliseconds, minimizing the latency of selecting and delivering content is crucial for preventing errors and reducing user frustration.

[0016] The secure MPC technique described in this document is flexible and supports different types of selection processes and / or additional selection process features, such as floor, tier, and / or boost. This secure MPC technique implements these features while still protecting user privacy and data security. When using tiers, multiple selection processes can be executed in parallel to reduce latency in selecting digital components, or sequentially to reduce unnecessary computation. Metrics that can be used to improve the efficiency of the digital component selection process can be aggregated and reported to the appropriate parties in a privacy-preserving manner.

[0017] Details of one or more embodiments of the subject matter described herein are set forth in the accompanying drawings and the following description. Other features, aspects, and advantages of the subject matter will become apparent from the description, drawings, and claims. Attached Figure Description

[0018] Figure 1 This is a block diagram of the environment in which the MPC cluster performs a secure MPC process to select digital components for distribution to client devices.

[0019] Figure 2 It shows Figure 1 An example data stream within an environment.

[0020] Figure 3 This is a diagram illustrating an exemplary process for selecting digital components to be distributed to client devices.

[0021] Figure 4 This is a diagram illustrating an exemplary process for selecting digital components to be distributed to client devices.

[0022] Figure 5 This is a diagram illustrating an exemplary process for selecting digital components to be distributed to client devices.

[0023] Figure 6 This is a diagram of an exemplary process for determining the highest alternative selection value for a digital component during the selection process.

[0024] Figure 7 It is a flowchart of an exemplary process for determining the difference between a first selection value in a true digital component selection process and a first selection value in a counterfactual digital component selection process.

[0025] Figure 8 This is a flowchart of an exemplary process for determining whether a user is a member of a user group using a Bloom filter that utilizes secret shares.

[0026] Figure 9 This is a block diagram of an exemplary MPC computing system.

[0027] Figure 10 This is a block diagram of an exemplary computer system.

[0028] The same reference numerals and names in the various figures indicate the same elements. Detailed Implementation

[0029] This document typically describes systems and technologies for selecting digital components using secure MPC to protect user privacy and safeguard the security of data for each party involved in the selection process. Enhancements to the selection process support multiple variations of the digital component selection process, providing content publishers and platforms with flexibility in managing digital component selection while maintaining user privacy and data security. For example, the MPC cluster described in this document is capable of performing secure digital component selection processes that include hierarchical, selection value promotion, first-value selection, second-value selection, and / or combinations of one or more of these variations. The technologies described in this document allow for this flexibility, privacy protection, and data security while still providing digital components within a short timeframe (e.g., within milliseconds) after a request is received, and simultaneously minimizing the size of data sent to and from the client devices displaying the digital components.

[0030] MPC clusters can also generate information, such as metrics, based on the completed selection process, which can be used to further enhance future digital component selection processes. This information can be generated using secure MPC, ensuring that user data and publisher / / or content platform data are inaccessible without unauthorized collusion between the MPC cluster's servers and / or other parties. Information can be reported to appropriate parties in encrypted form (e.g., as a secret share), allowing only the recipient to access the information in plaintext. To protect user privacy, in some implementations, it is anticipated that the recipient can access the information in plaintext with differential privacy noise applied and / or in aggregate form. Plaintext is uncomputed, specially formatted, or code- or data-based (including binary files) text that can be viewed or used without the need for keys or other decryption devices or processes.

[0031] In this document, some calculations performed by the MPC cluster on secret shares are shown as products or sums of secret share values. To improve the speed of performing these calculations, multiplication on secret shares can be performed using AND operations (e.g., bit-by-bit AND), and addition on secret shares can be performed using XOR operations (e.g., bit-by-bit XOR). In some cases, when a plaintext integer is multiplied by a secret share representing zero or one in Z2 (i.e., the sum of the two shares modulo 2 is zero or one), multiplication or bit-by-bit AND is not required. Instead, each computation system can evaluate its share and return an integer if its share is one and zero if its share is zero.

[0032] Figure 1 This is a block diagram of an environment 100 in which MPC cluster 130 performs a secure MPC process to select digital components for distribution to client devices 110. MPC cluster 130 also generates information about the completed digital component selection process and provides this information to the appropriate parties.

[0033] Exemplary environment 100 includes a data communication network 105, such as a local area network (LAN), a wide area network (WAN), the Internet, a mobile network, or a combination thereof. Network 105 connects client devices 110, a secure MPC cluster 130, a publisher 140, a website 142, and content platforms, such as a supply-side platform (SSP) 170 and a demand-side platform (DSP) 150. Exemplary environment 100 can include many different client devices 110, secure MPC clusters 130, publishers 140, websites 142, DSPs 150, and SSPs 170.

[0034] Website 142 includes one or more electronic resources 145. Resources 145 can be associated with a domain name and hosted on one or more servers. An exemplary website is a collection of web pages formatted in Hypertext Markup Language (HTML), which can contain text, images, multimedia content, and programming elements such as scripts. Each website 142 is maintained by a content publisher 140, which is the entity that controls, manages, and / or owns the website 142.

[0035] Resource 145 is any data that can be provided by publisher 140 via network 105 and can be associated with a resource address. Resources include HTML pages, word processing documents and portable document format (PDF) documents, images, videos, and feed sources, to name a few. Resource 145 can include content such as words, phrases, images, etc., and can include embedded information (e.g., metadata and hyperlinks) and / or embedded instructions, such as scripts.

[0036] Client device 110 is an electronic device capable of communicating via network 105. Exemplary client device 110 includes a personal computer, a mobile communication device (e.g., a smartphone), and other devices capable of sending and receiving data via network 105. Client device 110 may also include a digital assistant device that accepts audio input via a microphone and outputs audio via a speaker. When the digital assistant detects a “hot word” or “hot phrase” that activates the microphone to accept audio input, it can be put into listening mode (e.g., ready to accept audio input). The digital assistant device may also include a camera and / or display to capture images and visually present information. The digital assistant can be implemented in various forms of hardware devices, including wearable devices (e.g., watches or glasses), smartphones, speaker devices, tablet devices, or other hardware devices. Client device 110 may also include digital media devices, such as streaming devices that plug into a television or other display to stream video to the television, gaming systems, or virtual reality systems.

[0037] Client device 110 typically includes applications 112, such as web browsers and / or native applications, to facilitate sending and receiving data over network 105. Native applications are applications developed for a specific platform or device (e.g., for mobile devices with a specific operating system). Publisher 140 is able to develop native applications and provide them to client device 110, for example, making them available for download. A web browser can request resource 145 from a web server hosting website 142 of publisher 140, for example, in response to a user of client device 110 entering the resource address of resource 145 in the web browser's address bar or selecting a link referencing the resource address. Similarly, native applications can request application content from a publisher's remote server.

[0038] Some resources, application pages, or other application content may include digital component slots for displaying digital components together with resource 145 or application pages. As used throughout this document, the phrase "digital component" refers to a discrete unit of digital content or digital information (e.g., a video clip, audio clip, multimedia clip, image, text, or another unit of content). Digital components may be stored electronically as a single file or as a collection of files on a physical storage device, and digital components may take the form of video files, audio files, multimedia files, image files, or text files, and may include advertising information, making advertising a type of digital component. For example, a digital component may be content designed to complement the content of a web page, application content (e.g., an application page), or other resources displayed by application 112. More specifically, a digital component may include digital content related to the resource content; for example, a digital component may relate to the same topic as the web page content, or to a related topic. Thus, the provision of digital components can complement and generally enhance web pages or application content.

[0039] When application 112 loads resources (or application content) that include one or more digital component slots, application 112 can request digital components for each slot. In some implementations, the digital component slots can include code, such as one or more scripts, that, when processed by application 112, causes application 112 to request digital components to display to the user of client device 110. As described below, application 112 can request digital components from MPC cluster 130 and / or one or more SSPs 170.

[0040] Some publishers 140 use SSP 170 to manage the process of obtaining digital components for their resource 145 and / or application 112's digital component slots. SSP 170 is a hardware and / or software-implemented technology platform that automates the process of obtaining digital components for resources and / or applications. Each publisher 140 can have one or more SSPs 170. Some publishers 140 may use the same SSP 170.

[0041] Digital component provider 160 is capable of creating (or otherwise publishing) digital components that are displayed in the digital component slots of the publisher's resources 145 and application 112. For example, digital component provider 160 is capable of creating digital components that include content related to digital component provider 160. In a specific example, a product manufacturer's digital component can include product-related content.

[0042] Digital component provider 160 can use DSP 150 to manage the supply of its digital components for display in digital component slots. DSP 150 is a hardware and / or software-implemented technology platform that automates the process of distributing digital components for display with resources and / or applications. DSP 150 can interact on behalf of digital component provider 160 with multiple SSPs 170 to provide digital components for display with resources 145 and / or applications 112 from multiple different publishers 140. Typically, DSP 150 can (e.g., from SSP 170) receive requests for digital components, generate (or select) selection values ​​for one or more digital components created by one or more digital component providers 160 based on the requests, and provide data related to the digital components (e.g., the digital component itself or code enabling the digital component to be downloaded) and selection parameters to SSP 170. The selection values ​​can indicate the amount that digital component provider 160 is willing to provide for display with digital components or for user interaction with digital components. SSP 170 can then select the digital components to be displayed at client device 110 and provide client device 110 with data that enables it to display the digital components, for example, by providing the digital components or enabling the download of the digital components. As described in more detail below, MPC cluster 130 can select the digital components to be displayed at client device 110 in a manner that protects user privacy.

[0043] In some cases, receiving digital components related to web pages, application pages, or other electronic resources previously accessed and / or interacted with by the user is beneficial to the user. To distribute such digital components to users, users can be assigned to user groups, such as interest groups of users interested in the same or similar topics, groups of similar users, or other group types involving similar user data. Users can be assigned to user groups when they access a specific resource or perform a specific action at that resource (e.g., interacting with a specific item displayed on a web page or adding an item to a virtual shopping cart). User groups can be generated and updated by digital component provider 160. That is, each digital component provider 160 can assign users to its user groups when a user accesses an electronic resource of digital component provider 160. User groups can also be created and / or updated by content platforms (e.g., by DSP 150 and / or SSP 170).

[0044] To protect user privacy, for example, user group membership can be maintained at the user's client device 110 via application 112, the operating system of client device 110, or another trusted program, rather than via a digital component provider, content platform, or other party. In a specific example, the trusted program (e.g., a web browser or operating system) can maintain a list (“user group list”) of user group identifiers (e.g., users logged into the browser, application, or client device 110) of users using the web browser or another application. The user group list can include the user group identifier for each user group that includes the user as a member. The digital component provider 160 or content platform that creates the user group can assign a user group identifier to its user group. The user group identifier can describe the group (e.g., a gardening group) or represent the group using a code (e.g., a non-descriptive alphanumeric sequence). The user's user group list can be stored in a secure storage device at client device 110 and / or can be encrypted at storage to prevent access to the list by others.

[0045] When application 112 displays resources (e.g., web pages), application content, or digital components related to digital component provider 160, the resources, application content, or digital components can request application 112 to add one or more user group identifiers to the user group list. In response, application 112 can add one or more user group identifiers to the user group list and securely store the user group list. For example, a user choosing to view a web page with more information about a specific project can add the user to a user group associated with that specific project.

[0046] In some implementations, MPC cluster 130 can use a user's user group membership to select digital components that the user may be interested in or that are otherwise beneficial to the user / user device. For example, such digital components or other content may include data that improves user experience, improves the operation of the user device, or otherwise benefits the user or client device 110. However, the user group identifier of the user's user group list can be provided and used to prevent the computing systems MPC1 and MPC2 of MPC cluster 130 from accessing the user's user group identifier in plaintext when selecting digital components, thereby protecting user privacy when using user group membership data to select digital components. MPC cluster 130 can also use other conditions to select digital components, as described in more detail below.

[0047] Secure MPC cluster 130 includes two computing systems, MPC1 and MPC2, which perform a secure MPC process to select digital components for distribution to client devices based on a user's group membership, but without accessing group membership or other user information or signals derived from such user information in plaintext. While the exemplary MPC cluster 130 includes two computing systems, more computing systems can be used, as long as the MPC cluster 130 includes more than one computing system. For example, MPC cluster 130 can include three computing systems, four computing systems, or another suitable number of computing systems. Using more computing systems in MPC cluster 130 can provide greater security, but it can also increase the complexity of the MPC process. Each computing system can be a server or other suitable type of computer. Figure 9 An exemplary architecture of an MPC computing system is shown in the figure.

[0048] Computing systems MPC1 and MPC2 can be operated by different entities. In this way, each entity may not be able to access a user's group membership, other user information, or signals derived from such user information in plaintext. For example, one of the computing systems MPC1 or MPC2 can be operated by a trusted party different from the user, publisher 140, DSP 150, SSP 170, and digital component provider 160. For example, an industry group, government group, or browser developer can maintain and operate one of the computing systems MPC1 and MPC2. Other computing systems can be operated by different groups within these groups, such that different trusted parties operate each computing system MPC1 and MPC2. Advantageously, different parties operating different computing systems MPC1 and MPC2 may not have an incentive to collude to compromise user privacy. In some implementations, computing systems MPC1 and MPC2 are architecturally separated and monitored to prevent them from communicating with each other outside of performing the secure MPC processes described in this document.

[0049] Each computing system MPC1 and MPC2 can store digital components (e.g., the idea of ​​a digital component), selection values ​​for digital components, and other information about the digital components. For example, computing systems MPC1 and MPC2 can cache selection values ​​previously received from SSP 170 and / or DSP 150 as part of a previous digital component selection process or otherwise provided to computing systems MPC1 and MPC2 (e.g., pre-provided for use in the digital component selection process). In this way, MPC cluster 130 can use the selection values ​​to select a digital component for distribution to client device 110 in response to a future digital component request received from client device 110. In this document, a digital component whose selection value and other information are stored by MPC cluster 130 for the digital component selection process can be referred to as a stored digital component. However, the digital component itself is not necessarily stored by MPC cluster 130. Instead, MPC cluster 130 can store data for each stored digital component, such as code referencing the network location from which the digital component can be downloaded. In some implementations, the digital component itself is stored by MPC cluster 130 and returned directly to application 112. This implementation reduces the need for application 112 to extract the digital components and / or other information about the digital components from additional requests that may consume the device's battery and bandwidth and may leak additional signals used by the server to host the digital components themselves to track the device.

[0050] For each stored digital component, each computing system MPC1 and MPC2 can store a vector of selection values ​​or values ​​that can be used by computing systems MPC1 and MPC2 to determine the selection value of the digital component. Each computing system MPC1 and MPC2 can also store condition data for each digital component, which defines the conditions that the digital component must satisfy to become a qualified candidate for a given digital component selection process. The stored digital components can have zero or more corresponding conditions.

[0051] An exemplary condition is that the user to whom the selected digital component is provided is a member of the user group corresponding to the stored digital component. This condition can be referred to as a user group membership condition. In this example, computing systems MPC1 and MPC2 are able to store a set of one or more user group identifiers corresponding to the stored digital component. These user group identifiers identify the user group to which the stored digital component can be provided. That is, the stored digital component is merely a candidate for a digital component selection process, which is performed to select a digital component to be provided to a user who is a member of at least one user group identified by the set of one or more user group identifiers of the stored digital component.

[0052] Another exemplary condition for the stored digital components is a frequency cap condition, which indicates that a digital component, or a specific category of digital components, can only be provided to the same user a maximum of times within a given duration. Another exemplary condition for digital components is a blocked digital component condition, which indicates that a digital component has been blocked by the user (e.g., muted). For these exemplary conditions, computing systems MPC1 and MPC2 can receive a probability data structure, such as a Cuckoo filter or a Bloom filter, from the storage device for each of multiple users, representing digital components that cannot be provided to the user. For example, the probability data structure can represent a generic identifier of a digital component that is directly blocked by the user or blocked by the user due to exceeding the frequency at which the digital component is displayed to the user during a given duration.

[0053] Computing systems MPC1 and MPC2 can receive probabilistic data structures from the user's client device 110, for example, by preventing MPC1 or MPC2 from receiving the identifiers in plaintext. For instance, application 112 running on the user's client device 110 can generate a Bloom filter representing the identifiers of blocked digital components, either due to frequency limits or by the user. Application 112 can then provide data to each of the computing systems MPC1 and MPC2, enabling them to collaboratively query the Bloom filter using a secure MPC procedure to determine for the user whether a given digital component is blocked. The computing systems MPC1 and MPC2 use this secure MPC procedure to calculate a secret share of the blocked digital component condition. (Reference) Figure 8 An exemplary process for generating and querying Bloom filters is described.

[0054] In some implementations, the identifier of the blocked digital component can be included in the same probabilistic data structure as the user group identifier and queried using a different hash function. However, the target false positive rate of the blocked digital component can be lower than that of the user group identifier. Therefore, fewer hash functions can be used to generate and query the Bloom filter for the blocked digital component than for the user group identifier. To reduce the data size of the Bloom filter for the blocked digital component, the user group identifier can be represented by a different Bloom filter than the blocked digital component. This reduces the latency of sending the Bloom filter over the network, reduces the bandwidth consumed by sending the Bloom filter, and reduces the battery power used by sending the Bloom filter.

[0055] Another exemplary condition for the stored digital components is a pacing condition for pacing the distribution of digital components over a period of time. Computing systems MPC1 and MPC2 are capable of storing data indicating the total number of times a digital component can be provided over a period of time and / or the maximum budget for a digital component during that period. Computing systems MPC1 and MPC2 are capable of using this information to pac the frequency at which a digital component can be a candidate for the digital component selection process based on this condition (e.g., all the conditions that a digital component must meet to be a candidate). In some embodiments, computing systems MPC1 and MPC2 are capable of implementing a feedback controller, such as a proportional-integral-derivative (PID) controller, that uses a secret share to pac the stored digital components with pacing conditions.

[0056] In this example, computing systems MPC1 and MPC2 are capable of storing the setpoint of the PID controller for the digital component and maintaining the measured variables for the PID controller. Typically, the PID controller is a feedback controller that uses an error value (the difference between the target setpoint and the measured variable) to determine the output that drives the measured variable toward the setpoint. In the context of pacing the distribution of the digital component to client devices, the active setpoint can be impression rate, interaction rate, conversion rate, and / or resource exhaustion rate (e.g., budget expenditure rate). Similarly, the measured variable can be the impression rate, interaction rate, conversion rate, and / or resource exhaustion rate over a given duration. Computing systems MPC1 and MPC2 are also capable of storing fine-tuning parameters for each PID controller. The setpoint, measured variable, and fine-tuning parameters can be stored in secret shares (where each computing system MPC1 and MPC2 stores a corresponding share for each parameter) or in plaintext, depending on the target privacy / data security.

[0057] Another exemplary condition is the k-anonymity condition. A k-anonymity condition can include a k-anonymity rule that requires a digital component to be eligible (or to be selected) for distribution to at least k users within a given duration. The concept of k-anonymity ensures that the data of a particular user is indistinguishable from the data of other users of a threshold number k. The system can enforce the k-anonymity rule, for example, by ensuring that a particular digital component is distributed to client device 110 in response to a request for one or more digital components, and that the same digital component can have been or displayed to a set of at least k users or by at least k applications 112 within a specific time period. In some implementations, each of the k applications 112 to which the digital component can have been or distributed must be for a different user. In this example, computing systems MPC1 and MPC2 can store the value k for the digital component and maintain the number of users to whom the digital component can have been distributed.

[0058] Determining the number of users who can have had a digital component displayed can involve performing a counterfactual digital component selection process in parallel with each actual digital component selection process. In this counterfactual digital component selection process, a digital component can be a candidate if all digital components satisfy all conditions except the k-anonymity condition. If digital components are selected for at least k users or application 112 in the counterfactual digital component selection process, then digital components will have already been displayed to k users if not for the k-anonymity condition. Once this occurs, digital components that satisfy the k-anonymity condition can be included in the actual digital component selection process (assuming other conditions for the digital component are met, if any), excluding digital components with unsatisfied k-anonymity conditions.

[0059] In some implementations, each computing system MPC1 and MPC2 stores information about digital components in a data structure that maps the digital components and their corresponding information to a set of context signals. For example, each digital component may be eligible to be displayed in a presentation environment having resources and / or applications that include the set of context signals. Context signals may include, for example, the topic of the resource, keywords found in the resource, the resource locator, the geographic location of the client device 110, the speech settings of the application 112, the number of digital component slots in the resource, the type of digital component slot, and / or other appropriate context signals. Additionally, a digital component may have multiple corresponding selection values, one selection value for each set of context signals. Using such a data structure enables computing systems MPC1 and MPC2 to identify digital components eligible for use in the digital component selection process. Computing systems MPC1 and MPC2 can then use conditions to identify digital components from these eligible digital components as actual eligible candidates for selection in the digital component selection process. The set of context signals used in determining whether a digital component is eligible can be in the form of a lookup key that allows computing systems MPC1 and MPC2 to look up eligible digital components using the context signals requested by the digital component.

[0060] When a digit component is associated with a corresponding user group identifier that identifies a qualified user group of the digit component, a lookup table (LUT) can be used to store the information. Using a LUT offers some performance advantages, but other suitable data structures can also be used. A LUT maps a context signal, or a lookup key derived from a context signal, to a set of digit components, making the set of digit components eligible for display and / or for its selected values ​​or vectors to qualify, subject to other conditions described in this document. In this way, computing systems MPC1 and MPC2 can store multiple selected values ​​for each digit component, for example, one selected value for each set of context signals.

[0061] In some implementations, the lookup key is a hash-based message authentication code (HMAC) of the context signal. For example, the lookup key could be HMAC(URL, HMAC(language, location)), where the parameter URL is the URL of the resource for which the numeric component and selection value are qualified, the parameter language is the specified language of the application 112 for which the numeric component and selection value are qualified, and the parameter location is the geographic location for which the numeric component and selection value are qualified. If the context signal requested by the numeric component matches these parameters, the numeric component and selection value mapped to the lookup key are qualified for the numeric component selection process used to select the numeric component in response to the request. Other context signals can be used in addition to or in place of URL, location, and language.

[0062] To reduce the amount of bandwidth and latency consumed by transmitting digital component requests via network 105, application 112 can use the same HMAC to calculate the lookup key instead of sending context signals to computing systems MPC1 and MPC2. This also reduces the amount of battery consumed by client device 110 and the amount of data received by each computing system MP1 and MPC2.

[0063] In some implementations, for example, when a digital component is conditional on a user's membership in a user group, a two-level LUT table is used. The first level can be keyed by a request key (UG_Request_Key). UG_Request_Key can be a lookup key in the form of a composite message based on a set of context signals (e.g., the set of context signals requested by the digital component (e.g., URL, location, language, etc.) or the set of context signals for which the digital component is qualified to use for distribution). That is, the first-level LUT can be keyed based on the set of context signals. The key of the first level can be a hash of UG_Request_Key, for example, using a hash function such as SHA256. The key can be truncated to a specified number of bits, for example, truncated to 16 bytes, or another suitable number of bits. The value of each key UG_Request_Key in the first-level LUT can be an indication of the second-level LUT to include the row of data of the digital component that is qualified for the digital component request that includes the context signals of the digital component including UG_Request_Key. An exemplary first-level LUT is shown in Table 1 below.

[0064] key value SHA256(UG_Request_Key) OK… … OK…

[0065] Table 1

[0066] The second-stage LUT can be keyed based on a combination of the user group request key UG_Request_Key and the user group identifier in the first-stage LUT. In some implementations, the second-stage LUT can be an array or other suitable data structure. Each row in the second-stage LUT can be a specific selection value (or a vector of values) for a particular digital component. For example, the DSP150 can submit different selection values ​​for the same digital component, where each selection value is for a different set of context signals and / or a different user group identifier. Therefore, the selection value for a digital component can vary based on the context and user group membership of the user performing the digital component selection process.

[0067] DSP 150 or digital component provider 160 can associate (e.g., link or map) digital components to user groups to which DSP 150 or digital component provider wants to display digital components. For example, DSP 150 might want to display digital components related to fly fishing to men who have shown interest in fly fishing. In this example, DSP 150 can provide MPC cluster 130 with data indicating that the digital component corresponds to a user group identifier that includes men who have shown interest in fly fishing.

[0068] In some implementations, the key for a row in the second-level LUT can be a hash or code generated based on a combination of the user group request key UG_Request_Key and the user group identifier of the row's numeric component. For example, the key can be a combined HMAC, which can be represented as HMAC SHA256 (UG_Request_Key, ug_id). The user group identifier ug_id can be a combination of the user group's internal user group identifier and the domain of the user group's owner (e.g., the DSP, SSP, or digital component provider that owns the user group). For example, the user group identifier ug_id can be a digital digest of the owner's domain eTLD+1 and the user group's owner's internal user group identifier. eTLD+1 is the valid top-level domain (eTLD) plus one more level than the public suffix. An example eTLD+1 is "example.com", where ".com" is the top-level domain. ug_id can be truncated to 16 bytes or another appropriate data size.

[0069] Continuing with the previous fly fishing example, the second-level lookup key for the row containing information about the digital components to be displayed to users in the Men's Fly Fishing group can be a combination of the Men's Fly Fishing group's user group request key UG_Request_Key and user group identifier ug_id. Because digital components can be presented in different contexts, the second-level lookup table can include multiple rows of digital components associated with the Men's Fly Fishing group's user group identifier ug_id, each row having a different user group request key UG_Request_Key and a different value.

[0070] The values ​​in each row of the second-level LUT can be selected values ​​(or a vector of values) of the digital component and other data about the digital component, such as metadata identifying the digital component or the network location from which the digital component can be downloaded. In some implementations, the row can contain, for example, the digital component itself in a web packet format ready to be rendered by application 112.

[0071] This value can be a digital component information element (dc_information_element), which can be a byte array containing selection values ​​and metadata. The byte array can have a specific format that the application 112 or trusted program of client device 110 and computing systems MPC1 and MPC2 can parse to obtain the selection values ​​and metadata. In some implementations, the digital component information element can include the digital component itself. Exemplary second-level LUTs are shown in Table 2 below. When a vector is used to determine the selection value, the selection value can be replaced by the vector in Table 2.

[0072] key value HMAC(UG_Request_Key,UG_ID) {Select value, metadata} … …

[0073] Table 2

[0074] The second-level LUT maps the selection value to a specific digital component, a specific user group identifier (ug_id), and a specific set of context signals defined by the first-level lookup key (UG_Request_Key). In doing so, the second-level LUT indicates the specific context in which the selection value of the digital component is valid for it. This allows the DSP 150 or the digital component provider 160 to specify different selection values ​​for the same digital component for different contexts defined by the context signals and the user's group membership. When a request is received indicating that the user to whom the digital component will be displayed is a member of a specific user group identified by the specific user group identifier (ug_id) and that the digital component will be displayed in a specific context defined by the context signals of the first-level lookup key, any digital component in the second-level LUT with a matching user group identifier and a matching selection value for the first-level lookup key is a candidate to be selected for distribution in response to that request.

[0075] In addition to the descriptions throughout this document, users may be provided with controls (e.g., user interface elements that users can interact with) that allow them to choose whether and when the system, program, or feature described herein can enable the collection of user information (e.g., information about a user's social networks, social behavior, or activities, occupation, user preferences, or user's current location) and whether content or communications are sent to the user from the server. Furthermore, some data may be processed in one or more ways before it is stored or used, resulting in the removal of personally identifiable information. For example, a user's identity may be processed so that personally identifiable information about the user cannot be determined, or location information obtained may be generalized (e.g., to a city, zip code, or state level) so that the user's specific location cannot be determined. Therefore, users can control what information about themselves is collected, how that information is used, and what information is provided to them.

[0076] Figure 2 It shows Figure 1 An exemplary data stream within environment 100. This description includes two types of selection values: selection values ​​conditioned on sensitive user information, such as user group membership or other commercially sensitive information, or parameters whose values ​​change in a way that would allow an unethical party to infer sensitive information, or "conditional selection values"; and selection values ​​not conditioned on sensitive information, or "unconditional selection values". To protect user privacy, the conditions of the "conditional selection values" are evaluated within MPC cluster 130, rather than SSP 170 or DSP 150, to determine whether the "conditional selection values" are candidates for the content selection process.

[0077] This architecture allows MPC cluster 130 to protect user privacy and trade secrets, and to prove its trustworthiness to application providers (such as the provider of application 112). In this example, MPC cluster 130 relies on a secure two-party computation (2PC) architecture, which applies cryptographic techniques to ensure that there is no leakage of confidential user data or trade secrets if at least one of the two computing systems in MPC cluster 130 is honest. If MPC cluster 130 includes more than two computing systems, it can extend the current MPC protocol or use other MPC protocols.

[0078] The MPC cluster 130 runs a secure 2PC protocol to evaluate and apply conditions for selecting candidate digital components, implements a selection process to choose digital components based on selection values, and receives presentation notifications to update the parameters on which these conditions depend. All of these processes can be accomplished using secret share technology. (Reference) Figure 3 Please describe the protocol in detail.

[0079] In class A, application 112, for example, collaborates with a triggering element from a content platform such as SSP 170 to send requests for digital components to MPC cluster 130. Application 112 can combine multiple requests for digital components into a single composite request to retrieve multiple digital components. MPC cluster 130 can then serve each request in the composite request independently, or make one or more selection decisions as a whole. In this example, the request is for a single digital component and includes requests for digital components selected based on sensitive information or selected without using sensitive information. MPC cluster 130 can respond to the request by selecting a specific digital component corresponding to a specific selection value from a set of selection values, each mapped to a specific digital component. These selection values ​​can be selection values ​​previously cached or otherwise stored at MPC cluster 130 and / or selection values ​​generated by a platform such as DSP 150 or SSP 170, or just-in-time (JIT) selection values. JIT selection values ​​are generated directly in response to need and improve efficiency and reduce waste because the selection value is generated only when a digital component is needed. For example, when a digital component slot becomes available—indicated by receiving a request for a digital component—a JIT selection value can be generated. Therefore, the MPC cluster 130 can select a digital component from a set of digital components that includes stored digital components for which information is stored at the MPC cluster 130 and digital components that have received their JIT selection values ​​for the current digital component request.

[0080] In some implementations, two or more vectors can be used to determine the selection value of a digital component. The MPC cluster 130 can store a first value vector for each digital component that can be used to determine the selection value of that digital component. The first value vector can be specific to one or more user groups; for example, it can be used to determine the selection value of a digital component when a digital component is being selected for a user who is a member of one or more user groups. Therefore, the first value vector can also be referred to as a user group-based vector. A user group-based vector can include multiple elements across two or more dimensions, and each element can represent a specific characteristic of the digital component presentation opportunity. For example, a user group-based value vector can include elements for geographic location or region, spoken language, age or age range, a specific URL of a web page or other electronic resource, a specific product or service, whether the digital component slot is on the first screen or below, the type of digital component slot, the size of the digital component slot, the number of digital component slots on the electronic resource, the time of day, web attribute identifiers, and / or other appropriate characteristics of the digital component presentation opportunity. In some implementations, such as those employing neural networks, the user group-based value vector can be an embedding of the user group in an abstract vector space.

[0081] The value of each element can reflect the amount by which the selection value of the digital component is increased or decreased based on the current presentation opportunity of the digital component with the characteristics corresponding to that element. For example, if the DSP 150 wants to display the digital component to a user in Atlanta instead of a user in Dallas, the value of the element for Atlanta can be a positive value higher than one, and the value of the element for Dallas can be a positive value lower than one, such as zero or a negative value. As described in more detail below, the value of the vector based on the user group can be part of a vector dot product calculation to determine the selection value of the digital component.

[0082] The request includes information used in the digital component selection process, including potentially sensitive information such as user group identifiers of user groups to which application 112 is mapped or otherwise associated, and non-sensitive information such as context signals from application 112 regarding the context in which the digital component will be presented and / or displayed. As described in further detail below, the system is designed to improve the protection of user data that may be sensitive or confidential.

[0083] The triggering element can be, for example, a tag that detects the presence of a digital component slot within an internet location accessed by application 112. The triggering element can be placed at, for example, the internet location and can notify application 112 of the presence of a digital component slot for which a digital component should be requested.

[0084] In Level B, MPC cluster 130 sends a request for a digital component based on non-sensitive information, such as context signals, to SSP 170. This request is referred to as a "context request." The context request can contain various context signals and non-sensitive user information collected directly by the internet location that triggered the request for the digital component (e.g., a content publisher). For example, context signals can include analytics data, language settings, and other data that helps the content publisher provide a good user experience. However, the context request provided to SSP 170 does not include sensitive information, such as user group identifiers.

[0085] In level C, SSP 170 forwards the context request to one or more DSPs 150. In this specific example, for simplicity, SSP 170 forwards the context request to a single DSP 150. For example, SSP 170 is capable of forwarding the context request to DSP 150. In this example, DSP 150 has digital components and selection values ​​mapped to the digital components, or can use context signals to determine the selection values ​​of the digital components.

[0086] In level D, one or more DSPs 150 return selection values ​​in response to a context request. For example, DSP 150 returns one or more selection values ​​mapped to a digital component in response to a context request. DSP 150 is capable of returning any number of selection values ​​in response to a context request. In some implementations, DSP 150 is also capable of returning selection values ​​in response to a digital component request based on sensitive information, such as user group information. These selection values ​​are “conditional selection values” because they are conditional on sensitive information, and therefore conditional on the MPC cluster 130 receiving a request that includes sensitive information matching the sensitive information conditional on the selection value. For each selection value provided by DSP 150, DSP 150 includes information such as a Time-to-Live (TTL) parameter, which is the maximum time span for which MPC cluster 130 can cache the selection value. This TTL parameter enables MPC cluster 130 to cache selection values ​​received from DSP 150. In some implementations, without a TTL parameter, the MPC cluster 130 does not cache the received selection value, but instead discards the selection value after it has been used during the selection process (e.g., in the selection process corresponding to the digital component request transmitted in levels A, B, and C).

[0087] When a vector is used to determine a selection value, DSP 150 can generate and return a second value vector. DSP 150 can generate the second value vector based on the context signal of the digital component request transmitted in levels B and C. The second vector can be referred to as the context vector. The context vector can include the same elements corresponding to the same features as the user group-based vector. However, DSP 150 can determine the value of the context vector for the current digital component request based on the context signal of the digital component request. Instead, the value of the user group-based vector of DSP 150 is stored in MPC cluster 130 and is determined in advance, for example, based on the user group corresponding to the user group-based vector.

[0088] For each DSP 150 that provides a context vector, the MPC cluster 130 is able to determine the selection value for each stored digital component of the DSP 150 by determining the dot product of the user group-based vector and the context vector provided by the DSP 150. If the DSP 150 has multiple user group-based vectors stored by the MPC cluster 130, for example, each for a different digital component, the MPC cluster 130 determines the dot product of the context vector and the user group-based vector for each user group-based vector.

[0089] In some implementations, a third vector can be used based on the user profile of the user who submitted the digital component request. This vector can have the same dimensions and characteristics as other vectors, but with values ​​based on the user's user profile.

[0090] For example, if the user is in Austin, the value of the Austin position element in the user profile vector can be positive, or negative or zero if the user is not in Austin; if the publisher content currently shown to the user is highly relevant to Austin, the value of the same position element in the context vector can be positive; if the digital component is relevant to Austin, the value of the same position element in the user group-based vector for the digital component is positive. To compute the dot product of the three vectors, computation systems MPC1 and MPC2 first perform element-wise multiplication in corresponding elements, each corresponding element from each of the three vectors, and then sum the results. For example, suppose the three vectors are V1 = {v 1，1 …v 1，n},V2={v 2，1 ...v 2，n} and V3={v 3，1 ...v 3，n The dot product of the three vectors will be}

[0091] In level E, SSP 170 applies content selection rules to digital components corresponding to condition selection values. As mentioned above, these conditions can be based on user group identifiers, frequency control, blocked (e.g., muted) digital components, pacing, and / or k-anonymity.

[0092] SSP 170 also applies selection value rules to determine, for example, how selection values ​​affect the post-publish value for a particular content provider. The post-publish value can indicate, for example, the amount of digital components provided to publisher 140 for display along with publisher 140's resources or application content. SSP 170 then performs a selection process to determine the highest unconditional selection value, i.e., the unconditional selection value that produces the highest post-publish value. The unconditional selection value is not conditional on sensitive information and therefore allows SSP 170, rather than MPC cluster 130, to apply content selection rules such as budget and pacing rules, advertiser and digital component exclusions. SSP 170 then forwards the following as JIT selection values ​​to MPC cluster 130: all selection values ​​(selection values ​​with TTL values) that can be cached in MPC cluster 130, and all selection values ​​whose post-publish value is not less than the highest unconditional selection value.

[0093] In stage F, MPC cluster 130 updates its cache using the received JIT selection value that enables caching (with TTL values). Additionally, MPC cluster 130 applies selection rules, such as user group membership rules, frequency control, pacing rules, and rules to prevent specific user micro-targeting to all selection values ​​received in stage E and previously cached selection values, to select valid candidates for the selection process. Rules can include restrictions and guidelines regarding the distribution method or frequency of digital components, as well as other factors. Rules include frequency control, mute, resource exhaustion, and pacing constraints. In some implementations, JIT digital components with conditions evaluated by MPC cluster 130 can be ignored for the current digital component selection process. For example, ignoring these digital components for the current selection process can provide performance benefits, such as reduced latency in selecting and providing digital components. MPC cluster 130 then runs a final selection process among all qualified candidates, selects a winning selection value, and then returns the data of the digital component mapped to the winning selection value to application 112 in response to a digital component request.

[0094] In level G, the digital component mapped to the winning selection value is rendered by application 112. Application 112 then provides a presentation notification to MPC cluster 130. This presentation notification includes data that allows MPC cluster 130 to update information related to update parameters, which allow MPC cluster 130 to enforce the selection rule for future digital component requests received, for example, in subsequent occurrences of level A. In some implementations, application 112 can send the presentation notification G to MPC cluster 130 via a backing onto a future component request A to reduce the amount of network communication and battery / bandwidth consumption of mobile devices, as well as the processing / computing costs of MPC cluster 130.

[0095] Figure 3 This is a swimlane diagram of an exemplary process 300 for selecting digital components to be distributed to client devices. The operation of process 300 can be implemented, for example, by client device 110, computing systems MPC1 and MPC2 of MPC cluster 130, and DSP 150. The operation of process 300 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 300. Although process 300 and the other processes described below are with respect to two computing systems MPC cluster 130, MPC clusters with more than two computing systems can also be used to perform similar processes. Furthermore, the operation of process 300 can be implemented by SSP 170.

[0096] The exemplary process 300 can include variations such as hierarchy, promotion, first value selection process (e.g., first price auction), second value selection process (e.g., second price auction), and lower bound. (See reference) Figures 3 to 5 Describe each of these variations.

[0097] Typically, a boost is the amount by which the selection value of a digital component is adjusted. For example, when a digital component is selected to be displayed with one of the publisher's resources 145 or application content, the content publisher can instruct SSP 170 to give a specific DSP 150 a boost of a specified amount "x". If DSP 150 submits a selection value "y", then the selection value used in the digital component selection process will be x+y. However, if a digital component is selected, DSP 150 will only be required to provide an amount no greater than y in the first or second selection value process. In process 300, MPC cluster 130 can apply boosts to selection values ​​based on information provided by SSP 170. For example, each SSP 170 can provide information mapping boosts to pairs of DSPs 150 and publishers 140. That is, this information can indicate that for a digital component selection process where a digital component is selected to be displayed with content from a specific publisher, the selection value of a specific DSP should be boosted by a specific amount. In some implementations, SSPs / publishers can support boosts at a more granular level. For example, for each lookup key (e.g., for each set of context signals), the SSP / publisher can specify promotion.

[0098] SSP 170 can instruct the secure MPC cluster 130 to divide the DSP 150 into multiple tiers with different priorities. Instead of selecting the digital component corresponding to the highest selection value among all candidate digital components during the digital component selection process, the digital component with the highest selection value in the highest priority tier is selected. For illustration, consider an example with two tiers (highest and lowest tiers). If one or more candidate digital components exist in the highest tier, the candidate digital component with the highest selection value in the highest tier will be selected even if the selection value of a candidate digital component in the lowest tier is higher than the selection values ​​of all candidate digital components in the highest tier.

[0099] The main difference between the first and second value selection processes is the clearing amount of the selected digital component. The clearing amount is the quantity that needs to be provided by DSP 150 to publisher 140 and / or SSP 170 for display of the digital component. Two processes will be used to select the same digital component. In the first value selection process, DSP 150 will need to provide publisher 140 and / or SSP 170 with an amount equal to the selection value submitted by DSP 150. In the second value selection process, instead, DSP 150 will need to provide an amount based on the next highest selection value. If a hierarchy is used in conjunction with the second value selection process, the next highest value will be the next highest value in the same hierarchy as the selected digital component. If no such candidate digital component exists in the same hierarchy, the next highest value can be the minimum value used in the digital component selection process.

[0100] A selection value lower bound indicates the minimum selection value that publisher 140 is willing to accept for the display of a digital component. Publisher 140 can specify selection value lower bounds for various DSPs 150, for each category of digital components (e.g., one lower bound for automotive-related digital components, another for gardening-related digital components), for each digital component provider 160, for each brand, for each page on the publisher's site, for each digital component slot, for a set of digital component slots, and / or for other types of digital component groups. In some implementations, SSP 170 can set the lower bound in advance on behalf of publisher 140, or request a lower bound for each digital component, such as class A.

[0101] DSP 150 provides MPC cluster 130 with selection values ​​and additional information for digital components (e.g., selection criteria such as conditions) (302). In some implementations, DSP 150 is connected via SSP (for simplicity, in...). Figure 3 (Not shown) provides selection values ​​and additional information to MPC cluster 130. For example, DSP 150 can provide selection values ​​and additional information in response to a digital component request, and specify the digital component corresponding to the selection value as the digital component to be stored at MPC cluster 130.

[0102] MPC cluster 130 can store selection values ​​and selection criteria for future digital component requests received from client device 110. For each digital component, DSP 150 can also upload additional data for the digital component, such as metadata. The additional information for a digital component can include one or more conditions (and parameters of those conditions) that must be met to include the digital component in the selection process. For example, the additional information can include one or more user group identifiers corresponding to the user group of the digital component.

[0103] Additional information about a digital component may include context selection signals indicating the context in which the digital component is qualified, such as the location of client device 110, the language selected for application 112, the URLs of resources that the digital component can be presented with, and / or the excluded URLs of resources that the digital component cannot be presented with. This additional information may also identify the digital component, for example, using a unique identifier, the domain from which the digital component can be obtained, and / or other appropriate data about the digital component. This additional information may be included as metadata for the digital component.

[0104] In some implementations, the MPC cluster 130 caches or otherwise stores the selection values, selection criteria, and other information of the digital components provided to the MPC cluster 130 in response to digital component requests. In this example, the context signals for the digital components and selection values ​​can include the context signals included in the digital component request. As described above, the selection values ​​and metadata can be stored in a two-level LUT.

[0105] In some implementations, the DSP 150 is able to provide user group-based value vectors to digital components, rather than providing static selection values. In such examples, user group-based value vectors can be stored instead of selection values.

[0106] Client device 110 receives content (304). For example, client device 110 can receive electronic resources (e.g., web pages) for display by a web browser or application content for display by a native application. The content can include one or more digital component slots, each containing computer-readable code (e.g., scripts) that, when executed, causes client device 110 to request a digital component for each slot. Client device 110 can render the content on its display.

[0107] Client device 110 identifies a set of user group identifiers (306). The set of user group identifiers can be user group identifiers of user groups that include users as members. For example, the set of user group identifiers can be user group identifiers in a list of user groups. The application 112 or trusted program that renders the content can identify the set of user group identifiers, for example, by accessing the list of user groups from the secure storage of client device 110.

[0108] Client device 110 generates a probabilistic data structure (308). To securely and efficiently generate digital component requests based on sensitive information, application 112 can use a probabilistic data structure, such as a Cuckoo filter or a Bloom filter. In this example, the probabilistic data structure is a Cuckoo filter. (See reference...) Figure 8An example using a Bloom filter is described. Typically, a Bloom filter consists of an array of buckets, where each bucket can hold b fingerprints. The fingerprint of an item is a bit string derived from the hash of that item. A Bloom filter uses n hash functions, which allow items to be placed in n distinct buckets at any of the b locations. Typically, a Bloom filter is identified by the number of fingerprints in each bucket and the number of buckets. For example, a (2,4) Bloom filter has 2 buckets, and each bucket in the Bloom array can store up to 4 fingerprints. Therefore, the total capacity of a Bloom filter is 2×4, or 8 fingerprints.

[0109] Depending on the configuration of the Cuckoo Filter, an item can be inserted into one of N possible positions (e.g., N=2). Application 112 uses N pseudo-random functions (PRFs) parameterized by a user group identifier or an identifier from a set of blocked identifiers and either of two random variables generated by application 112 to determine all possible positions for the item to be inserted. For example, suppose the two random variables generated by application 112 are rand_var1a and rand_var1b. In some implementations, application 112 and MPC cluster 130 agree on the PRF in advance, where PRF(x, y) ∈ [0, 2]. k -1], where k is the number of bits in each item in the bucket of the Cuckoo filter.

[0110] Each position in the Cuckoo filter can be occupied by a user group identifier or a blocked identifier, or it can be empty. A blocked identifier is an identifier for which application 112 is blocking a digital component, for example, based on frequency control, or an identifier for a user group's digital component that the user has chosen to block. Application 112 can generate a Cuckoo filter table whose elements are PRF(ug_id, rand_var1a), PRF(blocked_uid, rand_var1b), and 0, where ug_id is the identifier of the user group generated by applying HMAC to the user group's tag based on the content provider's domain, blocked_uid is an identifier from the set of blocked identifiers, and 0 indicates an empty entry. This process is repeated for all user group identifiers. In some implementations, the same probabilistic data structure (e.g., a Cuckoo filter or a Bloom filter) can store both user group identifiers and blocked identifiers. In other implementations, user group identifiers and blocked identifiers are stored in a dedicated probabilistic data structure.

[0111] Application 112 can generate vector B based on a Cuckoo filter table generated for user group identifiers and / or blocked identifiers. Each value B in vector B... i Can be represented as B i =(A i-PRF(rand_var2,i) mod p, where A is the Cuckoo Filter table, and i is the index of vector B and Cuckoo Filter table A. When application 112 initiates a request for a digital component slot, application 112 sends rand_var1a, rand_var1b, and rand_var2 as request parameters to computing system MPC1. Application 112 also sends vector B, rand_var1a, and rand_var1b as request parameters to computing system MPC2. PRF(rand_var2,i) and B i Z is held by computing systems MPC1 and MPC2 respectively. p A in i The two additive secret shares. Because neither computing systems MPC1 nor MPC2 can access these two secret shares, neither computing system can recreate the Cuckoo Filter table, thus protecting user privacy.

[0112] Client device 110 transmits a digital component request (310) including parameters of the Cuckoo filter to MPC cluster 130. For example, client device 110 can transmit a digital component request including rand_var1a, rand_var1b, and rand_var2 to computing system MPC1. Client device 110 can also transmit a digital component request including vector B, rand_var1a, and rand_var1b to computing system MPC2. Both digital component requests can also include contextual signals, such as the URL of the electronic resource, the number of digital component slots of the resource, the geographic location of client device 110, and / or other appropriate contextual signals that can be used to select digital components, such as a lookup key.

[0113] MPC cluster 130 transmits a context digit component request (312) to SSP 170. This digit component request may include context signals but not sensitive user data, such as user group identifiers that identify user groups to which the user is a member. In some implementations, the context digit component request is generated from the SSP's tag on the publisher page rendered on client device 110. Application 112 transmits the context digit component request to SSP 170 via MPC cluster 130 by backing it onto the digit component request sent in operation 310. In some implementations, application 112 uses SSP 170's public key to encrypt the context digit component request and sends the encrypted context digit component request to SSP 170 by backing it onto the digit component request sent in operation 310, ensuring that no one other than SSP 170 can decrypt the context digit component.

[0114] SSP 170 transmits a context digital component request to one or more DSPs 150 (314). Each DSP 150 is capable of responding to the request with one or more conditional selection values ​​and / or one or more unconditional selection values ​​for the digital component. For each digital component, the response may include data identifying the digital component, the selection value of the digital component, and metadata (or other additional information) of the digital component. For example, the response may include a digital component information element dc_information_element for each digital component. Each DSP 150 is capable of selecting one or more digital components for inclusion in the digital component selection process based on context signals, and determining or identifying the selection value for each selected digital component. In some implementations, DSP 150 is capable of generating a context vector for each of the one or more digital components based on context signals.

[0115] Each DSP 150 can transmit its response to SSP 170 (316). SSP 170 can transmit the response to MPC cluster 130 (318). In some implementations, SSP 170 can apply one or more lower limits to the digital component selection process before transmitting the response to MPC cluster 130. SSP 170 can apply lower limits based on the publisher 140 of the electronic resource for which it selects digital components. As described above, publisher 140 specifies lower limits for DSP 150, the category of digital component, digital component provider 160, brand, and / or other types of digital component groups.

[0116] SSP 170 can identify the lower bounds specified by publisher 140 and apply them to the selection values ​​received from DSP 150. If a selection value is less than the corresponding lower bound, SSP 170 can remove that selection value from the digital component selection process, for example, by not providing the selection value to MPC cluster 130. For example, suppose publisher 140 specifies a lower bound of five units for a given digital component provider 160. If DSP 150 provides a selection value of four units for the digital component of a given digital component provider 160, SSP 170 can filter the selection value from the digital component selection process.

[0117] As described above, DSP 150 is able to provide selection values ​​for stored digital components to be stored for future use in the digital component process. If these selection values ​​do not meet the corresponding lower bound, the digital component and its associated selection values ​​are not stored at MPC cluster 130 because SSP 170 does not forward them to MPC cluster 130.

[0118] In some implementations, MPC cluster 130, in addition to SSP 170, also enforces an execution lower bound. MPC cluster 130 can enforce a lower bound on these selection values ​​when it computes the dot product of vectors used to determine selection values. Not SSP 170, but MPC cluster 130 can also enforce a lower bound on static selection values.

[0119] MPC cluster 130 performs a secure MPC process to select the digital components (320) to be provided for display at client device 110. This selection can include, for example, using a lookup key (as referenced above). Figure 1 The first-level lookup key (described) identifies the set of digital components eligible for use in the digital component selection process and their corresponding selection values ​​based on context signals. This can also include identifying candidate digital components from the set of digital components as candidates for selection. Candidate digital components can include unconditional digital components for which the DSP 150 provides selection values, and conditional digital components that satisfy each condition of the digital component. A conditional digital component is considered a candidate for the digital component selection process only if it satisfies all the conditions of the digital component.

[0120] MPC cluster 130 is able to select a digital component to be provided to client device 110 from candidate digital components in response to a digital component request, based on the selection value of the candidate digital component. For digital components with selection values ​​determined using vectors, MPC cluster 130 is able to determine the selection value of the digital component by determining the dot product of vectors (e.g., user group-based vectors, context vectors, and optionally user profile vectors).

[0121] When selecting digital components, the MPC cluster 130 can also consider any hierarchy or promotion of the digital components. As described above, the publisher 140 can establish hierarchy and / or promotion for the DSP 150 and / or digital component provider 160. When the publisher 140, which is selecting digital components for it, has already established promotion, the MPC cluster 130 (or SSP 170) can adjust the selection values ​​of the digital components of the DSP 150 and / or digital component provider 160 using the corresponding promotion specified by the publisher 140. If a vector is used to determine the selection value, the MPC cluster 130 can adjust the selection value after determining the selection value by calculating the dot product of the vectors.

[0122] When using hierarchical structures, the MPC cluster 130 can perform a selection process on each hierarchy sequentially or in parallel, for example, from the highest priority hierarchy to the lowest priority hierarchy. The MPC cluster 130 can select the digital component with the highest selection value in the highest priority hierarchy, which includes at least one candidate digital component. For example, if none of the digital components in the highest priority hierarchy are candidates that, for example, satisfy all the conditions used to include them in the digital component selection process, the MPC cluster 130 selects a candidate from the next highest priority hierarchy that includes the candidates.

[0123] The MPC cluster 130 can perform the selection process in parallel for each level to improve the speed of the selection process. In this way, if there are no candidates in the highest priority level, the MPC cluster 130 has started and may have already completed the selection process for each of the other levels, making it possible to select the final digital component.

[0124] The MPC cluster 130 can execute the selection process sequentially from the highest priority level to the lowest priority level. If speed is less critical, this can reduce wasted computation on lower priority levels if higher priority levels include candidate digital components. An exemplary process for selecting digital components using a secure MPC process is described in... Figure 4 It is shown in the figure and described below.

[0125] MPC cluster 130 transmits a secret share of the selection result to client device 110 (322). In some embodiments, MPC cluster 130 is also capable of sending a selection process identifier for the digital component selection process to client device 110. The selection process identifier uniquely identifies the digital component selection process for which the selection result was generated. For example, computing systems MPC1 and MPC2 can each request and generate a corresponding selection process identifier SPID for each digital component, and computing systems MPC1 and MPC2 execute the selection process for each digital component request to generate a selection result to provide to client device 110. In some embodiments, the selection process identifier SPID can be a random number or an opaque alphanumeric or number sequence.

[0126] MPC cluster 130 can also store data as part of a selection process that is keyed by SPID or otherwise linked to the SPID. For example, computing system MPC1 can store tables or other data structures containing data with selection values ​​based on the key of SPID1 generated by computing system MPC1 for the selection process. Similarly, computing system MPC2 can store tables or other data structures containing data with selection values ​​based on the key of SPID2 generated by computing system MPC2 for the selection process. This allows MPC cluster 130 to update the process variables of the feedback controller based on data received from client device 110.

[0127] The selection result can be in the form of a byte array, which includes information about the selected digital component. For example, the selection result can be a byte array that includes the value of the digital component in the second LUT, such as the selected value of the digital component and the metadata of the digital component. Computing systems MPC1 and MPC2 can use a secure MPC process to determine a secret share of the selection result, as described in more detail below. Computing system MPC1 can transmit a first secret share of the selection result to client device 110, and computing system MPC2 can send a second secret share of the selection result to client device 110. To prevent computing systems MPC1 and MPC2 from knowing the selected digital component, it is possible to prevent computing systems MPC1 and MPC2 from sharing their secret shares of the selection result with each other.

[0128] Client device 110 determines the digital component (324) corresponding to the selection result. For each selection result from which client device 110 receives two secret shares from computing systems MPC1 and MPC2, client device 110 is able to determine the selection result from the two secret shares. For example, using an additive secret share library described in more detail below, client device 110 is able to add the two secret shares of the selection result together to obtain the selection result in plaintext form. This gives client device 110 access to the selection value of the digital component and the metadata of the digital component (e.g., the identity of the digital component, the location from which client device 110 can download the digital component, etc.).

[0129] Client device 110 displays a digital component (326). For example, application 112 can display the digital component along with the content received in step 304. In some embodiments, client device 110 can display a digital component representing the selection result.

[0130] In some implementations, client device 110 can request digital components from MPC cluster 130 based on user group membership. Client device 110 can also request digital components from SSP 170 based on context signals. These context signals can include the same context signals described above, as well as optionally additional context signals, such as the number of digital component slots in the resource, the type of digital component slots, and the type and / or format of the digital components that can be displayed with the resource. SSP 170 can select one or more digital components based on the context signals and the selection value of the digital components, and provide one or more of the selected digital components (or data identifying the digital components) and the selection value of the digital components to client device 110. Client device 110 can then select the digital components to be displayed with the resource from the set of digital components including the selection results received from MPC cluster 130 and the digital components selected by SSP 170. If the resource includes multiple digital component slots, client device 110 can request the corresponding digital component for each slot from MPC cluster 130 and from SSP 170.

[0131] Client device 110 can transmit one or more event notifications to MPC cluster 130 (328). For example, suppose a digital component representing a selection result received from MPC cluster 130 is displayed by application 112 on client device 110, then application 112 can transmit a display notification for the digital component in response to its display. In another example, application 112 can transmit a user interaction notification in response to the detection of user interaction (e.g., selection / click on a digital component).

[0132] For user interaction notifications, application 112 can generate a secret share of the click parameter `clicked`, which is a Boolean parameter. This Boolean parameter can have a value of one if the user interacts with the digital component, or a value of zero if the user does not interact with the digital component for a specified duration after it is displayed. Therefore, in this example, either value indicates that the digital component is displayed, but a value of one can indicate that the user has interacted with the digital component. Application 112 can send a first notification to computer system MPC1 including the SPID1 received from computer system MPC1 and a first secret share of the click parameter [clicked1]. Similarly, application 112 can send a second notification to computer system MPC2 including the SPID2 received from computer system MPC2 and a second secret share of the click parameter [clicked2]. In another example, the notification can use a secret share similar to the click parameter to individually indicate whether the digital component is displayed at client device 110.

[0133] Display and user interaction notifications enable MPC cluster 130 to update process variables of the feedback controller used to pace the distribution of digital components. For example, if the process variable is the display rate, MPC cluster 130 can use display notifications to update the count of displays of the digital component (or activity including the digital component). If the process variable is the user interaction rate, MPC cluster 130 can use click parameters to update the number of user interactions with the digital component (or activity including the digital component). In a specific example, computing system MPC1 can use SPID1 to obtain stored data for the selection process, and computing system MPC2 can use SPID2 to obtain stored data for the selection process. MPC cluster 130 can then execute a secure MPC process to update process variables (e.g., display rate, interaction rate, conversion rate, and / or resource exhaustion rate) of the digital component activity displayed by application 112. Similarly, MPC cluster 130 can use notifications to update the counts used to determine whether a digital component satisfies the k-anonymity condition.

[0134] Figure 4 This is a swimlane diagram of an exemplary process 400 for selecting digital components to be distributed to client devices. The operation of process 400 can be implemented, for example, by computing systems MPC1 and MPC2 of the MPC cluster 130. The operation of process 400 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 400.

[0135] Process 400 can be used for first-value selection processes, second-value selection processes, and / or selection processes that include raising and / or lower bounds. Each of these variations is described below. Figure 5 Another exemplary process 500 shown can be used for selection processes that include hierarchy. Process 500 can also support first value selection processes, second value selection processes, and raising and / or lower bounds.

[0136] Computing systems MPC1 and MPC2 determine and / or identify the selection value of the digital component (402). Computing systems MPC1 and MPC2 are capable of determining the selection value in response to a digital component request received from client device 110. (See reference...) Figure 3The computing system MPC1 can receive a digital component request from the client device 110. This request includes context signals and data from a probabilistic data structure representing the user group identifier of the user of the client device 110. The probabilistic data structure may include parameters rand_var1a, rand_var1b, and rand_var2. Similarly, the computing system MPC2 can receive context signals and parameter vectors B, rand_var1a, and rand_var1b from the client device 110. The context signals may be in the form of a lookup key, for example, a reference... Figure 1 The first-level lookup key described (SHA256(UG_Request_Key)).

[0137] The selection values ​​can include selection values ​​for stored digital components, where each computing system MPC1 and MPC2 stores its data, and JIT selection values ​​received from SSP 170 for the digital component selection process. In cases where vectors are used to determine selection values, each computing system MPC1 and MPC2 can determine the selection value by determining the dot product of the vectors of the digital components. Computing systems MPC1 and MPC2 can also apply any boosts and / or enforce any lower bounds established by publisher 140 or SSP 170 for digital components for which publisher 140 or SSP 170 has already established boosts.

[0138] The computing system MPC1 identifies a qualified digital component (404). The computing system MPC1 is capable of identifying a qualified digital component in response to a digital component request received from the client device 110, for example, as referenced... Figure 3 The qualified digital component is a digital component that is eligible for selection based on the context signals requested by the digital component. For example, a qualified digital component can be a digital component that has a set of context signals that match the context signals requested by the digital component, such as a digital component that has a lookup key that matches the requested lookup key.

[0139] In an implementation using a two-level LUT, the computing system MPC1 can identify eligible digital components using a first-level lookup key from a digital component request. The computing system MPC1 can access the first-level LUT and use the first-level lookup key to identify rows in the second-level LUT that include information about digital components eligible to be displayed (e.g., for which a selection value has been received) based on the set of context signals represented by the first-level lookup key. For example, as described above, each row of the second-level LUT includes information about the digital component and a second-level lookup key based on the set of context signals. Therefore, the computing system MPC1 can use the first-level lookup key to identify rows in the second-level LUT that have a set of context signals matching the set of context signals defined by the first-level lookup key received in the digital component request. These rows include information about digital components eligible to be displayed or having a qualified selection value based on the context defined by the first-level lookup key received in the digital component request.

[0140] Computing system MPC2 identifies qualified digital components (406). Computing system MPC2 is capable of identifying qualified digital components in response to digital component requests received from client device 110. Computing system MPC2 is capable of identifying qualified digital components in a similar manner to computing system MPC1. In the implementation where the lower bound is enforced in MPC cluster 130, each MPC computing system MPC1 and MPC2 is capable of filtering from qualified digital components any qualified digital components that have a selection value that does not meet (e.g., does not meet or exceeds) its corresponding lower bound.

[0141] For each qualified digital component, computing systems MPC1 and MPC2 determine whether the digital component and its selected value are candidates (408) selected in response to a digital component request for distribution to client device 110. A candidate digital component is a qualified digital component that satisfies all or one of the conditions of a digital component if it is a conditional digital component. Each unconditional digital component that is context-qualified is also a candidate digital component. Computing systems MPC1 and MPC2 are able to use a secure MPC process to determine candidate digital components such that neither MPC1 nor MPC2 can identify the candidate digital components in plaintext.

[0142] Regarding the user group membership eligibility criteria, the calculation systems MPC1 and MPC2 are able to calculate the user group membership eligibility parameter ug_check for each eligible digital component "i". i The corresponding secret share. The user group membership qualification parameter ug_check, maintained by the computing system MPC1. i The first secret share can be represented as [ug_check] i,1 The user group membership qualification parameter ug_check, maintained by the computing system MPC2, is also included. iThe second secret share can be represented as [ug_check] i,2 The brackets are used to indicate the secret share of the parameter.

[0143] For the implementation of the Cuckoo filter used to represent a user's user group membership, computing systems MPC1 and MPC2 cooperate to calculate [ug_check] according to the following relation 1. i,1 ]:

[0144]

[0145] In relation 1, Π represents the multiplication of multiple terms. Here, ug_id(x) is a function used to retrieve the user group identifier ug_id associated with the selected value x, {F1,…F…} N} is the set of hash functions used to compute the possible indices of items within the Cuckoo Filter table A, and rand_val1a is the random value received in the digital component request. [M x,1 [] is the x-th element in array [M1]. == is an equality test between the plaintext integer and the secret share of the secret integer. == results in either 0 (not equal) or 1 (equal) secret share of the secret integer. Here, [M i,1 The value of ] is [PRF(rand_val2a,i)1].

[0146] Similarly, computing system MPC2 cooperates with computing system MPC2 according to the following relationship

[0147] Equation 2 is used to calculate [ug_check] i,2 ]:

[0148]

[0149] Here, [M i,2 The value of ] = B i .

[0150] For digital components conditioned on the user group membership of the user currently selecting a digital component, computing systems MPC1 and MPC2 are able to calculate the user group membership condition parameter ug_check. i Secret share [ug_check] i,1 ] and [ug_check i,2 The combination of two secret shares can be a Boolean value indicating whether a user is a member of the user group corresponding to the digital component. For example, a value of one can indicate that the user is a member, while a value of zero can indicate that the user is not a member. For digital components that are not conditional on a user's user group membership, computing systems MPC1 and MPC2 can use the secret share [ug_check]. i,1] and [ug_check i,2 The default value of ] makes the combination have a value (e.g., one) indicating that the user is a member of the user group corresponding to the digital component.

[0151] In the implementation where a Bloom filter is used to represent a user's group membership, computing systems MPC1 and MPC2 can query the Bloom filter, as referenced. Figure 8 The result is that the computation system MPC1 has the first secret share of the user group membership condition parameter for each hash function of the Bloom filter [ug_check]. i,1 Similarly, the computational system MPC2 has a second secret share [ug_check] for each hash function of the Bloom filter, which is a user group membership criterion parameter. i,2 For digital components that meet the user group membership criteria, the user group membership criterion parameter (i.e., ug_check) is used. i Each hash value of the Bloom filter will need to have a Boolean value of either true or one. The secret share of each hash value can be included in the final calculation of the secret share of the candidate parameters of the digital component.

[0152] The computing systems MPC1 and MPC2 can also collaborate to calculate the blocked digital component parameter `blocked_check` for each digital component `i` conditioned on frequency control or mute. i The corresponding secret share [blocked_check] i,1 ] and [blocked_check i,2 The combination of the two secret shares can be a Boolean value indicating whether the digital component meets the conditions for being blocked, based on frequency control (e.g., the digital component is not provided to the user more than a threshold number of times over a period of time) and / or based on whether the user chooses not to display the digital component. For example, a Boolean value of true or one can indicate that the digital component can be displayed to the user based on these factors, while a Boolean value of false or zero can indicate that the digital component cannot be displayed to the user based on these factors.

[0153] To determine the secret share of the parameters of the blocked digital component, computing systems MPC1 and MPC2 can use the share (e.g., an array) of a Bloom filter representing the identifier of the blocked digital component. Application 112 can generate a Bloom filter representing the identifier of the blocked digital component and send the data representing the Bloom filter to computing systems MPC1 and MPC2, as referenced. Figure 8 The aforementioned. Then, computing systems MPC1 and MPC2 are able to query the Bloom filter using an array representing the Bloom filter to obtain the secret share [blocked_check]. i,1] and [blocked_check i,2 ], as referenced Figure 8 As stated above.

[0154] The computing systems MPC1 and MPC2 can also collaborate to calculate the pacing control check parameter pacing_check for each digital component i, for example, using a feedback controller for pacing. i The corresponding secret share [pacing_check] i,1 ] and [pacing_check i,2 The combination of the two secret shares can be a Boolean value, indicating, for example, whether the digital component meets the pacing conditions based on the output of the feedback controller. For example, if the digital component is provided too frequently relative to the target display rate, the output of the feedback controller can indicate that the digital component is not eligible for use in the digital component selection process. A Boolean value of true or one can indicate that the digital component meets the pacing conditions, for example, it is not throttled for the selection process, while a Boolean value of false or zero can indicate that the digital component does not meet the pacing conditions, for example, it is throttled for the selection process.

[0155] To enforce resource depletion (e.g., budget) and pacing rules, computing systems MPC1 and MPC2 can randomly prevent digital components from participating in the digital component selection process using probabilities and resource depletion conditions determined by a feedback controller. If an activity involving a digital component has no additional resources, the probability is set to one. Otherwise, if the activity is ahead of its delivery schedule, the probability is set high (e.g., above zero and close to one), making computing systems MPC1 and MPC2 more likely to prevent that digital component from participating in the digital component selection process, for example, by calculating the secret share [pacing_check]. i,1 ] and [pacing_check i,2 This makes the pacing control check parameter pacing_check i The value is zero. The probability is lower if the activity is later in the delivery schedule.

[0156] The computing systems MPC1 and MPC2 are able to periodically calculate the pacing selector parameter (pacing_selector) for each activity in the additive secret share using a feedback controller. Conceptually, the pacing selector parameter is a throttling probability amplified by a factor of maximum range.

[0157] For each digital component request and for each digital component, computation systems MPC1 and MPC2 compute a secret number uniformly distributed in the range [0, maximum range]. If the random number is less than or equal to the pacing selector parameter pacing_selector, computation systems MPC1 and MPC2 compute, for example, by calculating the secret share [pacing_check].i,1 ] and [pacing_check i,2 This prevents digital components from participating in the digital component selection process, thus enabling the pacing control to check the pacing_check parameter. i The value is zero.

[0158] To protect the user privacy and confidential information of participants in the digital component selection process, both the random number and the pacing selector parameters are contained in an additive secret share. A scrambling circuit protocol can be used to perform the comparison between the two secret shares. By limiting the two secret shares to six or seven bits, the comparison protocol enables one or two rounds of communication between computing systems MPC1 and MPC2.

[0159] To determine the campaign's timing selector parameters, the computing system can calculate the amount of resources used for each campaign as resources_used_campaign = ∑(clearing_value × is_dc_the_winner), where the sum spans all digital component selection processes including the campaign's digital components, the parameter clearing_value is the clearing value of the digital component selection process, and is_dc_the_winner is the winner parameter of the digital component in the digital component selection process. This calculation can be performed within a secret share, allowing each computing system MPC1 and MPC2 to maintain a secret share of the amount of resources used. Then, computing systems MP1 and MPC2 can calculate the resource exhaustion parameter resources_exhausted for the campaign by determining whether the amount of resources used (i.e., resources_used_campaign) is greater than the total amount of resources allocated to the campaign in the secret share.

[0160] Computing systems MPC1 and MPC2 can calculate the pacing selector parameter pacing_selector for each activity as pacing_selector = resources_exhausted × maximum range + (1 - resources_exhausted) × output, where the parameter output is the output of the feedback controller. This calculation can be performed using an RPC between computing systems MPC1 and MPC2 to compute multiplications in the secret share. However, the calculation can be performed periodically offline to prevent any increased latency.

[0161] The computing systems MPC1 and MPC2 can also collaborate to compute the k-anonymity check parameter kanonymity_check for each digital component i that must satisfy the k-anonymity condition. i The corresponding secret share

[0162] [kanonymity_check i,1 ] and [kanonymity_check i,2 In some implementations, this can be applied to all digital components. The combination of the two secret shares can be a Boolean value indicating whether the digital component satisfies the k-anonymity condition. For example, a value of one can indicate that the digital component satisfies k-anonymity, while a value of zero can indicate that the digital component does not satisfy k-anonymity and should be prevented from participating in the digital component selection process.

[0163] The computing systems MPC1 and MPC2 are able to process logs periodically (as referenced). Figure 9 The process involves identifying the selection process of the winning digital component (e.g., the corresponding selection process identifier has been received in the display notification) that has been shown (or could have been shown) by application 112. During these selection processes, computing systems MPC1 and MPC2 count the number of displays shown (or could have been shown) by the user's application 112 as `impression_show`. i =∑(is_dc_the_winner_i). Here, i can represent a digital component or activity. Calculations are performed within the secret share, such that each computing system MPC1 and MPC2 has a display quantity `impression_show`. i The secret share. Then, the computing systems MPC1 and MPC2 are able to determine, for example, whether the number of displays exceeds the value k by comparing the number of displays with k on the secret share.

[0164] For each condition of a digital component (e.g., a digital component with at least one condition), each computing system MPC1 and MPC2 can store a corresponding secret share of the parameter for each condition of the digital component. In this way, as long as at least one MPC computing system is honest, neither MPC1 nor MPC2 knows the value of the parameter in plaintext. Each digital component can be conditional with zero or more conditions. For a given digital component selection process, some digital components can have different conditions and / or a different number of conditions than other digital components.

[0165] While some exemplary conditions have been provided above, other conditions can also be used. Typically, computing systems MPC1 and MPC2 can use a secure MPC process to calculate a secret share of the condition parameters. The standards and techniques used to determine the condition parameters can vary. In some implementations, the secret share of the condition parameters can be received from another computing system, for example, causing computing systems MPC1 and MPC2 not to calculate the condition parameters.

[0166] Computational systems MPC1 and MPC2 can use secret shares of conditional parameters to determine whether a conditional number component is a candidate for the number component selection process. Computational systems MPC1 and MPC2 can use secret shares of the conditional parameters of the conditional number components to compute the candidate parameter is_dc_a_candidate for each conditional number component i. i The secret share. Generally, if the conditional number component is conditional on each of the above conditions, then the candidate parameters of number component i can be calculated using the following relation 3:

[0167] is_dc_a_candidate i =ug_check i AND blocked_check i AND pacing_check i ANDkanonymity_check i

[0168] Since the value of each condition parameter is in a secret share, computation systems MPC1 and MPC2 can collaborate in a secure MPC process using round-trip remote procedure calls (RPCs) to determine the corresponding secret share [is_dc_a_candidate] of the candidate parameter of digital component i using the secret share of the condition parameter. i,1 ] and [is_dc_a_candidate i,2 The secret share of the candidate parameter of digital component i can be determined using any suitable secret-sharing algorithm used to determine logical AND operations [is_dc_a_candidate]. i,1 ] and [is_dc_a_candidate i,2 The computing systems MPC1 and MPC2 are able to determine the secret share of the candidate parameter using only the secret share of the conditional parameters of those conditions. At the end of this secure MPC process, computing system MPC1 retains the first secret share [is_dc_a_candidate] of the candidate parameter for each conditional digital component. i,1 ], and the computation system MPC2 maintains a second secret share of the candidate parameters for each conditional digital component [is_dc_a_candidate] i,2 ].

[0169] In some implementations, computing systems MPC1 and MPC2 use a scrambling circuit protocol to evaluate relation 3 for each digital component. In this example, either computing system MPC1 or MPC2 is capable of constructing a scrambling circuit. For this example, assume that computing system MPC1 constructs the scrambling circuit. Computing system MPC1 knows its own secret share and also knows that the secret share of computing system MPC2 must maintain only one possible bit pattern so that the candidate parameters of the digital components become true or one. Utilizing this property, for example, if there are approximately 50 Boolean parameters in total in relation 3, computing system MPC1 only needs up to 50 gates to construct the scrambling circuit.

[0170] In relation 3, there is only one user group membership qualification parameter, ug_check. i However, if a Bloom filter is used to represent a user's group membership, then relation 3 can include the corresponding group membership condition parameter ug_check for each hash function of the Bloom filter. i Similarly, if a Bloom filter is used to represent blocked digital components, then relation 3 will include the corresponding blocked digital component parameter `blocked_check` for each hash function of that Bloom filter. i In relation 3, pacing_check exists only if the owner of the digital component enables pacing checks. i .

[0171] Computing system MPC1 determines the order of digital components based on selection values ​​(410). Similarly, computing system MPC2 determines the order of digital components based on selection values ​​(412). These two orders should be identical because the input to the sorting process is the same for both computing systems MPC1 and MPC2. Each computing system MPC1 and MPC2 is capable of determining the order of digital components. Each order can include candidate digital components evaluated for eligibility in step 408, as well as other digital components. For example, the order can include all available digital components for the digital component selection process, all qualified digital components for the digital component selection process (e.g., qualified based on context signals), or all digital components in the second-level LUT (if used). The order can be from the digital component with the highest selection value to the digital component with the lowest selection value. In some implementations, the selection value used for the order can be, for example, a value that will be provided to the publisher 140 of the resource to be displayed with the selected digital components after any sharing with DSP 150 and / or SSP 170, plus any applicable boost.

[0172] Because the selection values ​​are in plaintext, computation systems MPC1 and MPC2 do not need to perform any round-trip computations to determine the order of the digital components. Instead, each computation system MPC1 and MPC2 can independently order the selection values. If the selection values ​​are stored as secret shares at each computation system MPC1 and MPC2, with each system having a corresponding secret share for each selection value, then MPC1 and MPC2 can use round-trip computations to perform a secure MPC process to order the selection values. If there is a relationship between two or more selection values, MPC1 and MPC2 can deterministically sever the relationship using additional metadata of the digital components corresponding to those selection values.

[0173] The computational systems MPC1 and MPC2 determine a secret share of the accumulated value for each candidate digit component (414). Conceptually, the accumulated value of a given digit component represents the total number of candidate digit components from the top of that order to the selection value of the given digit component, excluding the given digit component even if it is a candidate. That is, the accumulated value represents the number of candidate digit components that are more qualified for selection than the given digit component. This concept is illustrated in Table 3 below.

[0174]

[0175] Table 3

[0176] In some implementations, the accumulated value of a given number component represents the total number of candidate number components from the top of the sequence to the given number component, including the given number component if it is a candidate. In this example, the fourth column will indicate whether the accumulated value is equal to one and not zero. For brevity, the remaining discussion will follow the first example, where the accumulated value of a given number component represents the total number of candidate number components from the top of the sequence to the given number component, excluding the given number component even if it is a candidate.

[0177] Conceptually, in Table 3, for each numeric component with a candidate parameter is_dc_a_candidate equal to one, the accumulated value (acc) is incremented as it progresses from the top to the bottom of the sequence. The calculation of the accumulated value acc is performed within the secret share, as described below. For example, the accumulated value acc of the numeric component with the highest selection value is zero because the candidate parameter is_dc_a_candidate of the highest selection value is zero. The accumulated value acc of the second highest numeric component is also zero because the candidate parameter is_dc_a_candidate of the second highest numeric component is equal to one, but there is no candidate parameter is_dc_a_candidate with a selection value higher than the second highest numeric component that is equal to one. Moving down the sequence, based on the candidate parameter is_dc_a_candidate of the second highest selection value having a value of one, the accumulated value acc of the candidate parameter is_dc_a_candidate of the third highest selection numeric component is incremented by one. Since the candidate parameter is_dc_a_candidate of the third highest number component is zero, the accumulated value acc of the fourth number component is not incremented, and it has a zero value like the third highest number component.

[0178] Using Table 3, computing systems MPC1 and MPC2 will select the digital component corresponding to the selection value where the total candidate parameter is_dc_a_candidate has a value of one and the accumulated value acc, as indicated in the fourth column of Table 3, has a value of zero for distribution to client device 110. This means the digital component corresponding to the highest-ranking selection value where the candidate parameter is_dc_a_candidate has a value of one. Since the candidate parameter is_dc_a_candidate is kept in a secret share by computing systems MPC1 and MPC2 to maintain user privacy and ensure that user data is not leaked, computing systems MPC1 and MPC2 determine the secret share of the accumulated value acc for each digital component and use round-trip computation to determine which digital component has an accumulated value acc equal to zero and a candidate parameter is_dc_a_candidate equal to one.

[0179] In some implementations, computation systems MPC1 and MPC2 can independently determine their secret shares of the accumulated value acc for each digital component based on a secret share algorithm, without any round-trip computation. For example, computation system MPC1 can determine the first share of the accumulated value acc for each digital component i by traversing all digital components in descending order and summing the candidate parameters is_dc_a_candidate of the digital components along that path. i,1As described in Table 3 above. Similarly, the computing system MPC2 is able to determine the second share of the accumulated value acc for each digital component i by traversing all digital components in descending order and summing the candidate parameters is_dc_a_candidate of the digital components along that path. i,2 ].

[0180] The computing systems MPC1 and MPC2 determine a secret share (416) for each digital component to indicate whether the accumulated value has a specified value. The specified value can be zero, as shown in columns 3 and 4 of Table 3. As mentioned above, the digital component with an accumulated value of zero and a total candidate parameter is_dc_a_candidate of one is the digital component with the highest selected value among the candidate digital components.

[0181] Computational systems MPC1 and MPC2 can participate in multiple rounds of computation, such as multiple RPCs, as part of a secure MPC process to compute an equality operation acc based on the secret share of each digital component i. i == 0. The equality operation is used to determine the accumulated value acc of the digital component i. i Does it have a zero value? At the end of this process, the computation system MPC1 has a result acc for each digital component i. i == 0 is a secret share, and the computation system MPC2 has a result acc for each digital component. i Another secret share of ==0.

[0182] The computing systems MPC1 and MPC2 determine the winner parameter is_dc_the_winner for each digital component i. i The secret share (418). The computing systems MPC1 and MPC2 are able to calculate the accumulated value acc of each digital component i. i The secret share of == 0 and the candidate parameter is_dc_a_candidate i The secret share is used to determine the winner parameter is_dc_the_winner for each number component i. i The winner parameter for each number component i is_dc_the_winner i It can be a Boolean value that indicates whether digital component i is the winner of the selection process, for example, whether digital component i is selected for distribution to client device 110 in response to a digital component request.

[0183] In some implementations, computing systems MPC1 and MPC2 are capable of executing a secret share multiplication protocol to compute the winner parameter is_dc_the_winner for each selection value based on the secret share. i==(is_dc_a_candidate) i ×(acc i == 0). This can include an RPC between computing systems MPC1 and MPC2 to multiply by two secret shares. At the end of the MPC process, computing system MPC1 has what is represented as [is_dc_the_winner] i,1 ] = [is_dc_a_candidate i,1 ]x([acc i,1 The result of ]==1) is_dc_the_winner i A secret share. Similarly, the computing system MPC2 has a share represented as [is_dc_the_winner] i,2 ] = [is_dc_a_candidate sv,2 ]x([acc i,2 The result of ]==0 is_dc_the_winner i Another secret share. Note that for all number components, at most one number component has a winner parameter is_dc_the_winner equal to one. i This is the digital component selected for distribution to client device 110. All others will be equal to zero.

[0184] For the first value selection process, computational systems MPC1 and MPC2 are able to perform a similar process to determine the winner parameter is_dc_the_winner for each digital component i. i For example, computing systems MPC1 and MPC2 can perform a secret share equivalence test to determine the secret share (maybe_first_sv) of the first selected value parameter. i =(acc i == 0). The first choice value parameter for digital component i is maybe_first_sv. i This can be a Boolean value indicating whether the selected value of a numeric component is likely the highest among the candidate numeric components. The selected value will only be the highest among the candidate numeric components if the numeric component corresponding to the selected value is actually a candidate numeric component. Therefore, the first selected value parameter for numeric component i is `maybe_first_sv`. i This indicates whether a digital component will have the highest selection value if it is actually a candidate digital component. At the end of this equality test, the computing system MPC1 has the first selection value parameter `maybe_first_sv` for digital component i. i The first secret share [maybe_first_sv] i,1Furthermore, the computational system MPC2 has the first selected value parameter maybe_first_sv for digital component i. i The second secret share [maybe_first_sv] i,2 ].

[0185] Then, computing systems MPC1 and MPC2 can use the following relation 4 to calculate the winner parameter is_dc_the_winner for each digital component i based on the secret share. i :

[0186] isdc_the_winner i ==((is_dc_a_candidate) i =TRUE)AND(maybe_first_sv i =TRUE))

[0187] Calculation systems MPC1 and MPC2 determine the selection result (420). In some embodiments, calculation systems MPC1 and MPC2 can calculate the selection result based on the winner parameter of the digital component and the digital component information element dc_information_element of the digital component. As described above, the digital component information element dc_information_element of the digital component can include the selection value of the digital component and other data of the digital component.

[0188] Conceptually, computing systems MPC1 and MPC2 can use the following relation 5 to calculate the selection result parameter "result":

[0189] result = Σ i is_dc_the_winer i ×dc_information_element i

[0190] In other words, computing systems MPC1 and MPC2 are able to determine the winner parameter is_dc_the_winner across all digital components. i and the digital component information element dc_information_element i The sum of the products. In this example, the selection result will have a value of zero if no candidate number component exists, or it will have a value equal to the winner parameter is_dc_the_winner if it has a value equal to one. iThe value of the digital component information element dc_information_element for the selected digital component. In another example, the digital component information element dc_information_element can be replaced with the selected value of the digital component in relation 5.

[0191] In this example, the selection result will have a value of zero if no candidate number component exists, or it will have a value equal to the winner parameter is_dc_the_winner if it has a value equal to one. i The value of the selected digital component.

[0192] In order to perform calculations within the secret share, the computing system MPC1 acquires all digital components and then uses the digital component information element dc_information_element, which can be used to represent the digital components in plaintext. i Multiply by the winner parameter of the number component [is_dc_the_winner] i,1 The first secret share of the result. Then, the computing system MPC1 is able to determine the sum of these products and return the sum to the client device 110 that submitted the digital component request. That is, the computing system MPC1 can use the following relation 6 to determine the sum as the first secret share of the result [result1]:

[0193] [result1]=∑ i ([is_dc_the_winner i ×dc_information_element i )

[0194] The computing system MPC2 can perform similar calculations using the following relation 7 to determine the second secret share of the result [result2]:

[0195] [result2]=∑ i ([is_dc_the_winner i ×dc_information_element i )

[0196] Computing system MPC1 sends a first share [result1] (422) of the selection result to client device 110. Similarly, computing system MPC2 sends a second share [result2] (424) of the selection result to client device 110. Application 112 can then reconstruct the selection result result in plaintext using the two secret shares [result1] and [result2], for example, by determining the sum of the secret shares using an additive secret share algorithm. If the selection result has a value of zero, MPC cluster 130 does not recognize the digital component used to distribute to client device 110. Otherwise, the selection result has a value equal to the digital component information element dc_information_element. Application 112 can parse the digital component information element dc_information_element to obtain the selection value and metadata of the digital component. Application 112 can then display the digital component or perform the selection process using the digital component and other digital components received from SSP 170, as described above.

[0197] In some implementations, a mask is used to send the selected digital component to client device 110 to prevent computing systems MPC1 or MPC2 from accessing the selected digital component in plaintext and to reduce latency in sending the digital component to client device 110. In this example, application 112 is able to select a random number for each digital component request and send the random number along with the digital component request. Application 112 is able to send the random number to either computing system MPC1 or MPC2. For illustrative purposes, it is assumed that the random number is sent to computing system MPC2.

[0198] Both Application 112 and Computation System MPC2 can independently compute a mask of the same size as the largest digital component created using the same algorithm and the same input. For example, the i-th bit of the mask can be represented as PRF(random number, i), where PRF represents a pseudo-random function. Both Application 112 and Computation System MPC2 can keep the random number and mask strictly confidential from Computation System MPC1.

[0199] In order to send the selected digital component to application 112, computing system MPC2 is able to send the bit-by-bit XOR mask of [result2] to computing system MPC1. Then, computing system MPC1 sends the bit-by-bit XOR of [result1] (the bit-by-bit XOR mask of [result2]) as the selection result (e.g., as a response to the request for the digital component) to application 112.

[0200] Application 112 can compute a bitwise XOR of [result1] with a bitwise XOR mask of [result2] as the idea of ​​the digital component. This is equivalent to a bitwise XOR of [result1] with [result2]. This reduces the required bandwidth to the size of the maximum idea while preserving the guarantee of private information retrieval. As mentioned above, this reduces the bandwidth of the response relative to sending two secret shares of the selected result. In this way, there is little or no additional latency or bandwidth consumption in this privacy-preserving technique compared to sending the digital component idea as in other processes.

[0201] For the second value selection process, computing systems MPC1 and MPC2 are able to calculate the second selection value parameter maybe_second_sv for each digital component. i The secret share. The second selection value parameter of digital component i can be a Boolean value indicating whether the selection value of the digital component is likely the second highest selection value among the candidate digital components. The selection value will only be the second highest selection value among the candidate digital components if the digital component corresponding to the selection value is actually a candidate digital component. Therefore, the second selection value parameter of digital component i may_second_sv i This indicates whether a digital component will have the second highest selection value if it is actually a candidate digital component. Computation systems MPC1 and MPC2 are capable of performing a secret share equality test to determine the secret share (maybe_second_sv) of the second selection value parameter. i =(acc i ==1).

[0202] At the end of the equality test, the computing system MPC1 has the second selected value parameter maybe_second_sv for the digital component i. i The first secret share [maybe_second_sv] i,1 Furthermore, the computational system MPC2 has a second selectable value parameter, possibly_second_sv, for the digital component i. i The second secret share [maybe_second_sv] i,2 ].

[0203] Then, computing systems MPC1 and MPC2 are able to determine is_dc_a_candidate for each digital component i. i AND maybe_second_sv iThe result is a Boolean value of either true or one, which determines the candidate digit component with the second highest selection value based on the secret share. That is, the computing systems MPC1 and MPC2 can determine which digit component is a candidate digit component and has a second selection value parameter, maybe_second_sv, that is either true or one. i .

[0204] Conceptually, computing systems MPC1 and MPC2 can use the following relation 8 to calculate the second-highest selection value among the candidates:

[0205] second_selection_value =

[0206] ∑ i (selectionvalue i x(is_dc_a_candidate i AND maybe_second_sv i ))

[0207] In relation 8, the parameter "selectionvalue" i " is the selection value of numeric component i (with any promotion), and the parameter "second_selection_value" is the value of the second highest selection value among the candidate numeric components. Using the relation, the second selection value is the selection value as a candidate numeric component, and has a second selection value parameter with a Boolean value of true. The Boolean value in this relation can be regarded as a value of one (for true) or zero (for false).

[0208] Within the secret share, computing systems MPC1 and MPC2 use the secret share to calculate is_dc_a_candidate. i ANDmaybe_second_sv i The result is expressed as two additive secret shares in Z2 space (e.g., additive and then modulo 2). Furthermore, the selection value is in plaintext form. It is possible to obtain the result by comparing each bit of the selection value in plaintext form with the is_dc_a_candidate held by each computing system MPC1 and MPC2. i AND maybe_second_sv i The result is simplified by using a bitwise logical AND operation between 1-bit secret shares to replace multiplication in relation 8. Additionally, a bitwise XOR operation can be used instead of summation.

[0209] Figure 5This is a swimlane diagram of an exemplary process 500 for selecting digital components to be distributed to client devices. The operation of process 500 can be implemented, for example, by computing systems MPC1 and MPC2 of the MPC cluster 130. The operation of process 500 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 500. As described above, process 500 can be used for selection processes that include hierarchical structures.

[0210] Computing systems MPC1 and MPC2 determine the selection value for the digital component (502). Computing systems MPC1 and MPC2 are capable of obtaining or determining the selection value in response to a digital component request received from client device 110. Computing system MPC1 identifies qualified digital components eligible for use in the digital component selection process (504). Computing system MPC2 also identifies qualified digital components eligible for use in the digital component selection process (506). For each qualified digital component, computing systems MPC1 and MPC2 determine whether the digital component is a candidate for use in the digital component selection process (508). Steps 502 to 508 are compatible with... Figure 4 Steps 402 to 408 of process 400 shown are the same or similar.

[0211] The computing system MPC1 groups digital components into hierarchies (510). As described above, the publisher can establish hierarchies for the DSP 150 and / or the digital component provider 160. The publisher's hierarchy can include a highest priority hierarchy, a lowest priority hierarchy, and optionally one or more hierarchies between the highest and lowest priority hierarchies.

[0212] Computing system MPC1 can determine the hierarchy of each digital component based on DSP 150 or digital component provider 160, which corresponds to, for example, the one that provides selection values ​​or value vectors for the digital component. Computing system MPC1 can then group the digital components into their respective hierarchies. Similarly, computing system MPC2 can group digital components into their respective hierarchies (512). For both computing systems MPC1 and MPC2, the groups of digital components at each hierarchy should be the same. In some implementations, SSP 170 explicitly determines the hierarchy and then encodes the hierarchy into metadata for each selection value to be stored (e.g., cached in MPC cluster 130).

[0213] Then, computing systems MPC1 and MPC2 can perform a separate selection process for each of one or more levels to select the digital component to be provided in response to a digital component request (513). In some embodiments, computing systems MPC1 and MPC2 perform the selection process for that level in parallel. In some embodiments, computing systems MPC1 and MPC2 perform the selection process sequentially, starting from the highest priority level and moving down level by level until the selection process has been performed for all levels. In some embodiments, computing systems MPC1 and MPC2 can stop once a candidate is found in a level, but this may have the risk of disclosing user-sensitive information to computing systems MPC1 and MPC2. The steps in the dashed box are performed for each level for which a separate selection process is performed.

[0214] The computing system MPC1 sorts the digital components grouped into hierarchies by selection values ​​(514). Selection values ​​can be sorted first by hierarchical priority, and then by selection values ​​within the same hierarchical level. Similarly, the computing system MPC2 sorts the digital components grouped into hierarchies by selection values ​​(516). For each hierarchical level, these steps 514 and 516 are similar to... Figure 4 Steps 410 and 412 of process 400 are shown. However, the sequence only includes the digital components included in the hierarchy.

[0215] The computing systems MPC1 and MPC2 collaborate to determine the accumulated value acc of each digital component in the hierarchy. i The secret share (518). As described above, the accumulated value of a given number component can represent the total number of candidate number components from the top of the order to the selected value of the given number component, excluding the given number component even if it is a candidate. The computing systems MPC1 and MPC2 can be referenced as above. Figure 4 The cumulative value of the digital components in the hierarchy is determined in a similar manner to step 414 of process 400.

[0216] In some implementations, computation systems MPC1 and MPC2 can independently determine their secret shares of the accumulated value acc for each digital component based on a secret share algorithm, without any round-trip computation. For example, computation system MPC1 can determine the first share of the accumulated value acc for each digital component i by traversing all digital components in the hierarchy in descending order and summing the candidate parameter is_dc_a_candidate of the digital component along that path. i,1As described in Table 3 above. Similarly, the computing system MPC2 is able to determine the second share of the accumulated value acc for each digital component i by traversing all digital components in the hierarchy in descending order and summing the candidate parameter is_dc_a_candidate of the digital components along that path. i,2 ].

[0217] The computational systems MPC1 and MPC2 determine a secret share (520) for each candidate numeric component in the hierarchy, indicating whether the accumulated value equals a specified value. The specified value can be zero, as shown in columns 3 and 4 of Table 3. Within the hierarchy, the numeric component with an accumulated value of zero and a total candidate parameter is_dc_a_candidate having a Boolean value of either true or one is the numeric component with the highest selected value among the candidate numeric components in that hierarchy (if any).

[0218] Computational systems MPC1 and MPC2 can participate in multiple rounds of computation, such as multiple RPCs, as part of a secure MPC process to compute an equality operation acc based on the secret share of each digital component i. i == 0. The equality operation is used to determine the accumulated value acc of the digital component i. i Does it have a value of zero? At the end of this process, the computation system MPC1 has a result acc for each digital component i in the hierarchy. i == 0 is a secret share, and the computation system MPC2 has a result acc for each digital component in the hierarchy. i Another secret share of ==0.

[0219] Computation systems MPC1 and MPC2 determine the secret share of the winning parameter for each digital component in the hierarchy (522). Computation systems MPC1 and MPC2 are able to determine the secret share of the winning parameter based on the accumulated value acc. i == 0 secret share and candidate parameter is_dc_a_candidate for each numeric component i in the hierarchy i The secret share is used to determine the winner parameter is_dc_the_winner for each digital component i in the hierarchy. i The winner parameter for each number component i is_dc_the_winner i This can be a Boolean value indicating whether number component i is the winner of the selection process at that level; for example, whether number component i is a candidate number component and has the highest selection value among the candidate number components in the level. In some implementations, computing systems MPC1 and MPC2 can perform a secret share multiplication protocol to calculate the winner parameter is_dc_the_winner for each selection value based on the secret share. i=(is_dc_a_candidate i ×(acc i ==0)).

[0220] Computational systems MPC1 and MPC2 determine the selection result (524). Computational systems MPC1 and MPC2 are able to determine the winner by including the winning parameter is_dc_the_winner. i The highest level of the number components determines the selection result, and the winning parameter has a value (e.g., Boolean true or one) indicating that the number component is the winner of that level. This number component is the winner of the entire number component selection process. Computation systems MPC1 and MPC2 are able to use accumulated values ​​to determine the highest level with a winning parameter equal to true or one. For example, computation systems MPC1 and MPC2 can identify the highest level where the accumulated value of all number components in that level is not zero.

[0221] Computing system MPC1 provides a first secret share (526) of the selection result to client device 110, which receives the digital component request from it. Computing system MPC2 provides a second secret share (528) of the selection result to client device 110, which receives the digital component request from it.

[0222] In the second value selection process, which includes tiers, the selection value of a digital component is eligible to provide a second selection value only if the digital component is in the same tier as the selected digital component. To determine the second selection value, computing systems MPC1 and MPC2 are able to calculate the winning tier parameter `maybe_winning_tier` for each tier `t`, indicating whether that tier `t` includes the digital component selected for distribution to client device 110. t Conceptually, computing systems MPC1 and MPC2 can use the following relation 9 to calculate the winning tier parameter maybe_winning_tier for each tier t. t :

[0223]

[0224] In relation 9, the parameter "T" represents all levels with a higher priority than level t. Therefore, the winning level parameter is `maybe_winning_tier`. t This indicates whether any higher priority level includes candidate number components. If not, then if level t includes at least one candidate number component, that level is the winning level.

[0225] It is also possible to use RPCs between computing systems MPC1 and MPC2 to perform equality tests between the sum and the value of zero. Multiple RPCs used for various calculations can be grouped together into a smaller number of RPCs to reduce latency and network bandwidth consumption between computing systems MPC1 and MPC2.

[0226] Then, computing systems MPC1 and MPC2 can, based on the candidate parameter is_dc_a_candidate of a given digital component,... i The second selection value parameter for the digital component is maybe_second_sv i (It can be referenced as above) Figure 4 The calculated tier (and the winning tier parameter maybe_winning_tier, which includes a tier t containing a given numerical component) and the winning tier. t The combination of these factors determines whether the second selection value is set by the selection value of a given numeric component. For example, when the given numeric component is_dc_a_candidate i AND maybe_second_sv i AND maybe_winning_tier t When the second selection value is true or one (Boolean value), it is set by the selection value of the given numeric component.

[0227] Then, computing systems MPC1 and MPC2 can determine a second selection value using the selection value of a given digital component. For example, the second selection value can be equal to the selection value of the given digital component or the selection value of the given digital component plus a specified amount.

[0228] DSP 150 and digital component provider 160 can typically benefit from knowing the other highest selection values ​​in the digital component process, enabling them to optimize or improve the selection values ​​they provide for digital components in similar selection processes. For example, DSP 150 whose digital component is selected can benefit from knowing how much higher its selection value is than the next highest value. Similarly, DSP 150 whose digital component is not selected can benefit from knowing how much higher the selection value will need to be for the digital component to be selected. When DSP 150 and / or digital component provider 160 provide selection values ​​based on this information, DSP 150 is more likely to achieve its objectives, such as avoiding waste due to excessively high selection values ​​or avoiding losing digital component presentation opportunities due to low selection values.

[0229] For either the DSP 150 or the digital component provider 160 whose digital component is selected, the highest alternative selection value is the second highest selection value. For all other selection values, the highest alternative selection value is the highest selection value. This is the same for both the first and second value selection processes.

[0230] Figure 6 This is a diagram of an exemplary process 600 for determining the highest alternative selection value of a digital component during the selection process. The operation of process 600 can be implemented, for example, by computing systems MPC1 and MPC2 of the MPC cluster 130. The operation of process 600 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 600.

[0231] Computing systems MPC1 and MPC2 perform a digital component selection process to select digital components for distribution to client devices (602). Computing systems MPC1 and MPC2 can cooperate using a secure MPC process to select digital components, as referenced above. Figures 3 to 5 As stated above.

[0232] Computing systems MPC1 and MPC2 determine a first selection value (604) for the digital component selection process. The first selection value can be the selection value of the digital component selected for distribution to client device 110. For example, the first selection value can be the highest selection value among candidate digital components. If a hierarchy is used, the first selection value can be the highest selection value among candidate digital components in the highest priority hierarchy, which includes at least one candidate digital component.

[0233] Computing systems MPC1 and MPC2 can collaborate to determine a first selected value using a secure MPC process. Conceptually, computing systems MPC1 and MPC2 can determine the first selected value using the following relation 10:

[0234] First choice value

[0235] =Σ(selection_value) i x(is_dc_a_candidate i AND maybe_first_sv i ))

[0236] This sum represents the selection value across all digital components included in the digital component selection process. The selection value (selection_value) is the selection value for each digital component i. i It can be in plaintext form. As mentioned above, computing systems MPC1 and MPC2 can compute the candidate parameter is_dc_a_candidate. i and the first selection value parameter maybe_first_sv i The secret share. The computing system MPC1 is able to store the candidate parameter is_dc_a_candidate for each digital component i. iThe first share [is_dc_a_candidate] i,1 ] and the first choice value parameter maybe_first_sv i The first share [maybe_first_sv] i,1 Similarly, the computing system MPC2 is able to store the candidate parameter is_dc_a_candidate for each digital component i. i The second share [is_dc_a_candidate] i,2 ] and the first choice value parameter maybe_first_sv i The second share [maybe_first_sv] i,2 ].

[0237] The computing systems MPC1 and MPC2 determine a second selection value (606) for the digital component selection process. The second selection value can be the next highest selection value following the selection value of the digital component selected for distribution to the client device 110. For example, the second selection value can be the second highest selection value of a candidate digital component. If a hierarchy is used, the second selection value can be the second highest selection value of a candidate digital component in the highest priority hierarchy that includes at least one candidate digital component.

[0238] Computing systems MPC1 and MPC2 can collaborate to determine a second selection value using a secure MPC process. Conceptually, computing systems MPC1 and MPC2 can determine the second selection value using the following relation 11:

[0239] Second choice value

[0240] =∑(selection_value) i x(is_dc_a_candidate i AND maybe_second_sv i ))

[0241] This summation enables the selection of all digital components across the digital component selection process. As described above, computing systems MPC1 and MPC2 are capable of calculating the candidate parameter is_dc_a_candidate. i The second choice value parameter may_second_sv i The secret share. The computing system MPC1 is able to store a second selection value parameter, maybe_second_sv, for each digital component i. i The first share [maybe_second_sv] i,1 Similarly, the computing system MPC2 is able to store a second selection value parameter, maybe_second_sv, for each digital component i.i The second share [maybe_second_sv] i,2 ].

[0242] In relations 10 and 11, Boolean values ​​true and false can be treated as one and zero, respectively. In the secret shares, computational systems MPC1 and MPC2 use the secret shares (e.g., using RPC between computational systems) to calculate the result of the AND operation of relations 10 and 11, and represent the result as two additive secret shares in Z2 space (e.g., summed and then modulo 2). Therefore, each computational system can store secret shares of the first and second selected values. For example, computational system MPC1 can store the first share of the first selected value and the first share of the second selected value. Similarly, computational system MPC2 can store the second share of the first and second selected values. The sum of the two shares of the first selected value (e.g., summed and then modulo 2) equals the first selected value, and the sum of the two shares of the second selected value (e.g., summed and then modulo 2) equals the second selected value.

[0243] It is possible to use the selection value (selection_value) i The bitwise AND operation between each selected value in the equation and the candidate parameter and the 1-bit secret share of the result of the AND operation between the first selected value parameter (or the second selected value parameter) held by each computing system MPC1 and MPC2 simplifies relations 10 and 11 by replacing multiplication with a bitwise AND operation. Furthermore, the summation of relations 10 and 11 can be replaced by a bitwise XOR operation.

[0244] For each digital component, computing systems MPC1 and MPC2 compute the highest alternative value (608). Computing systems MPC1 and MPC2 are capable of computed to the highest alternative value for a digital component using a two-step process within the secret share. Computing systems MPC1 and MPC2 are also capable of computed to the winner parameter is_dc_the_winner for digital component i. i The computing systems MPC1 and MPC2 can use the candidate parameter is_dc_a_candidate i The secret share and the first choice value parameter maybe_first_sv i The secret share is used to calculate the winner parameter is_dc_the_winner i For example, is_dc_the_winner i =is_dc_a_candidate i AND maybe_first_sv i .

[0245] Then, computing systems MPC1 and MPC2 are able to use relation 12 to calculate the highest alternative choice value (HOSV) of digital component i. i ):

[0246] HOSV i =(is_dc_the_winner i ×second choice value)+((1-is_dc_the_winner) i (×First Choice Value)

[0247] Because the winner parameter, the first choice value, and the second choice value are kept in secret shares by computing systems MPC1 and MPC2, computing systems MPC1 and MPC2 collaboratively determine the highest other choice value using RPC between the two computing systems MPC1 and MPC2.

[0248] At the end of this process, the first share of the highest other selected value [HOSV] of the calculation system MPC1 stores digital component i. i,1 ], and calculate the second share of the highest other choice value of system MPC2 storage digital component i [HOSV] i,2 ].

[0249] Computing system MPC1 sends a first share of the highest alternative selection value for each digital component to, for example, the DSP 150 or digital component 160 corresponding to the digital component (610). Similarly, computing system MPC2 sends a second share of the highest alternative selection value for each digital component to, for example, the DSP 150 or digital component 160 corresponding to the digital component (612). In some embodiments, computing systems MPC1 and MPC2 provide the shares to an aggregation service that aggregates information for each DSP 150 and / or each digital component provider 160.

[0250] The recipients of two secret shares can combine the shares to derive the highest alternative choice value for a digital component during the selection process. For example, if an additive secret share algorithm is used, the recipient can derive the highest alternative choice value by adding the two shares together.

[0251] Computing systems MPC1 and MPC2 can send additional data along with the highest other selection value. For example, MPC1 and MPC2 can send context signals for the digital component selection process, such as lookup keys, along with their shares of the highest other selection value. In this way, a landscape of selection values ​​for digital component selection processes with the same or similar contexts can be calculated using the highest other selection value for the digital component selection process.

[0252] In some implementations, to improve performance, computing systems MPC1 and MPC2 can asynchronously calculate the highest alternative selection value after the selection result of the digital component selection process is provided to client device 110. This reduces the latency in transmitting and displaying digital components. In some implementations, computing systems MPC1 and MPC2 can calculate the highest alternative selection value when the load on them is below the baseline load.

[0253] For selection processes that include a lower bound on the selection value, additional steps can be taken to accurately calculate the highest alternative selection value. Calculation systems MPC1 and MPC2 can calculate the highest alternative selection value, as shown in the reference... Figure 6 The calculation systems MPC1 and MPC2 can then adjust the highest of the other selected values ​​to take into account the lower limit, for example, so that no selected value is less than the applicable lower limit.

[0254] Let H denote the highest alternative value calculated, and F denote the applicable lower bound. The final highest alternative value will be (H>F)×H+(1-H>F, which is equivalent to F+(H>F)×(HF).

[0255] To protect user privacy, H is in the form of a secret share. Each computing system MPC1 and MPC2 maintains one of the secret shares [H1] and [H2], respectively. Computing system MPC1 is able to use relation 13 to compute the first share of the final highest alternative value in the secret shares:

[0256] [HOSV1]=F+([H1]>F)×([H1]-F)

[0257] Similarly, the computational system MPC2 can use relation 14 to compute the second share of the final highest alternative value in the secret share:

[0258] [HOSV2]=F+([H2]>F)×([H2]-F)

[0259] The calculation is used for the process of selecting the highest alternative value of the digital component process, which includes the lower limit. This process can be compared and tested using three or more rounds of RPC, with one round used for multiplication.

[0260] When tiers and / or promotions are used in the selection of digital components, the first selection value (e.g., the selection value of the selected digital component) can be lower than the highest selection value among the candidate digital components. For example, if a candidate digital component in the highest priority tier has a lower selection value than a candidate digital component in a lower priority tier, a candidate digital component in the higher priority tier can be selected despite having a lower selection value. Similarly, a digital component can receive a promotion that makes the selection value used in the digital component selection value higher than that of an unpromoted (or lower-promoted) digital component, resulting in the publisher receiving less than it would have if it had selected an unpromoted digital component. The MPC cluster 130 is able to determine the difference between the two values, allowing the publisher to analyze the opportunity cost associated with tiers and / or promotions.

[0261] Figure 7 This is a flowchart of an exemplary process 700 for determining the difference between a first selection value in a true digital component selection process and a first selection value in a counterfactual digital component selection process. The operation of process 700 can be implemented, for example, by computing systems MPC1 and MPC2 of the MPC cluster 130. The operation of process 700 can also be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 700.

[0262] Computing systems MPC1 and MPC2 execute a real digital component selection process (702). Computing systems MP1 and MPC2 are capable of executing a real digital component selection process to select digital components to be provided to client device 110 in response to a digital component request. The real digital component selection process may include a hierarchy of digital components and / or the promotion of one or more digital components included in the digital component selection process. For example, the real digital component process should be consistent with... Figures 3 to 5 The process is the same or similar.

[0263] Computing systems MPC1 and MPC2 perform a counterfactual digital component selection process (704). The steps of the counterfactual digital component selection process can be similar to the steps of the real digital component selection process. However, in the counterfactual digital component selection process, the hierarchy and / or elevation of the real digital component selection process are removed. If the real digital component selection process includes hierarchy (e.g., as in...), ... Figure 4 In process 400), the counterfactual digital component selection process has all digital components in a group (e.g., as in...). Figure 5(In process 500). If the true digital component selection process involves boosting the selection value of one or more digital components, then those boosts are removed in the counterfactual digital component selection process. That is, the selection value in the counterfactual digital component selection process can be the received selection value rather than the boosted selection value.

[0264] The calculation systems MPC1 and MPC2 determine a clearing value (706) for the actual digital component selection process. This clearing value can be based on the selection value of the selected digital component. For example, the clearing value can be the amount that will actually be provided to the publisher for displaying the selection value of the selected digital component. If the selection value of a digital component is boosted, the boost amount will only affect the order of the selection values ​​when the accumulated value of each candidate digital component is determined in operation 414.

[0265] For the second value selection process, the liquidation value will be the next highest selected value after the selected digital component. If a tier is used in conjunction with the second value selection process, the next highest value will be the next highest value in the same tier as the selected digital component. If no such candidate digital component exists in the same tier, the next highest value can be the minimum value used in the digital component selection process.

[0266] The calculation systems MPC1 and MPC2 determine a liquidation value (708) for the counterfactual digital component selection process. This liquidation value can be based on the digital component selected in the counterfactual digital component selection process. For the second value selection process, the liquidation value will be the next highest selection value after the selection value of the selected digital component, similar to the liquidation value used for the real digital component selection process.

[0267] The calculation systems MPC1 and MPC2 determine the difference between the two liquidation values ​​(710). The calculation systems MPC1 and MPCs determine the difference by subtracting the liquidation value used in the counterfactual digital component selection process from the liquidation value of the true digital component selection value.

[0268] Computing systems MPC1 and MPC2 provide this difference to the recipient (712). For example, one of the computing systems can provide this difference to the publisher of the resource or application content that is displayed with the digital component after selection. In another example, one of the computing systems can provide the difference to an aggregation server that aggregates the publisher's differences. In either example, the computing system can provide contextual signals (e.g., lookup keys) for the actual digital component selection process, along with data indicating the difference, and data identifying the publisher (if sent to the aggregation server).

[0269] The aggregation server is capable of aggregating the differences reported by each publisher and providing data indicating the opportunity costs of using tiers and / or upgrades, for example, in the form of an interactive user interface. In some implementations, the computing systems MPC1 or MPC2 are also capable of providing the aggregation server with selection results for each real digital component selection process. In this way, the aggregation server is able to aggregate the opportunity costs for each DSP 150 and / or digital component provider 160.

[0270] To reduce the delay in providing the selected digital component to the client device 110 during the real digital component selection process, some or all of steps 704 to 712 of process 700 can be executed asynchronously after the selection result is provided to the client device 110.

[0271] Figure 8 This is a flowchart of an exemplary process 800 for determining whether a user is a member of a user group using a Bloom filter that utilizes secret shares. The operation of process 800 can be performed, for example, by an application 112 running on client device 110 and... Figure 1 The operation of process 800 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 800.

[0272] Using a Bloom filter to send data representing a user's group membership reduces the amount of data being sent and protects user privacy because the data identifying a user's user group is not sent in plaintext. To prevent computing systems MPC1 and MPC2 from accessing a user's group membership in plaintext, application 112 can send a corresponding share of the Bloom filter, such as a secret share, to each computing system 112, instead of sending the complete Bloom filter to each computing system MPC1 and MPC2. However, this would require sending the equivalent of sending two Bloom filters, one for each computing system MPC1 and MPC2. To prevent this and further reduce the amount of data sent from client device 110 across network 105 to computing systems MPC1 and MPC2, application 112 can send a first array generated using random numbers and the original Bloom filter created by application 112 to one of the computing systems (e.g., computing system MPC1), and only send the random numbers to the other computing system MPC2. In this way, only one array is sent from client device 110. Since the random number can be very small, such as 16 bytes, this greatly reduces the amount of data sent from the client device 110, which reduces the bandwidth consumption, latency and battery consumption of the client device 110.

[0273] Although process 800 is described using a Bloom filter representing user membership in a user group, a similar process can be used to generate a Bloom filter representing the blocked digital component and query whether the digital component is blocked. In this example, the Bloom filter would represent the identifier of the blocked digital component instead of the identifier of the user group.

[0274] The Bloom filter can be configured to be suitable for transmission and / or processing by computing systems MPC1 and MPC2. Bloom filter parameters include the number of user groups that can be represented by the Bloom filter, the expected false alarm rate of the Bloom filter, the number of hash functions used to generate the Bloom filter and test whether an element is included in the Bloom filter, and the size of the Bloom filter.

[0275] Reducing the number of hash functions decreases the computational burden on computing systems MPC1 and MPC2 when querying whether a user is a member of a user group. However, this can increase the false positive rate if the Bloom filter size remains constant. If a target false positive rate exists, reducing the number of hash functions may result in a larger Bloom filter size, which can increase the amount of bandwidth consumed. Therefore, the parameters of the Bloom filter can be selected by weighing bandwidth / battery consumption against the computational burden on computing systems MPC1 and MPC2.

[0276] Application 112 generates a Bloom filter (802). Application 112 is able to generate a Bloom filter using user group identifiers of user groups that include users of Application 112 as members. To do this, Application 112 uses each hash function of the Bloom filter to map the user group identifier to one of the positions in the Bloom filter. Application 112 is able to perform this operation for each user group identifier of the user. When constructing a Bloom filter for a blocked digital component, Application 112 is able to apply each hash function of the Bloom filter for the blocked digital component to the identifier of each blocked digital component. The Bloom filter is a bit array A of size N, where each bit of the Bloom filter is either zero or one, i.e., A[i]∈{0,1}.

[0277] Application 112, along with computing systems MPC1 and MPC2, can agree in advance on the pseudo-random function (PRF). The PRF can take two parameters and generate PRF numbers in {0,1} (inclusive).

[0278] Application 112 selects a random number (804). For each digital component request, application 112 can, for example, randomly or pseudo-randomly select a random number to share with only one of computing systems MPC1 or MPC2. In this example, the random number is shared with computing system MPC2.

[0279] Application 112 uses a Bloom filter and random numbers to compute the first array A1 (806). Application 112 can compute the first array A1 using an agreed PRF. For example, Application 112 can compute the first array A1 using relation 15:

[0280] A1[i] = A[i] XOR PRF(random number, i)

[0281] In relation 15, the XOR operation is a bit-by-bit XOR operation.

[0282] Application 112 sends the first array to computing system MPC1 (808). Application 112 also sends random numbers to computing system MPC2 (810).

[0283] The computing system MPC2 uses random numbers to compute the second array A2 (812). The computing system MPC2 can compute the second array A2 using both random numbers and PRF. For example, the computing system MPC2 can compute the second array A2 using relation 16:

[0284] A2[i] = PRF(random number, i)

[0285] The computing systems MPC1 and MPC2 use a first array A1 and a second array A2 to determine whether a user is a member of one or more user groups (814). Typically, a Bloom filter can be queried by applying each hash function of the Bloom filter to the user group identifier to determine the elements of the Bloom filter corresponding to the hash function and the user group identifier. If, for the user identifier, the value of each element of the hash function is one, this indicates that the user is a member of the group. Of course, due to the nature of Bloom filters, some false positives may occur.

[0286] Since neither computing systems MPC1 nor MPC2 have access to the complete Bloom filter (instead, each has only a secret share of the Bloom filter), computing systems MPC1 and MPC2 can use cryptographic protocols to determine whether a user is a member of a user group identifier. Some exemplary cryptographic protocols that can be used include scrambling circuits and the Goldreich-Micali-Wigderson (GMW) protocol.

[0287] In any algorithm, (conceptually) the input is the secret share of the Bloom filter, i.e., the first array A1 and the second array A2. The output is the secret share of the set of Boolean messages, one for each digital component, i.e., whether the user is a member of the user group associated with the corresponding digital component.

[0288] In the GMW protocol, one of the MPC computation systems (e.g., computation system MPC1) creates a truth table, one row for each possible bit pattern, with a secret share held by computation system MPC2. Computation system MPC1, for example, randomly selects its own secret share of the result and calculates the secret share of computation system MPC2 for each row based on its own secret share of the result and the possible secret shares of computation system MPC2 corresponding to that row. After constructing the truth table, computation system MPC2 uses an inadvertent transfer protocol to extract one and only one row from the table based on its own secret share. In this protocol, one computation system transfers one of multiple messages to another without knowing which message (if any) has been transferred. This inadvertent transfer protocol guarantees that the process does not reveal any information to either party.

[0289] The result of querying the Bloom filter for a given user group identifier is a secret share of the user group membership criterion parameter for each hash function. This secret share of the user group membership criterion parameter can be used during the digital component selection process to determine whether a digital component corresponding to a user group is a candidate for the digital component selection process. For example, if 10 hash functions are used, computation system MPC1 will have 10 first secret shares of the user group membership criterion parameter for each user group identifier. Similarly, computation system MPC2 will have 10 second secret shares of the user group membership criterion parameter for each user group identifier.

[0290] If the Bloom filter represents the identifier of the blocked digit component, then computation systems MPC1 and MPC2 can reconstruct a second array and query the Bloom filter in a similar manner. The result of querying the Bloom filter for a given digit component is the blocked condition parameter for each hash function. The secret share of the blocked condition parameter can be used in the digit component selection process to determine whether the digit component is a candidate for the selection process.

[0291] Figure 9 This is a block diagram of an exemplary MPC computing system 900. The MPC computing system 900 can be used to implement any MPC computing system described in this document. Alternatively, the MPC computing system can be implemented as one or more servers. However, the architecture and configuration of the MPC computing system 900 offer many performance improvements compared to using a general-purpose server layout.

[0292] The MPC computing system 900 includes a load balancer 910, a service pool 920, and a log processor pool 940. The computing system 900 also generates, updates, and otherwise maintains logs 930 and snapshots 950.

[0293] In some implementations, the MPC computing system 900 is deployed across various geographical regions to reduce latency in selecting digital components and providing them to client device 110. For example, an MPC cluster with two or more MPC computing systems 900 can be deployed in each region of a set of regions. If each MPC cluster includes two MPC computing systems, such as MPC1 and MPC2, then each region can include a pair of MPC computing systems 900 operated by different parties. Each instance of MPC1 across all regions can be operated by a first party, and each instance of MPC2 across all regions can be operated by a second party different from the first party.

[0294] The MPC cluster in a region can perform a digital component selection process in response to digital component requests generated by client devices 110 in that region. For example, instructions for digital component slots (e.g., tags) sent to client devices 110 in a specific region can include a reference to the network location of MPC computing system 900 in that specific region. In this way, application 112 sends digital component requests and notifications to the appropriate MPC computing system 900 in the appropriate region. In another example, a Domain Name Service (DNS) or load balancer 910 selects the MPC computing system 900 that is physically closest to client device 110.

[0295] MPC1 in the same area can collaborate with MPC2 in the same area to select digital components and update logs based on received requests. This reduces the latency and bandwidth consumption of collaborative computations that require round trips between MPC computing systems 900, as the distance between the MPC computing systems 900 is reduced. This also reduces the latency and bandwidth consumption of data transmission (e.g., digital component requests, digital component responses, and display notifications) between client device 110 and MPC computing system 900.

[0296] In some implementations, the log processor pool 940 is enabled only in appropriate subsets of regions for creating snapshots and publishing them to MPC computing systems 900 in other regions. For example, a first MPC computing system MPC1 can exist in each region operated by the first party. A subset of these first MPC computing systems can create snapshots for all first MPC computing systems and publish the snapshots to other first MPC computing systems. Similarly, a second MPC computing system MPC2 can exist in each region operated by the second party. A subset of these second MPC computing systems can create snapshots for all second MPC computing systems and publish the snapshots to other second MPC computing systems. Importantly, the first MPC computing systems do not share logs or snapshots with the second MPC computing systems, and vice versa, to protect user privacy. However, both the first and second computing systems do perform secure MPC processes to process the data in the logs because at least some of the data is sensitive and / or confidential and should not be accessible in plaintext by either computing system. To do this effectively without increasing latency or bandwidth consumption, a subset of the first MPC computing system and a subset of the second MPC computing system can be in the same region.

[0297] Load balancer 910 receives requests from application 112 running on client device 110. In some examples, these requests, which may be in the form of HTTP requests, can include digital component requests and notifications. Notifications can include display notifications that inform MPC computing system 900 that a digital component has been displayed at client device 110 and, optionally, whether a user has interacted with the digital component. Display notifications can also include additional information, such as a selection process identifier that identifies the digital component selection process in which the displayed digital component is shown. For k-anonymity conditions, display notifications can also include data identifying the winner of the actual digital component selection process and the winner of the counterfactual selection process, enabling MPC computing system 900 to update the display count for each digital component.

[0298] The load balancer 910 can distribute requests to the processors in the service pool 920 in a way that balances the load among the processors in the service pool 920. For example, the load balancer 910 can alternate between processors sequentially, or monitor the load of each processor and distribute requests based on the current load.

[0299] Service pool 920 includes multiple processors, each of which can be implemented as, for example, one or more microprocessors, one or more server-class computers, and / or one or more application-specific integrated circuits (ASICs). The processors of the service pool process incoming requests, which are typically latency-sensitive. For example, the processors of service pool 920 can cooperate with the processors of another MPC computing system 900 to perform a digital component selection process. The processors of service pool 920 can also update log 930 based on the completed digital component selection process and / or received notifications.

[0300] The processor of service pool 920 is capable of maintaining a current database of the stored digital components. This database can include the current values ​​of the parameters and / or conditions of the digital components. For example, for each stored digital component, the database can include secret shares of the parameters of the selected value or vector, at least some conditions (e.g., conditions that can be computed offline, such as k-anonymity and pacing, remaining budget, number of presentations (e.g., k-anonymity conditions)), and / or other data of the digital components used in the digital component selection process described in this document.

[0301] In some implementations, the service pool's database is a snapshot. For example, each snapshot can have a version identifier that identifies the version of the snapshot. Both MPC systems should operate using the same version of the snapshot.

[0302] Log 930 can include various types of logs that store a variety of information related to digital components stored by the MPC cluster. For example, log 930 can include logs for storing digital components and their corresponding data (e.g., selection values, selection value vectors, lookup keys, corresponding user group identifiers, conditions, and / or other appropriate information).

[0303] Log 930 can include a log of information about completed digital component requests. Such a log can include a selection process identifier for each digital component selection process, a settlement value for the digital component selection process, and parameters for each digital component included in the digital component selection process. These parameters can include, for example, a secret share of candidate parameters, a winning parameter, a selection value, and / or the accumulated value of the digital component.

[0304] Log 930 may include logs of parameters used to determine whether the conditions for a digital component are met. For example, for each digital component, such a log may include the number of impressions, the number of selections, the number of conversions, the total budget, the remaining budget, and / or the number of times the digital component has been presented (e.g., the number of times it was selected in a counterfactual selection process for k-anonymity). To protect user privacy and the confidentiality of sensitive user data, in some implementations, log 930 includes a secret share of the above information.

[0305] Log processor pool 940 can include processors (e.g., microprocessors, servers, or ASICs) that process logs 930 and generate snapshots 950 based on the logs. Each snapshot includes updates to a database maintained by the processors of service pool 920. For example, if a digital component is selected and displayed at client device 110, the snapshot can include the remaining budget for updates to the digital component and the number of updates to be displayed. Log processor pool 940 can generate snapshots based on the updated data in logs 930 and publish the snapshots to the processors of service pool 920. The processors of log processor pool 900 can also publish snapshots to other MPC computing systems operated by the same party, for example, if log processor pool 940 is only enabled at some MPC computing systems 900.

[0306] To reduce latency in responding to requests, the processors in service pool 920 can process these requests immediately upon receipt. Less time-sensitive processes can be handled by the processors in log processor pool 940. For example, service pool 920 can execute any process on the critical path of selecting digital components and providing them to client device 110. Log processor pool 940 can execute any process not on the critical path. However, updates to the database should occur quickly to ensure that the latest information is being used to select digital components. Therefore, using processes such as those from... Figure 9 The different processor sets provided by the architecture shown enable both the digital component selection process and database updates to be performed very quickly.

[0307] Figure 10 This is a block diagram of an example computer system 1000 capable of performing the operations described above. System 1000 includes a processor 1010, memory 1020, storage device 1030, and input / output device 1040. Each of components 1010, 1020, 1030, and 1040 can be interconnected, for example, using a system bus 1050. Processor 1010 is capable of processing instructions for execution within system 1000. In some embodiments, processor 1010 is a single-threaded processor. In another embodiment, processor 1010 is a multi-threaded processor. Processor 1010 is capable of processing instructions stored in memory 1020 or storage device 1030.

[0308] The memory 1020 stores information within the system 1000. In one embodiment, the memory 1020 is a computer-readable medium. In some embodiments, the memory 1020 is a volatile memory cell. In another embodiment, the memory 1020 is a non-volatile memory cell.

[0309] Storage device 1030 provides high-capacity storage for system 1000. In some embodiments, storage device 1030 is a computer-readable medium. In various embodiments, storage device 1030 may include, for example, a hard disk drive, an optical disk drive, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other high-capacity storage device.

[0310] Input / output device 1040 provides input / output operations for system 1000. In some embodiments, input / output device 1040 may include one or more of the following: a network interface device, such as an Ethernet card; a serial communication device, such as an RS-232 port; and / or a wireless interface device, such as an 802.11 card. In another embodiment, input / output device may include a driver configured to receive input data and send output data to external device 1060 (e.g., a keyboard, printer, and display device). However, other embodiments, such as mobile computing devices, mobile communication devices, set-top box television client devices, etc., may also be used.

[0311] Although already Figure 10 An example processing system is described herein, but implementations of the subject matter and functional operations described herein can be implemented in other types of digital electronic circuits, or in computer software, firmware, or hardware (including the structures disclosed herein and their equivalents), or in a combination of one or more of them.

[0312] Embodiments of the subject matter and operations described in this specification can be implemented in digital electronic circuits, or in computer software, firmware, or hardware (including the structures disclosed in this specification and their equivalents), or in a combination of one or more of these. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a computer storage medium (or medium) for execution by or control of the operation of a data processing apparatus. Alternatively or additionally, program instructions can be encoded on artificially generated propagated signals, such as machine-generated electrical, optical, or electromagnetic signals, generated to encode information for transmission to a suitable receiver device for execution by the data processing apparatus. The computer storage medium can be a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of these, or be included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of these. Furthermore, although the computer storage medium is not a propagated signal, it can be a source or destination of computer program instructions encoded in artificially generated propagated signals. Computer storage media can also be one or more separate physical components or media (e.g., multiple CDs, discs or other storage devices) or included in one or more separate physical components or media (e.g., multiple CDs, discs or other storage devices).

[0313] The operations described in this specification can be implemented as operations performed by a data processing device on data stored on one or more computer-readable storage devices or received from other sources.

[0314] The term "data processing apparatus" encompasses all kinds of devices, apparatuses, and machines for processing data, including, for example, programmable processors, computers, systems-on-a-chip, or a combination thereof. The apparatus can include special-purpose logic circuitry, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits). In addition to hardware, the apparatus can also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or combinations thereof. The apparatus and execution environment can implement a variety of different computing model infrastructures, such as web services, distributed computing, and grid computing infrastructures.

[0315] A computer program (also known as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but does not need to, correspond to a file in a file system. A program can be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple collaborative files (e.g., a file storing one or more modules, subroutines, or code portions). A computer program can be deployed to execute on a single computer or on multiple computers located at a single site or distributed across multiple sites and interconnected through a communication network.

[0316] The processes and logic flows described in this specification can be executed by one or more programmable processors that execute one or more computer programs to perform actions by manipulating input data and generating outputs. The processes and logic flows can also be executed by dedicated logic circuits, and the devices can be implemented as dedicated logic circuits, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits).

[0317] For example, processors suitable for executing computer programs include both general-purpose microprocessors and special-purpose microprocessors. Typically, a processor receives instructions and data from read-only memory or random access memory, or both. The basic components of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include, or be operatively coupled to, one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, to receive data from or transfer data to, or both. However, a computer does not need to have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), and so on. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices such as EPROM, EEPROM, and flash memory devices; disks such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM discs. Processors and memory can be supplemented by or incorporated into dedicated logic circuits.

[0318] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, and a keyboard and pointing device, such as a mouse or trackball, through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual, auditory, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Furthermore, the computer can interact with the user by sending documents to and receiving documents from the device used by the user; for example, by sending a web page to a web browser on the user's client device in response to a request received from a web browser.

[0319] Embodiments of the subject matter described in this specification can be implemented in a computing system that includes back-end components (e.g., as a data server), middleware components (e.g., an application server), or front-end components (e.g., a client computer having a graphical user interface or web browser that a user can interact with through embodiments of the subject matter described in this specification), or any combination of one or more such back-end components, middleware components, or front-end components. The components of the system can be interconnected via digital data communication (e.g., a communication network) of any form or medium. Examples of communication networks include local area networks (“LANs”) and wide area networks (“WANs”), the Internet (e.g., the Internet), and peer-to-peer networks (e.g., self-organizing peer-to-peer networks).

[0320] A computing system can include clients and servers. Clients and servers are typically geographically separated and usually interact via a communication network. The client-server relationship arises from computer programs running on their respective computers and involves a client-server relationship. In some embodiments, the server sends data (e.g., HTML pages) to the client device (e.g., to display data to a user interacting with the client device and to receive user input from the user). Data generated at the client device (e.g., the result of user interaction) can be received from the client device at the server.

[0321] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope that may be claimed, but rather as descriptions of features specific to particular embodiments of a particular invention. Certain features described in the context of individual embodiments in this specification can also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment can also be implemented individually or in any suitable sub-combination in multiple embodiments. Furthermore, although features may be described above as functioning in certain combinations, and even initially claimed in this way, one or more features from a claimed combination can be removed from that combination in some cases, and the claimed combination may involve sub-combinations or variations thereof.

[0322] Similarly, although operations are described in a specific order in the accompanying drawings, this should not be construed as requiring such operations to be performed in the specific order or sequence shown, or requiring all illustrated operations to be performed to obtain the desired result. In some cases, multitasking and parallel processing can be advantageous. Furthermore, the separation of various system components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0323] Therefore, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific order or sequence shown to achieve the desired result. In some embodiments, multitasking and parallel processing can be advantageous.

Claims

1. A computer-implemented method, comprising: The first server of the secure multi-party computation system receives digital component requests from client devices; For each digital component in the set of digital components, identify the selection value of the digital component and the priority level of the digital component; For each of the multiple priority levels: The secure multi-party computation process, in cooperation with one or more second servers of the secure multi-party computation system, is used to determine the first secret share of the winner parameter for each digital component in the priority hierarchy, including: For each digital component in the priority hierarchy, determine a first secret share of the candidate parameter indicating whether the digital component is a candidate for selection; and Based on (i) the first secret share of the value of the candidate parameter of each digital component in the priority hierarchy, (ii) one or more second secret shares of the candidate parameter of each digital component in the priority hierarchy, and the selection value of each digital component in the priority hierarchy, the secret share of the winner parameter of each digital component in the priority hierarchy is determined. Identify the highest level among the plurality of levels where a given number component has a winner parameter, the winner parameter indicating that the given number component is the winning number component at that level; and Provide the client device with a first secret share that identifies the selection result of the given digital component.

2. The computer-implemented method according to claim 1, wherein, Determining the first secret share of the winner parameter for each digital component in the priority hierarchy by using the secure multi-party computation process in cooperation with one or more second servers of the secure multi-party computation system includes: determining the first secret share of the winner parameter for each digital component in each priority hierarchy in parallel.

3. The computer-implemented method according to claim 1, wherein, Determining the first secret share of the winner parameter for each digital component in the priority hierarchy by using the secure multi-party computation process in cooperation with one or more second servers of the secure multi-party computation system includes: determining the first secret share of the winner parameter for each digital component in each priority hierarchy in a sequence from the highest priority hierarchy to the lowest priority hierarchy.

4. The computer-implemented method according to claim 1, wherein, For each digital component in the priority hierarchy, determining a first secret share of a candidate parameter indicating whether the digital component is a candidate for selection includes: cooperating with each of the one or more second servers to determine the first secret share of the candidate parameter of the particular digital component based on a secret share of one or more conditions of the particular digital component.

5. The computer-implemented method according to claim 1, wherein, For each digital component in the set of digital components, the selection value for identifying the digital component includes: For a given content platform, identify an enhancement established by the publisher of the electronic resource or the publisher's content platform, wherein a request for the digital component of the electronic resource is received; and The enhancement is used to adjust the selection value of each digital component of the content platform.

6. The computer-implemented method according to claim 1, further comprising: Identify a lower limit of selection values ​​established by the publisher of the electronic resource, wherein a request for the digital component of the electronic resource is received; and Filter from the set of digital components one or more digital components that have a selection value less than the lower limit of the selection value.

7. The computer-implemented method according to claim 1, wherein, Determining the secret share of the winner parameter for each digital component in the priority hierarchy includes: The digital components in the priority hierarchy are sorted based on the selection value of each digital component in the priority hierarchy; A first secret share of the accumulated value of each digital component in the priority hierarchy is determined at least based on the first secret share of the candidate parameters of each digital component in the ranking and the priority hierarchy, wherein the accumulated value of the digital component indicates the number of candidate digital components in the priority hierarchy that have a higher selection value than the digital component; and For each digital component in the priority hierarchy, the first secret share of the winner parameter of the digital component is determined based on the first secret share of the candidate parameter of the digital component, each of the one or more second secret shares of the candidate parameter of the digital component, and the accumulated value of the digital component.

8. The computer-implemented method of claim 7, further comprising determining a second selection value corresponding to the second value selection process, including: For each priority level, determine a first secret share of the winning level parameter that indicates whether the given digital component is included in the priority level; For each digital component in the set of digital components, a first secret share of a second selection value parameter is determined, the second selection value parameter indicating whether the selection value of the digital component is likely to be the second highest selection value in the set of candidate digital components; as well as The selection value of a digital component is identified as the second selection value, wherein, for the digital component: (i) the candidate parameter of the digital component indicates that the digital component is a candidate for selection, (ii) the winning tier parameter indicates that the given digital component is included in the winning tier, and (iii) the second selection value parameter indicates that the selection value of the digital component may be the second highest selection value in the set of candidate digital components.

9. A system for selecting digital components for distribution to client devices, comprising: A first server comprising one or more processors; as well as One or more storage devices storing instructions, the instructions causing the one or more processors to perform operations when executed by the one or more processors, the operations including: The first server of the secure multi-party computation system receives digital component requests from the client device; For each digital component in the set of digital components, identify the selection value of the digital component and the priority level of the digital component; For each of the multiple priority levels: The secure multi-party computation process, in cooperation with one or more second servers of the secure multi-party computation system, is used to determine the first secret share of the winner parameter for each digital component in the priority hierarchy, including: For each digital component in the priority hierarchy, determine a first secret share of the candidate parameter indicating whether the digital component is a candidate for selection; and Based on (i) the first secret share of the value of the candidate parameter of each digital component in the priority hierarchy, (ii) one or more second secret shares of the candidate parameter of each digital component in the priority hierarchy, and the selection value of each digital component in the priority hierarchy, the secret share of the winner parameter of each digital component in the priority hierarchy is determined. Identify the highest level among the plurality of levels where a given number component has a winner parameter, the winner parameter indicating that the given number component is the winning number component at that level; and Provide the client device with a first secret share that identifies the selection result of the given digital component.

10. The system according to claim 9, wherein, Determining the first secret share of the winner parameter for each digital component in the priority hierarchy by using the secure multi-party computation process in cooperation with one or more second servers of the secure multi-party computation system includes: determining the first secret share of the winner parameter for each digital component in each priority hierarchy in parallel.

11. The system according to claim 9, wherein, Determining the first secret share of the winner parameter for each digital component in the priority hierarchy by using the secure multi-party computation process in cooperation with one or more second servers of the secure multi-party computation system includes: determining the first secret share of the winner parameter for each digital component in each priority hierarchy in a sequence from the highest priority hierarchy to the lowest priority hierarchy.

12. The system according to claim 9, wherein, For each digital component in the priority hierarchy, determining a first secret share of a candidate parameter indicating whether the digital component is a candidate for selection includes: cooperating with each of the one or more second servers to determine the first secret share of the candidate parameter of the particular digital component based on a secret share of one or more conditions of the particular digital component.

13. The system according to claim 9, wherein, For each digital component in the set of digital components, the selection value for identifying the digital component includes: For a given content platform, identify an enhancement established by the publisher of the electronic resource or the publisher's content platform, wherein a request for the digital component of the electronic resource is received; and The enhancement is used to adjust the selection value of each digital component of the content platform.

14. The system according to claim 9, wherein, The operation includes: Identify the lower limit of the selection value established by the publisher of the electronic resource, and receive a request for the digital component of the electronic resource; and Filter from the set of digital components one or more digital components that have a selection value less than the lower limit of the selection value.

15. The system according to claim 9, wherein, Determining the secret share of the winner parameter for each digital component in the priority hierarchy includes: The digital components in the priority hierarchy are sorted based on the selection value of each digital component in the priority hierarchy; A first secret share of the accumulated value of each digital component in the priority hierarchy is determined at least based on the first secret share of the candidate parameters of each digital component in the ranking and the priority hierarchy, wherein the accumulated value of the digital component indicates the number of candidate digital components in the priority hierarchy that have a higher selection value than the digital component; and For each digital component in the priority hierarchy, the first secret share of the winner parameter of the digital component is determined based on the first secret share of the candidate parameter of the digital component, each of the one or more second secret shares of the candidate parameter of the digital component, and the accumulated value of the digital component.

16. The system according to claim 15, wherein, The operation includes determining a second selection value corresponding to the second value selection process, including: For each priority level, determine a first secret share of the winning level parameter that indicates whether the given digital component is included in the priority level; For each digital component in the set of digital components, a first secret share of a second selection value parameter is determined, the second selection value parameter indicating whether the selection value of the digital component is likely to be the second highest selection value in the set of candidate digital components; and The selection value of a digital component is identified as the second selection value, wherein, for the digital component: (i) the candidate parameter of the digital component indicates that the digital component is a candidate for selection, (ii) the winning tier parameter indicates that the given digital component is included in the winning tier, and (iii) the second selection value parameter indicates that the selection value of the digital component may be the second highest selection value in the set of candidate digital components.

17. A non-transitory computer-readable storage medium carrying instructions that, when executed by one or more processors of a first server, cause the one or more processors to perform operations, the operations including: The first server of the secure multi-party computation system receives digital component requests from the client device; For each digital component in the set of digital components, identify the selection value of the digital component and the priority level of the digital component; For each of the multiple priority levels: The secure multi-party computation process, in cooperation with one or more second servers of the secure multi-party computation system, is used to determine the first secret share of the winner parameter for each digital component in the priority hierarchy, including: For each digital component in the priority hierarchy, determine a first secret share of the candidate parameter indicating whether the digital component is a candidate for selection; and Based on (i) the first secret share of the value of the candidate parameter of each digital component in the priority hierarchy, (ii) one or more second secret shares of the candidate parameter of each digital component in the priority hierarchy, and the selection value of each digital component in the priority hierarchy, the secret share of the winner parameter of each digital component in the priority hierarchy is determined. Identify the highest level among the plurality of levels where a given number component has a winner parameter, the winner parameter indicating that the given number component is the winning number component at that level; and Provide the client device with a first secret share that identifies the selection result of the given digital component.

18. The non-transitory computer-readable storage medium according to claim 17, wherein, Determining the first secret share of the winner parameter for each digital component in the priority hierarchy by using the secure multi-party computation process in cooperation with one or more second servers of the secure multi-party computation system includes: determining the first secret share of the winner parameter for each digital component in each priority hierarchy in parallel.

19. The non-transitory computer-readable storage medium according to claim 17, wherein, Determining the first secret share of the winner parameter for each digital component in the priority hierarchy by using the secure multi-party computation process in cooperation with one or more second servers of the secure multi-party computation system includes: determining the first secret share of the winner parameter for each digital component in each priority hierarchy in a sequence from the highest priority hierarchy to the lowest priority hierarchy.

20. The non-transitory computer-readable storage medium according to claim 17, wherein, For each digital component in the priority hierarchy, determining a first secret share of a candidate parameter indicating whether the digital component is a candidate for selection includes: cooperating with each of the one or more second servers to determine the first secret share of the candidate parameter of the particular digital component based on a secret share of one or more conditions of the particular digital component.

Images