Cryptographic security controls using secure multi-party computation

Abstract

This document describes systems and techniques for using secure multi-party computation (MPC) to select digital components in a secure manner that protects user privacy and the data of each party involved in the selection process. In one aspect, a method includes obtaining, by a first computer of a secure multi-party computation (MPC) system, at least a first share of a set of contextual attributes of the environment in which the selected digital component will be displayed at a client device. For each digital component in the set of digital components, at least a first share of a qualification expression defining the relationships between a set of qualification criteria for that digital component is obtained. Based on the at least first share of the set of contextual attributes and the at least first share of the qualification expression, a first share of qualification parameters is determined.

Description

Technical Field

[0001] This manual covers cryptography and data security. Background Technology

[0002] Secure multi-party computation (MPC) is a set of cryptographic protocols that distribute computation across multiple parties, preventing any single party from accessing another party's data or intermediate computational values. Furthermore, outputs are only distributed to designated parties to prevent data access. MPC computation systems typically use secret shares or other forms of data encryption, along with secure information exchange between the parties, to perform computations. Summary of the Invention

[0003] In general, an innovative aspect of the subject matter described in this specification can be embodied in a method comprising: obtaining, by a first computer of a secure multi-party computation (MPC) system comprising a plurality of computers, at least a first share of a set of context attributes of an environment in which a selected digital component will be displayed at a client device; for each digital component in the set of digital components: obtaining at least a first share of a qualification expression defining a relationship between a set of qualification criteria for the digital component; and determining, based on the at least first share of the set of context attributes and the at least first share of the qualification expression, at least a first share of a qualification parameter indicating whether the digital component is qualified to be displayed at the client device; performing a secure MPC process, in cooperation with one or more second computers of the secure MPC system, a secure MPC process to select a given digital component as the selected digital component from a set of qualified digital components, the set of qualified digital components comprising each digital component having a qualification parameter indicating that the digital component is qualified to be selected; generating a first share of a selection result identifying the selected digital component as a result of the secure MPC process; and sending the first share of the selection result to the client device by the first computer. Other embodiments of this aspect include corresponding apparatus, systems, and computer programs coded on computer storage devices and configured to perform aspects of the method.

[0004] These and other implementations may each optionally include one or more of the following features. In some aspects, obtaining at least a first share of the context attribute set includes receiving a first secret share of the context attribute set from a client device or content platform.

[0005] In some respects, at least a first share of the context attribute set includes all context attributes in the context attribute set; at least a first share of the eligibility expression includes the entire eligibility expression; and at least a first share of determining whether a numeric component is eligible for selection includes evaluating the eligibility expression based on the context attribute set in a sandbox environment isolated from other code execution.

[0006] In some aspects, determining at least a first share of the eligibility parameter indicating whether a digital component is eligible for selection, based on at least a first share of the set of context attributes and at least a first share of the eligibility expression, includes performing a second secure MPC process in collaboration with one or more second computers to determine a first secret share of the eligibility parameter.

[0007] In some aspects, at least a first share of the eligibility criteria set for a particular digital component includes a first secret share of the attribute vector of the particular digital component; the set of context attributes includes a vector of context attributes; the eligibility expression for the particular digital component includes a set intersection check; and determining at least a first share of the eligibility parameters for the particular digital component includes using a second secure MPC process in cooperation with one or more second computers of a secure MPC system to determine that there is an intersection between at least one element of the attribute vector of the particular digital component and at least one element of the vector of context attributes.

[0008] In some respects, the eligibility expression defines a block list of attribute vectors of a particular digital component, in which the particular digital component is not eligible for selection when one or more elements of the attribute vector of the particular digital component match one or more corresponding elements of the context attribute vector, and determining at least a first share of the eligibility parameter of the particular digital component includes: in response to determining that there is an intersection between at least one element of the attribute vector of the particular digital component and at least one element of the vector of the context attribute, setting the value of at least a first share of the eligibility parameter to indicate that the particular digital component is not eligible for selection for display at the client device.

[0009] In some respects, the eligibility expression defines an attribute vector of a particular digital component as an enable list, in which the particular digital component is eligible for selection when one or more elements of the attribute vector of the particular digital component match one or more corresponding elements of the vector of the context attributes, and determining at least a first share of the eligibility parameter of the particular digital component includes: in response to determining that there is an intersection between at least one element of the attribute vector of the particular digital component and at least one element of the vector of the context attributes, setting the value of at least a first share of the eligibility parameter to indicate that the particular digital component is eligible for selection for display at the client device.

[0010] In some aspects, at least a first share of the eligibility criteria set for a particular digital component includes a first secret share of a first Bloom filter containing attributes of the particular digital component; the set of context attributes includes a second Bloom filter containing context attributes; the eligibility expression for the particular digital component includes a set intersection check; and determining at least a first share of the eligibility parameters for the particular digital component includes using a second secure MPC process in cooperation with one or more second computers of a secure MPC system to determine whether there is an intersection between at least one element of the first Bloom filter and at least one element of the second Bloom filter.

[0011] In some aspects, the eligibility expression for a particular digital component includes a comparison between a given property of the digital component and a corresponding property of the set of contextual properties. In other aspects, the eligibility expression for a particular digital component includes an equality test between a given property of the digital component and a corresponding property of the set of contextual properties.

[0012] In some aspects, the eligibility expression for a particular numeric component includes a truth table that defines when a particular numeric component is eligible for selection. In other aspects, the eligibility expression includes a Boolean expression comprising two or more subexpressions and a Boolean operator for each pair of subexpressions. The two or more subexpressions may include two or more of the following: (i) a set intersection check, (ii) an equality test, and (iii) a comparison test.

[0013] In some respects, the set of contextual attributes includes at least one of the following: (i) data about the resources that the selected digital component will be displayed with, (ii) data about the user of the client device, (iii) data about the application that will display the digital component, or (iv) data about the client device.

[0014] The subject matter described in this specification can be implemented in specific embodiments to achieve one or more of the following advantages. A secure MPC process, performed by two or more computers of a secure MPC system operated by different parties, selects digital components based on shares of user information, ensuring that user information cannot be accessed in plaintext by any MPC computer or the other party in the absence of unauthorized collusion between the MPC computers. Thus, user data privacy is protected as long as at least one MPC server is honest. The secure MPC process can also use shares of information received from the content platform in the selection of digital components to preserve the confidentiality of the content platform's information, ensuring that this information cannot be accessed by any MPC computer or another entity that obtains a share of the information in any way.

[0015] During the digital component selection process, the MPC server can choose from qualified digital components that meet one or more eligibility criteria, while preventing parties from accessing user information in plaintext. Eligibility criteria may include restrictions and guidelines on the manner or frequency of digital component distribution, as well as other factors. These criteria may include user group membership, frequency control, muting (e.g., user blocking), k-anonymity to prevent micro-targeting of users, and / or pacing and budget constraints.

[0016] Another example of eligibility criteria involves the context in which the digital component will be presented, such as the resources with which the digital component will be displayed, the geographic location of the client device displaying the digital component, and the spoken language settings of the application (e.g., a browser) displaying the digital component. Digital component providers can also specify the contexts in which their digital components can and / or cannot be displayed. Similarly, resource publishers can specify the characteristics of digital components that can or cannot be displayed with their resources. Instead of using cached lookup keywords that consider all possible combinations of attributes that can be used to identify a digital component eligible for display opportunities in each digital component with its associated context, criteria for the digital component can be defined using expressions that can be evaluated by the MPC computer, for example, in a secret share using a secure MPC process. This reduces the amount of data stored by the MPC computer compared to using large cached lookup keywords. This also increases the flexibility of publishers and digital component providers in controlling the display of digital components without increasing the data storage requirements of the MPC computer, allowing the MPC computer to store more digital components, digital component information, and / or other relevant information in high-speed memory, such as in a cache.

[0017] Since the selection of digital components is an online process that typically occurs while content is being loaded on the client device, it is important to complete this process quickly (e.g., within milliseconds). The techniques described in this document improve the speed of digital component selection by reducing the amount of data transferred between the client device and the MPC cluster, by reducing the computing resources required by the MPC cluster, and by reducing the number of round-trip communications performed by the servers of the MPC cluster and the amount of data transferred between servers. For example, if the client device is a battery-powered mobile device, the reduction in the amount of data between the client device and the server also reduces network bandwidth consumption and the client device's battery consumption.

[0018] MPC clusters can transmit secret shares of the results that identify the selected digital components chosen by the MPC cluster using a secure MPC process. By sending only secret shares of the results for the selected digital components, rather than sending information about all digital components or a large set of digital components, latency in transmitting and receiving results is similarly reduced, along with the bandwidth, processing power, and battery power consumed. This also reduces the potential leakage of confidential information from the content platform that submits the selection values ​​of digital components to the MPC cluster by limiting the number of digital components that provide their information to client devices.

[0019] Reducing the latency of content presentation also reduces the number of errors that occur on user devices while waiting for such content to arrive. Since content typically needs to be delivered to wirelessly connected mobile devices within milliseconds, minimizing latency in content selection and delivery is crucial in preventing errors and reducing user frustration.

[0020] Details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the following description. Other features, aspects, and advantages of this subject matter will become apparent from the specification, drawings, and claims. Attached Figure Description

[0021] Figure 1 This is a block diagram of the environment in which the MPC cluster performs a secure MPC process to select digital components for distribution to client devices.

[0022] Figure 2 It shows Figure 1 Example data stream within the environment.

[0023] Figure 3 This is a diagram illustrating an example process for selecting digital components to be distributed to client devices.

[0024] Figure 4 This is a diagram illustrating an example process for selecting digital components to be distributed to client devices.

[0025] Figure 5 This is a diagram illustrating an example process for determining whether a digital component is eligible for selection.

[0026] Figure 6 This is a diagram illustrating an example process for selecting digital components to be distributed to client devices.

[0027] Figure 7 This is a block diagram of an example computer system.

[0028] The same reference numerals and markings in different figures indicate the same elements. Detailed Implementation

[0029] In summary, this document describes systems and techniques for selecting digital components in a manner that utilizes cryptography, secret sharing, and secure MPC to protect user privacy and securely safeguard the data of each party involved in the selection process. The techniques described in this document allow for such privacy and data security while still providing digital components within a short timeframe (e.g., within milliseconds) after a request is received, and simultaneously minimizing the size of both the data sent to and from the client devices displaying the digital components. These techniques also provide flexibility and security for the rules and other data specified by the content platform and / or digital component provider for controlling the environment in which the digital components are displayed, as well as the rules and other data associated with the digital components displayed alongside specific electronic resources (e.g., web pages and / or native app content).

[0030] Figure 1 This is a block diagram of an environment 100 in which MPC cluster 130 performs a secure MPC process to select digital components for distribution to client device 110. Example environment 100 includes a data communication network 105, such as a local area network (LAN), wide area network (WAN), Internet, mobile network, or a combination thereof. Network 105 connects client device 110, secure MPC cluster 130, publisher 140, website 142, content platforms such as provider-side platform (SSP) 170, and demand-side platform (DSP) (150). Example environment 100 may include many different client devices 110, secure MPC cluster 130, publisher 140, website 142, DSP 150, and SSP 170.

[0031] Website 142 includes one or more electronic resources 145. Resources 145 may be associated with a domain name, a domain-unique resource identifier (such as a path), and are hosted by one or more servers. An example website is a collection of web pages formatted in Hypertext Markup Language (HTML), which may contain text, images, multimedia content, and programming elements such as scripts. Each website 142 is maintained by a content publisher 140, which is the entity that controls, manages, and / or owns the website 142.

[0032] Resource 145 is any data that can be provided by publisher 140 via network 105 and can be associated with a resource address. Resources include HTML pages, word processing documents and portable document format (PDF) documents, images, videos, and feed sources, to name a few. Resource 145 may include content such as words, phrases, images, etc., and may include embedded information (such as meta-information and hyperlinks) and / or embedded instructions, such as scripts.

[0033] Client device 110 is an electronic device capable of communicating via network 105. Example client device 110 includes a personal computer, a mobile communication device such as a smartphone, and other devices that can send and receive data via network 105. Client device 110 may also include a digital assistant device that accepts audio input via a microphone and outputs audio via a speaker. When the digital assistant detects a “hot word” or “hot phrase” that activates the microphone to accept audio input, the digital assistant can be put into listening mode (e.g., ready to accept audio input). The digital assistant device may also include a camera and / or display to capture images and visually present information. The digital assistant may be implemented in various forms of hardware devices, including wearable devices (e.g., watches or glasses), smartphones, speaker devices, tablet devices, or other hardware devices. Client device 110 may also include a digital media device, such as a streaming device that plugs into a television or other display to stream video to a television, gaming system, or virtual reality system.

[0034] Client device 110 typically includes applications 112, such as web browsers and / or native applications, to facilitate sending and receiving data over network 105. Native applications are applications developed for a specific platform or device, such as applications developed for mobile devices with a specific operating system. Publisher 140 may develop and provide (e.g., make available for download) native applications to client device 110. For example, in response to a user of client device 110 entering the resource address of resource 145 in the address bar of a web browser or selecting a link referencing the resource address, the web browser can request resource 145 from the web server of website 142 hosting publisher 140. Similarly, native applications can request application content from a publisher's remote server.

[0035] Some resources, application pages, or other application content may include digital component slots for displaying digital components along with resource 145 or application pages. As used throughout this document, the phrase "digital component" refers to a discrete unit of digital content or digital information (e.g., a video clip, audio clip, multimedia clip, image, text, or another unit of content). Digital components may be stored electronically on a physical storage device as a single file or in a collection of files, and may take the form of video files, audio files, multimedia files, image files, or text documents, and may include advertising information, making an advertisement a digital component. For example, a digital component may be content designed to complement web page content, application content (e.g., an application page), or other resources displayed by application 112. More specifically, digital components may include digital content related to resource content; for example, a digital component may relate to the same topic as or to a related topic as the web page content. Thus, the provision of digital components can complement and often enhance web page or application content.

[0036] When application 112 loads resources (or application content) that include one or more digital component slots, application 112 may request digital components for each slot. In some implementations, the digital component slots may include code, such as one or more scripts, that, when processed by application 112, causes application 112 to request digital components to display to the user of client device 110. As described below, application 112 may request digital components from MPC cluster 130 and / or one or more SSPs 170.

[0037] Some publishers 140 use SSP 170 to manage the process of acquiring digital components for their resource 145 and / or application 112 digital component slots. SSP 170 is a technology platform implemented in hardware and / or software that automates the process of acquiring digital components for resources and / or applications. Each publisher 140 may have a corresponding SSP 170 or multiple SSPs 170. Some publishers 140 may use the same SSP 170.

[0038] Digital component provider 160 may create (or otherwise publish) digital components that are displayed in the digital component slots of publisher's resources 145 and application 112. For example, digital component provider 160 may create digital components that include content related to digital component provider 160. In a particular example, a product manufacturer's digital components may include product-related content.

[0039] Digital component provider 160 may use DSP 150 to manage the supply of its digital components for display in digital component slots. DSP 150 is a hardware and / or software-implemented technology platform that automates the process of distributing digital components for display with resources and / or applications. DSP 150 may interact on behalf of digital component provider 160 with multiple SSPs 170 to provide digital components for display with resources 145 and / or applications 112 from multiple different publishers 140. In general, DSP 150 may receive requests for digital components (e.g., from SSP 170), generate (or select) selection values ​​for one or more digital components created by one or more digital component providers 160 based on those requests, and provide SSP 170 with data associated with the digital components (e.g., the digital component itself, or authoring elements including code that enables the digital component to be downloaded) and the selection values. The selection values ​​may be the amount that digital component provider 160 is willing to provide for the display or user interaction of the digital component. SSP 170 can then select a digital component to be displayed at client device 110 and provide client device 110 with data that enables client device 110 to display the digital component, for example, by providing the digital component or enabling the download of the digital component. As described in more detail below, MPC cluster 130 can select a digital component that client device 110 displays in a manner that protects user privacy.

[0040] In some cases, receiving digital components related to web pages, application pages, or other electronic resources that a user has previously accessed and / or interacted with is beneficial to the user. To distribute such digital components to users, users can be assigned to user groups, such as user interest groups, groups of similar users (e.g., those who have performed similar actions or accessed similar electronic resources, or other group types involving similar user data). For example, a user can be added to a user group when they access a specific resource or perform a specific action at that resource (e.g., interacting with a specific item displayed on a web page or adding that item to a virtual shopping cart). User groups can be generated and updated by digital component providers 160. That is, each digital component provider 160 can assign users to their user groups when a user accesses an electronic resource provided by a digital component provider 160. User groups can also be created and / or updated by content platforms (e.g., by DSP 150 and / or SSP 170).

[0041] To protect user privacy, user group memberships may be maintained at the user's client device 110, for example, by one of the applications 112, the operating system of the client device 110, or another trusted program, rather than by the digital component provider, content platform, or other party. In a specific example, the trusted program (e.g., a web browser or operating system) may maintain a list of user group identifiers (“user group list”) for users using a web browser or another application (e.g., for users logged into a browser, application, or client device 110). The user group list may include a user group identifier for each user group that includes the user as a member. The digital component provider 160 or content platform that creates the user groups may assign user group identifiers to their user groups. The user group identifier may describe the group (e.g., a gardening group) or represent the group using a code (e.g., a non-descriptive alphanumeric sequence). The user group list may be stored in secure storage at the client device 110 and / or may be encrypted at storage to prevent access to the list by others.

[0042] When application 112 displays a resource (e.g., a web page), application content, or digital component related to digital component provider 160, the resource, application content, or digital component may request application 112 to add one or more user group identifiers to a user group list. In response, application 112 may add one or more user group identifiers to the user group list and securely store the user group list. For example, a user choosing to view a web page with more information about a specific item may add the user to a user group associated with that specific item.

[0043] In some implementations, MPC cluster 130 may use a user's user group membership to select digital components that the user may be interested in or that may otherwise benefit the user / user device. For example, such digital components or other content may include data that improves user experience, improves the operation of the user device, or otherwise benefits the user or client device 110. However, user group identifiers from the user's user group list may be provided and used to prevent the computing systems MPC1 and MPC2 of MPC cluster 130 from accessing the user's user group identifiers in plaintext when selecting digital components, thereby protecting user privacy when using user group membership data to select digital components. MPC cluster 130 may also use other conditions to select digital components, as described in more detail below. Plaintext is text that is not computationally marked, specially formatted, or written in code or data (including binary files) in a form that can be viewed or used without the need for keys or other decryption devices or other decryption processes.

[0044] Example secure MPC cluster 130 includes two computing systems, MPC1 and MPC2, which perform secure MPC processes to select digital components for distribution to a user's client device, for example, based on the user's group membership and / or context data (e.g., context attributes of the environment in which the selected digital component will be displayed), but without accessing group membership, context data, or other user information, or signals derived from such user information, in plaintext. Although example MPC cluster 130 includes two computing systems, more computing systems can be used, as long as MPC cluster 130 includes more than one computing system. For example, MPC cluster 130 may include three computing systems, four computing systems, or other suitable number of computing systems. Using more computing systems in MPC cluster 130 can provide greater security, but it also increases the complexity of the MPC process. Each computing system, MPC1 and MPC2, can be a server or other suitable type of computer.

[0045] Computing systems MPC1 and MPC2 can be operated by different entities. In this way, each entity may not be able to access a user's group membership, other user information, or signals derived from such user information in plaintext. For example, one of the computing systems MPC1 or MPC2 can be operated by a trusted party different from the user, publisher 140, DSP 150, SSP 170, and digital component provider 160. For example, an industry group, government group, or browser developer could maintain and operate one of the computing systems MPC1 and MPC2. Other computing systems can be operated by different ones from these groups, such that different trusted parties operate each computing system MPC1 and MPC2. Advantageously, different parties operating different computing systems MPC1 and MPC2 may have no incentive to collude to compromise user privacy. In some implementations, computing systems MPC1 and MPC2 are architecturally separate and monitored to not communicate with each other except for performing the secure MPC processes described in this document.

[0046] Each computing system MPC1 and MPC2 can store digital components (e.g., the idea of ​​a digital component), selection values ​​for digital components, and other information about the digital components. For example, computing systems MPC1 and MPC2 can cache selection values ​​previously received from SSP 170 and / or DSP 150 or otherwise provided to computing systems MPC1 and MPC2 as part of a previous digital component selection process (e.g., pre-provided for use in the digital component selection process). In this way, MPC cluster 130 can use the selection values ​​to select digital components for distribution to client device 110 in response to future digital component requests received from client device 110.

[0047] The MPC cluster 130 stores the selection values ​​and other information of the digital component selection process. The digital component may be referred to as the stored digital component in this document. However, the digital component itself is not necessarily stored by the MPC cluster 130. Instead, the MPC cluster 130 may store data for each stored digital component, such as code referencing the network location from which the digital component can be downloaded. In some implementations, the MPC cluster 130 stores the digital component itself and returns it directly to the application 112. This implementation reduces the need for the application 112 to retrieve the digital component and / or other information about the digital component in additional requests, which could consume device battery and bandwidth and potentially leak additional signals to the server hosting the digital component itself for tracking the device.

[0048] For each stored digital component, each computing system MPC1 and MPC2 may store a selection value or a vector of values ​​that computing systems MPC1 and MPC2 can use to determine the selection value of the digital component. The selection value of the digital component may be based on the context in which the digital component will be displayed. For example, digital component provider 160 may be willing to give a higher selection value to a digital component that it wants to display on a resource related to a specific topic (e.g., a travel-related webpage) than to other topics, for example, if the digital component is related to a specific topic. As another example, digital component provider 160 may be willing to give a higher selection value to a digital component that it wants to display to a user with certain characteristics, interests, intentions, previous interactions with the digital component, etc. Therefore, DSP 150 may provide computing systems MPC1 and MPC2 with multiple selection values ​​(or multiple vectors of selection values) for a given digital component, where each selection value or vector is used for a different combination of context and user attributes.

[0049] Each selected value or vector and its corresponding numeric component can be referred to as a numeric component selection item. A numeric component selection item may include the numeric component itself, the selected value or vector, information about the numeric component (e.g., metadata of the numeric component), qualification expressions that define the relationships between sets of qualification criteria, and / or conditional data.

[0050] A qualification expression is used to determine whether a digital component option is eligible for distribution to client device 110 based on a scenario in which the digital component will be displayed at client device 110. Qualification criteria are the standards for the qualification expression. The qualification expression can be in the form of a Boolean expression, including multiple subexpressions and Boolean operators between them. An example of a qualification expression could be: URL = example.com AND location = United States. DSP 150 can provide the qualification expression for the digital component and the corresponding selection value (or data that can be used to determine the selection value, such as one or more vectors) to computing systems MPC1 and MPC, for example, as part of the digital component option. Example qualification expressions, qualification criteria, and techniques for evaluating qualification expressions are described below.

[0051] The condition data for digital component selection items defines the conditions that a digital component selection item (and therefore the digital component and selection value of the selection item) must meet to become a candidate for a given digital component selection process. Stored digital components may have zero or more corresponding conditions. In some implementations, in order to become a candidate for selection, a digital component selection item must be eligible based on the digital component's eligibility criteria, and must satisfy each condition of the digital component selection item.

[0052] One example condition is that the user to whom the selected digital component is provided is a member of the user group corresponding to the stored digital component. This condition can be referred to as the user group membership condition. In this example, computing systems MPC1 and MPC2 can store a set of one or more user group identifiers corresponding to a digital component selection item (e.g., as part of the selection item). These user group identifiers identify the user group to which the stored digital component can be provided. That is, the digital component selection item is merely a candidate for a digital component selection process performed to select a digital component to provide to a user who is a member of at least one user group identified by the set of one or more user group identifiers of the digital component selection item.

[0053] Another example condition for stored digital components is a frequency cap condition, which indicates the maximum number of times a digital component or a specific category of digital components can be offered to the same user within a given duration. Another example condition for digital components is a blocked digital component condition, which indicates that a digital component has been blocked by the user, such as being muted. For these example conditions, computing systems MPC1 and MPC2 can receive and store probabilistic data structures, such as cuckoo filters or Bloom filters, for each of multiple users, representing digital components that cannot be offered to the user. For example, the probabilistic data structure could represent a generic identifier for digital components that are directly blocked by the user or blocked because the frequency at which the digital component is displayed to the user within a given duration has been exceeded.

[0054] Computing systems MPC1 and MPC2 can receive probabilistic data structures from the user's client device 110, for example, in an encrypted form to prevent MPC1 or MPC2 from accessing the identifiers in plaintext. For instance, application 112 running on the user's client device 110 can generate a Bloom filter representing the identifiers of blocked digital components, either due to frequency limits or by the user. Application 112 can then provide data to each of the computing systems MPC1 and MPC2, enabling them to collaboratively query the Bloom filter using a secure MPC procedure to determine whether a given digital component is blocked for the user. The computing systems MPC1 and MPC2 use this secure MPC procedure to calculate a secret share of the blocked digital component condition.

[0055] In some implementations, the identifier of the blocked digital component can be included in the same probabilistic data structure as the user group identifier and queried using the same or a different set of hash functions. However, the target false positive rate of the blocked digital component may be lower than that of the user group identifier. Therefore, fewer hash functions can be used to generate and query the Bloom filter for the blocked digital component compared to the user group identifier. To reduce the data size of the Bloom filter for the blocked digital component, the user group identifier can be represented by a different Bloom filter than the blocked digital component. This reduces the latency of sending the Bloom filter over the network, reduces the bandwidth consumed by sending the Bloom filter, and reduces the battery power used by sending the Bloom filter.

[0056] Another example of a stored condition for a digital component is a pacing condition for pacing the distribution of the digital component over a certain period of time. Computing systems MPC1 and MPC2 may store data indicating the total number of times a digital component can be provided over a certain period of time and / or the maximum budget for a digital component for that period. Computing systems MPC1 and MPC2 can use this information to pac the frequency at which a digital component can become a candidate in the digital component selection process based on this condition (e.g., all the conditions that a digital component must meet to be a candidate). In some embodiments, computing systems MPC1 and MPC2 may implement a feedback controller, such as a proportional-integral-derivative (PID) controller, which uses a secret share to pac the stored digital components with pacing conditions.

[0057] In this example, computing systems MPC1 and MPC2 can store the setpoint of the PID controller used for the digital component and maintain the measured variables of the PID controller used for the digital component. In general, a PID controller is a feedback controller that uses an error value (which is the difference between the target setpoint and the measured variable) to determine the output that drives the measured variable toward the setpoint. In a scenario where the distribution of the digital component to the client device is calibrated, the active setpoint can be an impression rate, interaction rate, conversion rate, and / or resource depletion rate (e.g., budget expenditure rate). Similarly, the measured variable can be an impression rate, interaction rate, conversion rate, and / or resource depletion rate over a given duration. Computing systems MPC1 and MPC2 can also store the tuning parameters of each PID controller. Depending on the target privacy / data security, the setpoint, measured variable, and tuning parameters can be stored in secret shares (where each computing system MPC1 and MPC2 stores a corresponding share for each parameter) or in plaintext.

[0058] Another example condition is the k-anonymity condition. A k-anonymity condition can include a k-anonymity rule that requires a digital component to be eligible (or to be selected) for distribution to at least k users within a given duration. The concept of k-anonymity ensures that data for a particular user cannot be distinguished from data for other users of a threshold number k. The system can enforce the k-anonymity rule, for example, by ensuring that, in response to a request for one or more digital components, a particular digital component is distributed to client device 110, and that the same digital component may have been displayed to or displayed to a set of at least k users or displayed by at least k applications 112 within a specific time period. In some implementations, each of the k applications 112 to which the digital component may have been distributed must be used for a different user. In this example, computing systems MPC1 and MPC2 can store the value k for the digital component and maintain the number of users to whom the digital component may have been distributed.

[0059] Determining the number of users to whom a digital component may have been displayed can include performing a counterfactual digital component selection process in parallel with each actual digital component selection process. In this counterfactual digital component selection process, all digital components can be candidates if they satisfy all conditions except the k-anonymity condition. If a digital component is selected for at least k users or application 112 in the counterfactual digital component selection process, that digital component will have already been displayed to k users if it is not subject to the k-anonymity condition. Once this occurs, digital components satisfying the k-anonymity condition can be included in the actual digital component selection process (assuming other conditions for the digital component, if any, are satisfied), excluding digital components that do not satisfy the k-anonymity condition.

[0060] In some implementations, each digital component selection is stored as a digital component information element (dc_information_element), which can be a byte array containing the selection value of the digital component and other information (e.g., including the idea itself). The byte array can have a specific format that can be parsed by the application 112 or trusted program of client device 110 and computing systems MPC1 and MPC2 to obtain the selection value and metadata. In some implementations, the digital component information element may include the digital component itself.

[0061] In addition to the descriptions throughout this document, controls (e.g., user interface elements that users can interact with) may be provided to users that allow them to choose whether and when the systems, programs, or features described herein can enable the collection of user information (e.g., information about the user's social networks, social actions or activities, occupation, user preferences, or the user's current location), and whether to send content or communications to the user from a server. Furthermore, certain data may be processed in one or more ways before being stored or used, such that personally identifiable information is removed. For example, a user's identity may be processed so that personally identifiable information about the user cannot be determined, or, if location information is available, the user's geographic location may be generalized (e.g., down to the city, zip code, or state level), making it impossible to determine the user's specific location. Therefore, users can control what information about themselves is collected, how that information is used, and what information is provided to them.

[0062] In this document, some computations performed by the MPC cluster on secret shares are shown as the product or sum of secret share values. To improve the speed of performing these computations, multiplication can be performed on secret shares using AND operations (e.g., bit-by-bit AND), and addition can be performed on secret shares using XOR operations (e.g., bit-by-bit XOR). In some cases, when a plaintext integer is multiplied by a secret share in Z2 that represents zero or one (i.e., the sum of the two shares modulo 2 is zero or one), multiplication or bit-by-bit AND is not required. Instead, each computation system can evaluate its share and return an integer if its share is one and zero if its share is zero.

[0063] Figure 2 It shows Figure 1Example data stream 200 within environment 100. This description includes two types of selection values: selection values, or "conditional selection values," conditioned on sensitive user information (such as user group membership or other commercially sensitive information) or parameters whose changes in their values ​​could allow unethical parties to infer sensitive information; and selection values, or "unconditional selection values," not conditioned on sensitive information. To protect user privacy, the conditions of "conditional selection values" are evaluated within MPC cluster 130, rather than within SSP 170 or DSP 150, to determine whether a "conditional selection value" is a candidate for the digital component selection process.

[0064] This architecture allows MPC cluster 130 to protect user privacy and trade secrets, and to prove its trustworthiness to application providers such as application 112. In this example, MPC cluster 130 relies on a secure two-party computation (2PC) architecture that applies cryptographic techniques to ensure that there is no leakage of confidential user data or trade secrets if at least one of the two computing systems in MPC cluster 130 is honest. If MPC cluster 130 includes more than two computing systems, the current MPC protocol can be extended, or other MPC protocols can be used.

[0065] The MPC cluster 130 runs a secure 2PC protocol to evaluate and apply conditions to assess the eligibility of candidate digital components, conduct a selection process to choose digital components based on selection values, and receive impressions and user interaction (e.g., digital component selection) notifications to update the parameters upon which those conditions depend. All of these processes can be accomplished using secure 2PC and secret-sharing techniques. (Reference) Figures 3 to 6 Please describe the protocol in detail.

[0066] In phase A, application 112, for example, collaborates with a triggering element from a content platform such as SSP 170 to send a request for a digital component to MPC cluster 130. Application 112 may include multiple requests for digital components together in a combined request to acquire multiple digital components. MPC cluster 130 may then serve each request in the combined request independently or make one or more selection decisions as a whole. In this example, the request is for a single digital component and includes requests for digital components selected based on sensitive information or digital components selected without sensitive information. MPC cluster 130 may respond to the request by selecting a specific digital component corresponding to a specific selection value from a set of selection values, each selection value being mapped to a corresponding specific digital component. These selection values ​​may be selection values ​​previously cached or otherwise stored at MPC cluster 130 and / or selection values ​​generated by a platform such as DSP 150 or SSP 170, or just-in-time (JIT) selection values. JIT selection values ​​are generated directly in response to need and improve efficiency and reduce waste because selection values ​​are generated only when a digital component is needed. For example, a JIT selection value can be generated when a digital component slot becomes available (indicated by the receipt of a request for a digital component). Therefore, MPC cluster 130 can select digital components from a set of digital components, including stored digital components whose information is stored at MPC cluster 130 and digital components that have received their JIT selection values ​​for the current digital component request.

[0067] In some implementations, two or more vectors may be used to determine the selection value of a digital component. The MPC cluster 130 may store a first vector of values ​​that can be used to determine the selection value of the digital component. When a digital component is being selected, the first vector of values ​​can be used to determine the selection value of the digital component. Therefore, the first vector of values ​​may also be referred to as a digital component-based vector. A digital component-based vector may include multiple elements across two or more dimensions, and each element may represent a specific characteristic of the digital component's presentation opportunity. For example, a digital component-based value vector may include elements of the geographic location or region associated with the digital component, spoken language, age or age range associated with the digital component, a specific URL of a web page or other electronic resource, a specific product or service, whether the digital component will perform well when displayed on or below the first screen, the type of digital component, the size of the digital component, the best time of day for the digital component to be displayed, and / or other appropriate characteristics of the digital component. In some implementations, such as those employing neural networks, the digital component-based value vector may be an embedding of user groups and other user and / or digital component signals in some abstract vector space.

[0068] The value of each element can reflect the amount by which the selected value of the digital component is increased or decreased based on the characteristics corresponding to that element at the current digital component presentation opportunity. For example, if the DSP 150 wants to display the digital component to a user in Atlanta instead of a user in Dallas, the value of the element for Atlanta could be a positive value greater than one, while the value of the element for Dallas could be a positive value less than one, such as zero, or a negative value. As described in more detail below, the value of the vector based on the digital component can be part of a vector dot product calculation to determine the selected value of the digital component.

[0069] The request includes information used in the digital component selection process, including potentially sensitive information such as user group identifiers of user groups mapped or otherwise associated with application 112, and non-sensitive information such as contextual signals from application 112 regarding the context in which the digital component will be presented and / or displayed (e.g., contextual attributes of the environment in which the selected digital component will be displayed). As described further in detail below, system 110 is designed to improve the protection of potentially sensitive or confidential user data.

[0070] The trigger element can be, for example, a tag that detects the existence of a digital component slot within an internet location accessed by application 112. The trigger element can be placed, for example, at an internet location, and can notify application 112 of the existence of a digital component slot for which a digital component should be requested.

[0071] In Phase B, MPC cluster 130 transmits a digital component request based on non-sensitive information, such as context signals, to SSP 170. This request is referred to as a "context request." A context request may contain various context signals and non-sensitive user information collected directly by the internet location that triggered the request for the digital component (e.g., a content publisher). For example, context signals may include analytics data, language settings, and other data that helps the content publisher provide a good user experience. However, the context request provided to SSP 170 does not include sensitive information, such as user group identifiers.

[0072] In stage C, SSP 170 forwards the scene request to one or more DSPs 150. In this particular example, and for simplicity, SSP 170 forwards the scene request to a single DSP 150. For example, SSP 170 may forward the scene request to DSP 150. In this example, DSP 150 has digital components and selection values ​​mapped to the digital components, or the selection values ​​of the digital components may be determined using scene signals.

[0073] In phase D, one or more DSPs 150 return selection values ​​in response to a scenario request. For example, DSP 150 returns one or more selection values ​​mapped to digital components in response to a scenario request. DSP 150 may return selection values ​​in the form of digital component selection items, which include the selection value, additional information about the digital component, and the optional digital component itself, such as in the form of a creative. DSP 150 may return any number of selection values ​​in response to a scenario request.

[0074] In some implementations, DSP 150 may also return selection values ​​in response to a digital component request based on sensitive information, such as user group information. These selection values ​​are “conditional selection values” because they are conditional on sensitive information and therefore conditional on MPC cluster 130 receiving a request that includes sensitive information matching the sensitive information conditional on the selection value. For each selection value provided by DSP 150, DSP 150 may optionally include information such as a Time-to-Live (TTL) parameter, which is the maximum time span for which MPC cluster 130 can cache or otherwise store the selection value (e.g., store digital component selections). This TTL parameter enables MPC cluster 130 to cache selection values ​​received from DSP 150. In some implementations, without a TTL parameter, MPC cluster 130 does not cache received selection values ​​but instead discards them after they have already been used in a selection process (e.g., in a selection process corresponding to a digital component request transmitted in stages A, B, and C). If the digital component selection is stored by the MPC cluster 130, the MPC cluster 130 may include the digital component selection in the future digital component selection process for future digital component requests received from client devices.

[0075] DSP 150 may also provide, for example, eligibility expressions and their corresponding eligibility criteria as part of digital component selection options, as well as condition data defining any conditions that must be met for a digital component selection option to become a selection candidate. Depending on the target level of privacy protection and / or data security, this information may be provided in plaintext or in shares (e.g., secret shares). If secret shares are used, DSP 150 may provide SSP 170 with a first secret share of the eligibility expression, a first secret share of the eligibility criteria, and a first secret share of the condition data for each condition. DSP 150 may also provide SSP 170 with a second secret share of the eligibility expression, a second secret share of the eligibility criteria, and a second secret share of the condition data for each condition. SSP 170 may provide the first secret share to MPC1 and the second secret share to MPC2, such that neither MPC1 nor MPC2 can access any information in plaintext without unauthorized collusion.

[0076] When using a vector to determine the selection value, DSP 150 can generate and return a second vector value. DSP 150 can generate the second vector of values ​​based on the context signal requested by the digital component transmitted in stages B and C. The second vector can be referred to as the context vector. The context vector can include the same elements corresponding to the same characteristics as the digital component-based vector. However, DSP 150 can determine the value of the current digital component-requested context vector based on the context signal requested by the digital component. Instead, the value of the digital component-based vector of DSP 150 is stored in MPC cluster 130 and, for example, is determined in advance based on the user group corresponding to the digital component-based vector.

[0077] For each DSP 150 that provides a context vector, the MPC cluster 130 can determine the selection value for each stored digital component of the DSP 150 by determining the dot product of the digital component-based vector and the context vector provided by the DSP 150. If the DSP 150 has multiple digital component-based vectors stored by the MPC cluster 130, for example, each vector for a different digital component, then the MPC cluster 130 determines the dot product of the context vector and the digital component-based vector for each digital component-based vector.

[0078] In some implementations, a third vector can be used based on the user profile of the user who submitted the digital component request. This vector can have the same dimensions and characteristics as other vectors, but has values ​​based on the user's user profile.

[0079] For example, if the user is in Austin, the Austin position element in the user profile vector can have a positive value, or if the user is not in Austin, the Austin position element in the user profile vector can have a negative or zero value; if the publisher content currently displayed to the user is highly relevant to Austin, the same position element in the context vector can have a positive value; if the digital component is relevant to Austin, the same position element in the digital component-based vector is positive. To compute the dot product of the three vectors, computation systems MPC1 and MPC2 first perform element-wise multiplication between corresponding elements (one from each of the three vectors), and then add the results. For example, suppose the three vectors are V1 = {v...} 1,1 ...v 1,n}、V2={v 2，1 ...v 2，n} and V3={v 3，1 ...v 3，n}, then the dot product of the three vectors will be

[0080] In phase E, SSP 170 receives digital component selections from DSP 150 and provides them to MPC cluster 130. In some implementations, SSP 170 may process the digital component selections before sending them to MPC cluster 130.

[0081] For example, SSP 170 can apply selection value rules to determine, for example, how selection values ​​affect the post-publish value of a particular content provider. The post-publish value could indicate, for example, the number of digital components provided to publisher 140 for display alongside publisher 140's resources or application content. SSP 170 then performs a selection process to determine the top unconditional selection value, i.e., the unconditional selection value that produces the highest post-publish value. The unconditional selection value is not conditional on sensitive information and therefore can be used by SSP 170 (or DSP 150) instead of MPC cluster 130 to apply content selection rules, such as budget and pacing rules, advertiser and digital component exclusions. SSP 170 then forwards the following selection values ​​(which are JIT selection values) to MPC cluster 130: all selection values ​​that enable caching in MPC cluster 130 (selection values ​​with TTL values), and all selection values ​​whose post-publish value is not less than the top unconditional selection value.

[0082] In some implementations, DSP 150 and / or SSP 170 can infer attributes of the environment in which the selected digital component will be displayed. For example, DSP 150 and / or SSP 170 can infer the approximate location of the client device 110 where the digital component will be displayed, the subject of the resource that will be displayed with the digital component, the time and / or date on which the digital component will be displayed, etc. SSP 170 can provide the inferred attributes along with the digital component selection to MPC cluster 130. In some implementations, MPC cluster 130 can infer the approximate location of the client device 110 where the digital component will be displayed based on information not available at DSP 150 and SSP 170 (such as the client device IP address).

[0083] In phase F, MPC cluster 130 updates its cache with the received JIT selection values ​​that enable caching (i.e., have TTL values). Furthermore, MPC cluster 130 applies selection rules, such as user group membership rules, frequency control, pacing rules, and rules to prevent specific user microtargeting of all selection values ​​received in phase E and previously cached selection values, to select valid candidates for the selection process. These rules may include restrictions and guidelines on the manner or frequency of digital component distribution, as well as other factors. These rules include frequency control, muting, resource exhaustion, and pacing restrictions. In some implementations, JIT digital components with conditions evaluated by MPC cluster 130 may be ignored for the current digital component selection process. For example, ignoring these digital components for the current selection process may provide performance benefits, such as reducing latency in selecting and providing digital components. MPC cluster 130 then runs a final selection process among all eligible candidates, selects the winning digital component, and then, in response to a digital component request, returns the data of the selected digital component to application 112. (See reference...) Figures 3 to 6 The aforementioned method can utilize a secure MPC process that leverages secret shares to enforce rule application and digital component selection.

[0084] In phase G, the selected digital component is rendered by application 112. Application 112 then provides an impression notification to MPC cluster 130. This impression notification includes data that allows MPC cluster 130 to update information related to update parameters, which allow MPC cluster 130 to enforce selection rules on future digital component requests received, for example, in subsequent events of phase A. In some implementations, application 112 may provide an interaction notification to MPC cluster 130 when a user interacts with a digital component (such as clicking on a digital component). In some implementations, application 112 may send the impression or interaction notification G to MPC cluster 130 by carrying it on top of a future component request A, thereby reducing the amount of network communication and battery / bandwidth consumption of mobile devices, as well as the processing / computing costs of MPC cluster 130.

[0085] Figure 3This is a swimlane diagram of an example process 300 for selecting digital components to be distributed to client devices. The operation of process 300 can be implemented, for example, by client device 110, computing systems MPC1 and MPC2 of MPC cluster 130, and DSP 150. The operation of process 300 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 300. Although process 300 and other processes below are described with respect to two computing systems MPC cluster 130, MPC clusters with more than two computing systems can also be used to execute similar processes. Furthermore, the operation of process 300 can be implemented by SSP 170.

[0086] DSP 150 provides information (302) to digital components. This information may include selection values ​​for the digital components and additional information (e.g., qualification expressions, qualification criteria, and / or conditional data of conditions). In some implementations, DSP 150 is provided via SSP (for brevity, Figure 3 (Not shown) provides selection values ​​and additional information to MPC cluster 130. For example, DSP 150 may provide selection values ​​and additional information in response to a digital component request, and specify the digital component corresponding to the selection value as the digital component that should be stored at MPC cluster 130.

[0087] As described above, DSP 150 can provide MPC cluster 130 with one or more digital component selection options for one or more digital components. Each digital component selection option can have a corresponding digital component, a selection value, and the other information described above. To provide different selection values ​​for different scenarios, DSP 150 can provide multiple digital component selection options for the same digital component, wherein each digital component selection option can have a different qualification expression or different qualification criteria and different selection values. MPC cluster 130 can, for example, store digital component selection options for future digital component requests received from client device 110 in a high-speed memory such as a cache.

[0088] In some implementations, the DSP 150 can provide a value vector based on the digital component, instead of a static selection value for the digital component. In such an example, the value vector based on the digital component can be stored instead of the selection value.

[0089] Client device 110 receives content (304). For example, client device 110 may receive electronic resources (e.g., web pages) for display by a web browser or application content for display by a native application. The content may include one or more digital component slots, each containing computer-readable code, such as a script, which, when executed, causes client device 110 to request a digital component for each slot. Client device 110 may render the content on its display.

[0090] Client device 110 identifies a set of user group identifiers (306). This set of user group identifiers can be user group identifiers of user groups that include users of application 112 or client device 110 as members. For example, the set of user group identifiers can be user group identifiers in a user group list. Application 112, which renders content or is a trusted program, can identify the set of user group identifiers, for example, by accessing a user group list from the secure storage of client device 110.

[0091] Client device 110 generates a probabilistic data structure (308). To securely and efficiently generate digital component requests based on sensitive information, application 112 can use a probabilistic data structure, such as a cuckoo filter or a Bloom filter. In this example, the probabilistic data structure is a cuckoo filter. Generally, a cuckoo filter consists of an array of buckets, where each bucket can store b fingerprints. The fingerprint of an item is a bit string derived from the hash of that item. The cuckoo filter uses n hash functions, which allow items to be placed in any of b positions among n distinct buckets. Typically, a cuckoo filter is identified by the number of fingerprints in each bucket and the number of buckets. For example, a (2, 4) cuckoo filter has 2 buckets, and each bucket in the cuckoo array can store up to 4 fingerprints. Therefore, the total capacity of the cuckoo filter is 2 × 4 or 8 fingerprints.

[0092] Depending on the configuration of the cuckoo filter, an item can be inserted into one of N possible positions of the cuckoo filter, for example, N=2. Application 112 uses N pseudo-random functions (PRFs) to determine all possible positions of the item to be inserted. These functions are parameterized by a user group identifier or an identifier from a set of blocked identifiers, and either one of two random variables generated by application 112. For example, suppose the two random variables generated by application 112 are rand_var1a and rand_var1b. In some implementations, application 112 and MPC cluster 130 pre-agree on the PRF, where PRF(x, y) ∈ [0, 2]. k -1], where k is the number of bits for each item in the bucket of the cuckoo filter.

[0093] Each position in the cuckoo filter can be occupied by a user group identifier or a blocked identifier, or it can be empty. A blocked identifier is an identifier used by application 112, for example, to block digital components based on frequency control, or an identifier for a user group's digital components that the user has chosen to block. Application 112 can generate a cuckoo filter table whose elements are PRF(ug_id, rand_var1a), PRF(blocked_uid, rand_var1b), and 0, where ug_id is the user group identifier generated by applying HMAC to the user group's tag based on the content provider's domain, blocked_uid is the identifier from the set of blocked identifiers, and 0 indicates an empty entry. This process is repeated for all user group identifiers. In some implementations, the same probabilistic data structure, such as a cuckoo filter or a Bloom filter, can store both user group identifiers and blocked identifiers. In other implementations, user group identifiers and blocked identifiers are stored in a dedicated probabilistic data structure.

[0094] Application 112 can generate vector B based on a cuckoo filter table generated for user group identifiers and / or blocked identifiers. Each value in vector B is Bcuckoo. i It can be represented as B i =(A i -PRF(rand_var2,i) mod p, where A is the cuckoo filter table, and i is the index of vector B and cuckoo filter table A. When application 112 initiates a request for a digital component in a digital component slot, application 112 transmits rand_var1a, rand_var1b, and rand_var2 as request parameters to computing system MPC1. Application 112 also transmits vector B, rand_var1a, and rand_var1b as request parameters to computing system MPC2. PRF(rand_var2,i) and B i It is Z p A in i The two additive secret shares are held by computing systems MPC1 and MPC2 respectively. Because neither computing system MPC1 nor MPC2 can access these two secret shares, neither of them can recreate the Cuckoo Filter Table, thus protecting user privacy.

[0095] Steps 306 and 308 are optional steps that can be excluded in some implementations. For example, MPC cluster 130 can provide digital components regardless of a user's group membership. In implementations where group membership is used, client device 110 can encrypt and / or compress group membership data in a manner different from using probabilistic data structures.

[0096] Client device 110 transmits a digital component request (310) to MPC cluster 130. The digital component request may include context data related to the context in which the selected digital component will be displayed, such as context attributes of the environment in which the selected digital component will be displayed. The context data may include data about the resources that will be displayed with the digital component, data about the user of client device 110, data about the application 112 that will display the digital component, data about client device 110, and / or general context data (e.g., the date and time).

[0097] Data about the resource may include the resource's URL, the resource's subject, the number of digital component slots in the resource, the type of digital component slots, and the location of the digital component slots within the resource. Data about the user may include demographic data (e.g., age, gender, etc.), user group membership, and / or other appropriate user data. Data about application 112 may include the application's name (e.g., a specific web browser or a native application), the application's category (e.g., a browser, video streaming application, map application, etc.), and / or other appropriate data about application 112. Data about client device 110 may include rough geographic location information indicating the approximate area of ​​client device 110 (e.g., city, state, zip code, etc.), the type of client device 110, and the size of the client device's display.

[0098] Since some or all of the context and / or user data can be considered private, client device 110 can use encryption or other technologies to transmit data to prevent any unauthorized entity from obtaining such information. To prevent these entities and the computing systems MPC1 and MPC2 of the MPC cluster 130 from accessing the context data in plaintext, client device 110 can generate corresponding shares of the context data, such as secret shares, and send these shares to each computing system of the MPC cluster 130. For example, client device 110 can send a first secret share of the context data to computing system MPC1 and a second secret share of the context data to computing system MPC2. Thus, without unauthorized collusion, neither computing systems MPC1 nor MPC2 can reconstruct the context data in plaintext.

[0099] In some implementations, application 112 can be configured to send some context data, such as context data deemed sensitive, using a secret share, while simultaneously sending some context data in plaintext or sending some context data encrypted using a cryptographic technique that allows computing systems MPC1 and MPC2 to access the context data in plaintext. This enables MPC cluster 130 to send at least some context data to SSP 170 for distribution to DSP 150, allowing DSP 150 to use the context data to select digital components and / or selection values ​​for those digital components. In some implementations, client device 110 or application 112 generates a context digital component request, encrypts it into a blob using SSP 170's public key, and inserts the blob as a parameter into the digital component request. In such implementations, MPC cluster 130 can forward context data intended for SSP 170 as an encrypted blob without needing to access the context data in plaintext.

[0100] In embodiments that include a probabilistic data structure for representing user group membership, the digital component request may include parameters for the cuckoo filter. For example, client device 110 may transmit a digital component request including rand_var1a, rand_var1b, and rand_var2 to computing system MPC1. Client device 110 may also transmit a digital component request including vector B, rand_var1a, and rand_var1b to computing system MPC2. Both digital component requests may also include contextual signals, such as the URL of the electronic resource, the number of digital component slots for the resource, the geographic location of client device 110, and / or other appropriate contextual signals that may be used to select the digital component, such as search keywords.

[0101] MPC cluster 130 transmits a Scene Digital Component Request (312) to SSP 170. This digital component request may include scene signals but not sensitive user data, such as user group identifiers identifying user groups whose members include the user. For example, the scene digital component request may include plaintext scene data received from client device 110, but not any scene data sent from client device 110 as a secret share. In some implementations, the scene digital component request is generated by a tag on a publisher page rendered on client device 110 by the SSP, or by a software development kit (SDK) installed on the publisher application of the SSP on client device 110.

[0102] SSP 170 transmits a field digital component request (314) to one or more DSPs 150. Each DSP 150 may respond to the request with one or more conditional selection values ​​and / or one or more unconditional selection values ​​for a digital component. For each digital component, the response may include data identifying the digital component, the selection value of the digital component, and metadata (or other additional information) of the digital component. For example, the response may include a digital component selection item for each digital component, such as a digital component information element dc_information_element. Each DSP 150 may select one or more digital components for inclusion in the digital component selection process based on a field signal and determine or identify the selection value for each selected digital component. In some embodiments, DSP 150 may generate a field vector for each of the one or more digital components based on the field signal.

[0103] Each DSP 150 may transmit its response (316) to the SSP 170. The SSP 170 may transmit a response (318) to the MPC cluster 130. As described above, the DSP 150 and / or the SSP 170 may, for example, infer additional context data of the environment in which the selected digital component will be displayed at the client device 110, based on context data received from the MPC cluster 130. If so, the SSP 170 may also include this additional context data in its response to the MPC cluster 130.

[0104] MPC cluster 130 executes a secure MPC process to select digital components for display at client device 110 (320). This selection may include, for example, using eligibility expressions and / or eligibility criteria to identify a set of digital components and their corresponding selection values, such as identifying eligible digital component selections based on context signals. This may also include identifying candidate digital component selections from the set of eligible digital component selections as candidates for selection. Candidate digital component selections may include unconditional digital components for which DSP 150 provides unconditional selection values ​​or vectors, and conditional digital components that satisfy each condition of the digital component. A conditional digital component selection is considered a candidate for the digital component selection process only when all conditions of the digital component selection are satisfied.

[0105] MPC cluster 130 can, in response to a digital component request, select a digital component option from candidate digital component options based on the selection value of the candidate digital component option to provide its digital component to client device 110. For digital component options with selection values ​​determined using vectors, MPC cluster 130 can determine the selection value of the digital component option by determining the dot product of the vectors, such as a vector based on the digital component, a context vector, and an optional user profile vector.

[0106] MPC cluster 130 transmits a secret share (322) of the selection result to client device 110. In some embodiments, MPC cluster 130 may also send a selection process identifier for the digital component selection process to client device 110. The selection process identifier can uniquely identify the digital component selection process that generated the selection result for it. For example, computing systems MPC1 and MPC2 may each request the generation of a corresponding selection process identifier SPID for each digital component, and computing systems MPC1 and MPC2 may request the execution of a selection process for that digital component to generate a selection result provided to client device 110. In some embodiments, the selection process identifier SPID may be a random number or an opaque alphanumeric or number sequence.

[0107] By sending only a secret share of the results from the selected digital components, rather than sending information about all digital components or a large set of digital components, latency in transmitting and receiving results is similarly reduced, along with the bandwidth, processing power, and battery power consumed. This also reduces the potential leakage of confidential information from the content platform that submits the selection values ​​of digital components to the MPC cluster 130 by limiting the number of digital components that provide their information to client devices.

[0108] MPC cluster 130 may also store data of selection values ​​that are part of a selection process keyed by or otherwise linked to the SPID. For example, computing system MPC1 may store tables or other data structures containing data with selection values ​​based on the key of SPID1 generated by computing system MPC1 for the selection process. Similarly, computing system MPC2 may store tables or other data structures containing data with selection values ​​based on the key of SPID2 generated by computing system MPC2 for the selection process. This enables MPC cluster 130 to update the process variables of the feedback controller based on data received from client device 110. In some embodiments, client device 110 or application 112 generates the SPID. In some embodiments, MPC1 and MPC2 infer the SPID from digital component request 310.

[0109] The selection result can be in the form of a byte array, which includes information about the digital component selected. For example, the selection result can be a byte array including the selection value of the digital component and metadata and / or other additional information of the digital component. Computing systems MPC1 and MPC2 can use a secure MPC process to determine a secret share of the selection result, as described in more detail below. Computing system MPC1 can transmit a first secret share of the selection result to client device 110, and computing system MPC2 can send a second secret share of the selection result to client device 110. To prevent computing systems MPC1 and MPC2 from knowing the selected digital component, they can prevent themselves from sharing their secret shares of the selection result with each other. For example, MPC1 and MPC2 can independently encrypt their respective secret shares using the public key of the client device, which can be a parameter in the digital component request.

[0110] By sending only a secret share of the results from the selected digital components, rather than sending information about all digital components or a large set of digital components, latency in transmitting and receiving results is similarly reduced, along with the bandwidth, processing power, and battery power consumed. This also reduces the potential leakage of confidential information from the content platform that submits the selection values ​​of digital components to the MPC cluster by limiting the number of digital components that provide their information to client devices.

[0111] Client device 110 determines the digital component (324) corresponding to the selection result. For each selection result from which client device 110 receives two secret shares from computing systems MPC1 and MPC2, client device 110 can determine the selection result from these two secret shares. For example, using an additive secret share library described in more detail below, client device 110 can add the two secret shares of the selection result together to obtain the selection result in plaintext form. This allows client device 110 to access the selection value of the digital component and the metadata of the digital component, such as the identity of the digital component, the location from which client device 110 can download the digital component, etc. In some embodiments, the byte array includes the digital component itself, allowing client device 110 to access the digital component after reconstructing the secret shares of the selection result.

[0112] Client device 110 displays a digital component (326). For example, application 112 may display a digital component containing the content received in step 304. In some embodiments, client device 110 may display a digital component showing the selection result.

[0113] In some implementations, client device 110 may request digital components from MPC cluster 130 based on user group membership (or other user signals). Client device 110 may also request digital components from SSP 170 based on context signals. These context signals may include the same context signals described above, as well as optional additional context signals, such as the number of digital component slots for the resource, the type of digital component slots, the type and / or format of digital components that can be displayed with the resource, etc. SSP 170 may select one or more digital components based on the context signals and the selection value of the digital components, and provide client device 110 with one or more of the selected digital components (or data identifying the digital components) and the selection value of the digital components. Client device 110 can then select digital components from a set of digital components including the selection results received from MPC cluster 130 and the digital components selected by SSP 170 for display with the resource. If the resource includes multiple digital component slots, client device 110 may request the corresponding digital component for each slot from MPC cluster 130 and from SSP 170.

[0114] Client device 110 may transmit one or more event notifications (328) to MPC cluster 130. For example, suppose a digital component representing a selection result received from MPC cluster 130 is displayed by application 112 of client device 110, application 112 may transmit an impression notification of the digital component in response to displaying the digital component. In another example, application 112 may transmit a user interaction notification in response to detecting a user interaction, such as the selection / click of a digital component.

[0115] For user interaction notifications, application 112 can generate a secret share of the click parameter `clicked`, which is a Boolean parameter. This Boolean parameter can have a value of one if the user interacts with the digital component, or a value of zero if the user does not interact with the digital component for a specified duration after it is displayed. Therefore, in this example, either value indicates that the digital component was displayed, but a value of one can indicate that the user interacted with the digital component. Application 112 can send a first notification to computer system MPC1, which includes SPID1 received from computer system MPC1 and a first secret share of the click parameter [clicked1]. Similarly, application 112 can send a second notification to computer system MPC2, which includes SPID2 received from computer system MPC2 and a second secret share of the click parameter [clicked2]. In another example, the notification can, for example, use a secret share similar to the click parameter to individually indicate whether the digital component is displayed at client device 110.

[0116] Impression and user interaction notifications enable MPC cluster 130 to update process variables of the feedback controller used to pace the distribution of digital components. For example, if the process variable is the impression rate, MPC cluster 130 can use the impression notification to update the count of impressions of the digital component (or activities that include the digital component). If the process variable is the user interaction rate, MPC cluster 130 can use the click parameter to update the number of user interactions with the digital component (or activities that include the digital component). In a specific example, computing system MPC1 can use SPID1 to obtain stored data for the selection process, and computing system MPC2 can use SPID2 to obtain stored data for the selection process. MPC cluster 130 can then execute a secure MPC procedure to update process variables (e.g., impression rate, interaction rate, conversion rate, and / or resource exhaustion rate) of the digital component activities displayed by application 112. Similarly, MPC cluster 130 can use notifications to update the counts used to determine whether a digital component satisfies the k-anonymity condition.

[0117] Figure 4 This is a swimlane diagram of an example process 400 for selecting digital components to be distributed to client devices. The operation of process 400 can be implemented, for example, by computing systems MPC1 and MPC2 of the MPC cluster 130. The operation of process 400 can also be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices can cause the one or more data processing devices to perform the operation of process 400.

[0118] Computing systems MPC1 and MPC2 determine and / or identify the selection value of the digital component (402). Computing systems MPC1 and MPC2 can determine the selection value in response to a digital component request received from client device 110. (See reference...) Figure 3 As described, computing system MPC1 can receive a digital component request from client device 110, the request including context data and, optionally, data of a probabilistic data structure representing a user group identifier of the user of client device 110. The data of the probabilistic data structure may include parameters rand_var1a, rand_var1b, and rand_var2. Similarly, computing system MPC2 can receive context data and parameter vectors B, rand_var1a, and rand_var1b from client device 110. As mentioned above, the context data may include context attributes in which the environment in which the selected digital component will be displayed.

[0119] Client device 110 can send context data to computing systems MPC1 and MPC2 in various ways. In some embodiments, client device 110 can send a first secret share of the context data to computing system MPC1 and a second secret share of the context data to computing system MPC2. If some context data is considered non-sensitive, client device 110 can send the non-sensitive context data to each computing system MPC1 and MPC2 in plaintext.

[0120] In some implementations, client device 110 may encode the context attributes into a vector and send the vector to each computing system MPC1 and MPC2, or send a corresponding secret share of the vector to computing systems MPC1 and MPC2. Elements in the vector (and optionally, when not in vector form) may be expressed as integers. For example, a location may be expressed as an integer by assigning an integer to each possible location or using the postal code of that location.

[0121] The selection values ​​may include selection values ​​for digital components stored by each computing system MPC1 and MPC2 for which they store data, as well as JIT selection values ​​received from SSP 170 for the digital component selection process. In the case where vectors are used to determine the selection values, each computing system MPC1 and MPC2 can determine the selection values ​​by the dot product of the vectors used to determine the digital components.

[0122] Computing system MPC1 identifies eligible digital components (404). Computing system MPC2 also identifies eligible digital components (406). An eligible digital component is a digital component that has a digital component selection option that is qualified for selection based on the context data requested by the digital component.

[0123] In some implementations, computing systems MPC1 and MPC2 use eligibility expressions for digital components to determine whether each stored and / or JIT digital component is eligible. The output of the eligibility check can be an eligibility parameter indicating whether a digital component selection item (and its digital component and corresponding selection value) is eligible for selection to be distributed to client device 110 for display in response to a digital component request. In some implementations, the eligibility parameter eligibility_check for digital component selection item "i" is... i It can be in plaintext. In some implementations, the eligibility_check parameter of the digital component selection item i... i It can be in the form of a secret share, where the computing system MPC1 has the first secret share [eligibility_check] i.1 Furthermore, the computing system MPC2 possesses a second secret share [eligibility_check]. i.2The brackets []. are used to indicate the secret share of the parameter. (See reference.) Figure 5 An example process for determining whether a digital component is a digital component is described.

[0124] For each eligible digital component, in response to a digital component request, computing systems MPC1 and MPC2 determine whether a digital component option is a candidate to be selected for distribution to client device 110 (408). If the digital component is a conditional digital component, then a candidate digital component option is an eligible digital component option that meets the eligibility criteria of the digital component. Each unconditional digital component that is eligible based on the context is also a candidate digital component. Computing systems MPC1 and MPC2 may use a secure MPC process to determine candidate digital component options such that neither MPC1 nor MPC2 can identify the candidate digital component in plaintext.

[0125] Regarding user group membership eligibility criteria, calculation systems MPC1 and MPC2 can calculate the user group membership eligibility criterion parameter ug_check for each eligible digital component selection item "i". i The corresponding secret share. The user group membership qualification parameter ug_check, maintained by the computing system MPC1. i The first secret share can be represented as [ug_check] i,1 The user group membership qualification parameter ug_check is maintained by the computing system MPC2. i The second secret share can be represented as [ug_check] i,2 ].

[0126] In the implementation scheme that uses a cuckoo filter to represent a user's user group membership, computing systems MPC1 and MPC2 collaborate to calculate [ug_check] according to the following relation 1. i,1 ]:

[0127]

[0128] In relation 1, Π represents the product of multiple terms. Here, ug_id(x) is a function used to retrieve the user group identifier ug_id associated with the selected value x, {F1,…F…} N} is the set of hash functions used to compute the possible indices of items within the Cuckoo Filter table A, and rand_val1a is the random value received in the digital component request. [M x,1 [m] is the x-th element in array [M1]. == is an equality test between the plaintext integer and the secret share of the secret integer. The result of == is 0 (not equal to) or 1 (equal to) the secret share of the secret integer. Here, [M] i,1The value of ] is [PRF(rand_val2a,i)1].

[0129] Similarly, computing system MPC2 collaborates with computing system MPC2 to calculate [ug_check] according to the following relation 2. i,2 ]:

[0130]

[0131] Here, [M i,2 The value of ] = B i .

[0132] For a digital component selection option that is conditional on the user group membership of the user currently selecting a digital component, computing systems MPC1 and MPC2 can calculate the user group membership condition parameter ug_check. i Secret share [ug_check] i,1 ] and [ug_check i,2 The combination of two secret shares can be a Boolean value indicating whether a user is a member of the user group corresponding to the digital component. For example, a value of one can indicate that the user is a member, and a value of zero can indicate that the user is not a member. For digital component selections that are not conditional on the user's user group membership, computing systems MPC1 and MPC2 can use the secret share [ug_check]. i,1 ] and [ug_check i,2 The default value of ] makes the combination have a value (e.g., one) that indicates that the user is a member of the user group corresponding to the numeric component selection.

[0133] In an implementation where a Bloom filter is used to represent a user's group membership, computational systems MPC1 and MPC2 can query the Bloom filter. As a result, for each hash function of the Bloom filter, computational system MPC1 has a first secret share [ug_check] of the user group membership condition parameter. i,1 Similarly, for each hash function of the Bloom filter, the computation system MPC2 has a second secret share of the user group membership criterion parameter [ug_check]. i,2 To ensure that a digital component meets the user group membership criteria, the user group membership criterion parameter, ug_check, is used for each hash value of the Bloom filter. iThis will require a Boolean truth value of either 1 or 0. To check if a user belongs to a specific user group, assume the Bloom filter has N hash functions hashed to N array indices, where all Boolean values ​​at these N indices must be 1 or true. At the implementation level, each ug_check parameter can be the result of a bitwise AND of N secret shares. The secret share of each hash value can be included in the final calculation of the secret share of the candidate parameters for the digital component selection.

[0134] The computing systems MPC1 and MPC2 can also collaborate to calculate the blocked digital component parameter `blocked_check` for each digital component selection item `i` conditioned on frequency control or mute. i The corresponding secret share [blocked_check] i,1 ] and [blocked_check i,2 The combination of these two secret shares can be a Boolean value indicating whether the digital component meets the conditions for being blocked, based on frequency control (e.g., the digital component not being provided to the user more than a threshold number of times over a certain period of time) and / or whether the user has chosen not to display the digital component. For example, a Boolean value of true or one could indicate that the digital component can be displayed to the user based on these factors, and a Boolean value of false or zero could indicate that the digital component cannot be displayed to the user based on these factors.

[0135] To determine the secret share of the blocked digital component parameters, computing systems MPC1 and MPC2 can use the shares of a Bloom filter representing the identifier of the blocked digital component, such as an array. Application 112 can generate a Bloom filter representing the identifier of the blocked digital component and send the data representing the Bloom filter to computing systems MPC1 and MPC2. Computing systems MPC1 and MPC2 can then use the array representing the Bloom filter to query the Bloom filter to obtain the secret share [blocked_check]. i,1 ] and [blocked_check i,2 ].

[0136] The computing systems MPC1 and MPC2 can also collaborate to, for example, use a feedback controller to calculate the pacing control check parameter pacing_check for each digital component selection item i being paced. i The corresponding secret share [pacing_check] i,1 ] and [pacing_check i,2The combination of the two secret shares can be, for example, a Boolean value based on the output of a feedback controller indicating whether a digital component selection item meets the pacing conditions. For example, if a digital component is offered too frequently relative to a target impression rate, the output of the feedback controller can indicate that the digital component is not eligible for use in the digital component selection process. A Boolean value of true or one can indicate that the digital component selection item meets the pacing conditions, for example, that the selection process is not throttled, and a Boolean value of false or zero can indicate that the digital component selection item does not meet the pacing conditions, for example, that the selection process is throttled.

[0137] To enforce resource depletion (e.g., budget) and pacing rules, computing systems MPC1 and MPC2 can randomly block digital components from participating in the digital component selection process using probabilities determined by feedback controllers and resource depletion conditions. If an activity involving a digital component has no additional resources, the probability is set to one. Otherwise, if the activity is ahead of the delivery schedule, the probability is higher, making computing systems MPC1 and MPC2 more likely to block digital components from participating in the digital component selection process, for example, by calculating the secret share [pacing_check]. i,1 ] and [pacing_check i,2 This makes the pacing control check parameter pacing_check i It has a value of zero. The probability is low if the activity lags behind the delivery schedule.

[0138] Computational systems MPC1 and MPC2 can use feedback controllers to periodically compute the pacing selector parameter, pacing_selector, for each activity with an additive secret share. Conceptually, the pacing selector parameter is a throttling probability amplified by a factor of maximum range.

[0139] For each digital component request and each digital component selection, computation systems MPC1 and MPC2 calculate a secret number uniformly distributed in [0, maximum range]. If the random number is less than or equal to the pacing selector parameter, computation systems MPC1 and MPC2 prevent the digital component selection from proceeding, for example, by calculating the secret share [pacing_check]. i,1 ] and [pacing_check i,2 This makes the pacing control check parameter pacing_check i It has a value of zero.

[0140] To protect user privacy and the confidentiality of participants during the selection of digital components, both the random number and the pacing selector parameters are presented in the form of additive secret shares. Comparison between the two secret shares can be performed using a scrambled circuit protocol. By limiting the two secret shares to six or seven bits, the comparison protocol can facilitate one or two rounds of communication between computing systems MPC1 and MPC2.

[0141] To determine the campaign's timing selector parameters, the computing system can calculate the amount of resources used for each campaign as resources_used_campaign = Σ(clearing_value × is_dc_the_winner), where the sum spans all digital component selection processes including the campaign's digital components, the parameter clearing_value is the clearing value of the digital component selection process, and is_dc_the_winner is the winner parameter of the digital component in the digital component selection process. This calculation can be performed in secret shares, such that each computing system MPC1 and MPC2 holds a secret share of the amount of resources used. Computing systems MP1 and MPC2 can then calculate the campaign's resource exhaustion parameter resources_exhausted by determining whether the amount of resources used, i.e., resources_used_campaign, is greater than the total amount of resources allocated to the campaign in the secret shares.

[0142] Computing systems MPC1 and MPC2 can calculate the pacing selector parameter pacing_selector for each activity as pacing_selector = resources_exhausted × maximum range + (1 - resources_exhausted) × output, where the parameter output is the output of the feedback controller. This calculation can use an RPC between computing systems MPC1 and MPC2 to compute the multiplication in the secret share. However, the calculation can be performed periodically offline to prevent any increased latency.

[0143] The computing systems MPC1 and MPC2 can also collaborate to calculate the k-anonymity check parameter kanonymity_check for each digital component option i that must satisfy the k-anonymity condition. i The corresponding secret share [kanonymity_check] i,1 ] and [kanonymity_check i,2This can be applied to all digital components in some implementations. The combination of the two secret shares can be a Boolean value indicating whether a digital component selection satisfies the k-anonymity condition. For example, a value of one can indicate that a digital component selection satisfies k-anonymity, while a value of zero can indicate that a digital component selection does not satisfy k-anonymity and should be blocked from the digital component selection process.

[0144] For each condition of a conditional digital component (e.g., a digital component with at least one condition), each computing system MPC1 and MPC2 can store a corresponding secret share of the parameter for each condition of the digital component selection item corresponding to the digital component. Thus, provided at least one MPC computing system is honest, neither MPC1 nor MPC2 knows the parameter value in plaintext form. Each digital component selection item can be conditional with zero or more conditions. For a given digital component selection process, some digital component selection items can have different conditions and / or a different number of conditions than other digital component selection items.

[0145] In some implementations, the digital component selection option is included as the only criterion that must be met during the digital component selection process: eligibility criteria based on context data. In this example, other conditions (e.g., k-anonymity, pacing, etc.) are not considered.

[0146] While some example conditions have been provided above, other conditions may also be used. Typically, computing systems MPC1 and MPC2 can use a secure MPC process to calculate the secret share of the condition parameters. The standards and techniques used to determine the condition parameters can vary. In some implementations, the secret share of the condition parameters may be received from another computing system, for example, causing computing systems MPC1 and MPC2 not to calculate the condition parameters.

[0147] Computation systems MPC1 and MPC2 can use a secret share of the conditional parameter to determine whether a conditional numeric component selection item (and therefore its numeric component and corresponding selection value) is a candidate in the numeric component selection process. Computation systems MPC1 and MPC2 can use the secret share of the conditional parameter of each conditional numeric component selection item i to compute the candidate parameter is_dc_a_candidate for that conditional numeric component selection item. i The secret share. In general, if the conditional number component is conditional on each of the above conditions, the candidate parameters of number component i can be calculated using the following relation 3:

[0148] is_dc_a_candidate i =ug_check i AND blocked_check i AND pacing_checki ANDkanonymity_check i

[0149] In this example, only the AND operator is used, but other Boolean operators such as OR, XOR, and NOT can also be used. Since the value of each condition parameter is in the form of a secret share, computation systems MPC1 and MPC2 can collaborate using round-trip remote procedure calls (RPCs) during a secure MPC process to determine the corresponding secret share [is_dc_a_candidate] of the candidate parameter for the numeric component selection item i using the secret share of the condition parameter. i,1 ] and [is_dc_a_candidate i,2 Any suitable secret-sharing algorithm used to determine logical AND operations can be used to determine the secret share of the candidate parameter of digital component selection item i [is_dc_a_candidate]. i,1 ] and [is_dc_a_candidate i,2 The computing systems MPC1 and MPC2 can determine the secret share of the candidate parameter using only the secret share of the conditional parameters of those conditions. At the end of this secure MPC process, the computing system MPC1 holds the first secret share [is_dc_a_candidate] of the candidate parameter for each conditional digital component selection. i,1 ], and the computation system MPC2 holds the second secret share of the candidate parameters for each conditional digital component selection [is_dc_a_candidate] i,2 ].

[0150] In some implementations, computational systems MPC1 and MPC2 use a scrambled circuit protocol to evaluate relation 3 for each digital component. In this example, either computational system MPC1 or MPC2 can construct a scrambled circuit. For this example, assume computational system MPC1 constructs the scrambled circuit. Computational system MPC1 knows its own secret share and also knows the only possible bit pattern that computational system MPC2's secret share must maintain in order for the candidate parameters of the digital component to become true or one. Utilizing this property, computational system MPC1 only needs up to 50 gates to construct the scrambled circuit, for example, if there are approximately 50 Boolean parameters in total in relation 3.

[0151] In relation 3, there is only one user group membership qualification parameter, ug_check. i However, if a Bloom filter is used to represent a user's group membership, then relation 3 can include the corresponding group membership condition parameter ug_check for each hash function of the Bloom filter. iSimilarly, if a Bloom filter is used to represent blocked digital components, then relation 3 will include the corresponding blocked digital component parameter `blocked_check` for each hash function of that Bloom filter. i In relation 3, pacing_check is enabled only if the owner of the digital component has pacing checked. i Only then will it exist.

[0152] Computing system MPC1 determines the order of digital component selections based on selection values ​​(410). Similarly, computing system MPC2 determines the order of digital component selections based on selection values ​​(412). These two orders should be identical because the inputs to the sorting process are the same for both computing systems MPC1 and MPC2. Each computing system MPC1 and MPC2 can determine the order of digital component selections. Each order can include candidate digital components and other digital components that were evaluated for eligibility in step 408. For example, the order can include all available digital components for the digital component selection process, all eligible digital components for the digital component selection process (e.g., eligible based on context data), or all digital components maintained by MPC cluster 130. The order can be from digital component selections with the highest selection value to digital component selections with the lowest selection value. In some embodiments, the selection value used for the order can be a value to be provided to the publisher 140 of the resource, for example, after any sharing with DSP 150 and / or SSP 170, the selected digital components will be displayed with that resource.

[0153] Because the selection values ​​are in plaintext, computing systems MPC1 and MPC2 do not need to perform any round-trip computations to determine the order of the digital component selections. Instead, each computing system MPC1 and MPC2 can independently sort the digital component selections. If the selection values ​​are stored as secret shares at each computing system MPC1 and MPC2, with each system having a corresponding secret share for each selection value, then MPC1 and MPC2 can use round-trip computations to perform a secure MPC process to sort the digital component selections based on the selection values. If a tie exists between two or more selection values, MPC1 and MPC2 can deterministically break the tie using additional metadata corresponding to the digital component selections for those selection values.

[0154] The computational systems MPC1 and MPC2 determine a secret share (414) of the cumulative value of each candidate digital component selection. Conceptually, the cumulative value of a given digital component selection represents the total number of candidate digital component selections from the top of the order to the given digital component selection, excluding the given digital component selection, even if the given digital component selection is a candidate. That is, the cumulative value represents the number of candidate digital component selections that are better and / or more qualified for selection than the given digital component selection. This concept is illustrated in Table 1 below.

[0155] Sorted selection values is_dc_a_candidate Cumulative value (acc) Is the cumulative value equal to 0? Highest 0 0 1 Second highest 1 0 1 Third highest 0 1 0 Fourth High 1 1 0 … … … …

[0156] Table 1

[0157] In some implementations, the cumulative value of a given numeric component selection represents the total number of candidate numeric component selections from the top of the sequence up to the given numeric component selection (including the given numeric component selection if it is a candidate). In this example, the fourth column will indicate whether the cumulative value is equal to one rather than zero. For brevity, the remaining discussion will follow the first example, where the cumulative value of a given numeric component selection represents the total number of candidate numeric component selections from the top of the sequence up to the given numeric component selection (excluding the given numeric component selection even if it is a candidate).

[0158] Conceptually, in Table 1, for each numeric component selection whose candidate parameter is_dc_a_candidate equals one, the cumulative value (acc) increases as it progresses from the top to the bottom of the sequence. As described below, the calculation of the cumulative value acc is performed within a secret share. For example, when the candidate parameter is_dc_a_candidate with the highest selection value is zero, the cumulative value acc of the numeric component selection with the highest selection value is zero. The cumulative value acc of the second-highest numeric component selection (the numeric component selection with the second-highest selection value) is also zero because its candidate parameter is_dc_a_candidate equals one, but none of the numeric component selections above it have a candidate parameter is_dc_a_candidate equal to one. Moving down the sequence, the candidate parameter `is_dc_a_candidate` of the second highest-selected numeric component has a value of one, and the cumulative value `acc` of the candidate parameter `is_dc_a_candidate` of the third highest-selected numeric component (the numeric component with the third highest selection value) increments to one. Since the candidate parameter `is_dc_a_candidate` of the third highest-selected numeric component is zero, the cumulative value `acc` of the fourth highest-selected numeric component (the numeric component with the fourth highest selection value) does not increment and, like the third highest-selected numeric component, has a value of zero.

[0159] Using Table 1, computing systems MPC1 and MPC2 will select digital components corresponding to the selection items where the total candidate parameter is_dc_a_candidate has a value of one and the cumulative value acc has a value of zero (as shown in the fourth column of Table 1) for distribution to client device 110. This means that the digital component corresponding to the highest-ranking selection value of the candidate parameter is_dc_a_candidate with a value of one is selected. Since the candidate parameter is_dc_a_candidate is in a secret share in computing systems MPC1 and MPC2 to maintain user privacy and ensure that user data is not leaked, computing systems MPC1 and MPC2 determine the secret share of the cumulative value acc for each digital component and use round-trip computation to determine which digital component has a cumulative value acc equal to zero and a candidate parameter is_dc_a_candidate equal to one.

[0160] In some implementations, computational systems MPC1 and MPC2 can independently determine the secret share of their cumulative value acc for each digital component selection item without any round-trip computation, depending on the secret sharing algorithm. For example, for each digital component selection item i, computational system MPC1 can determine the first share of the cumulative value acc[acc] by traversing all digital components in descending order and summing the candidate parameter is_dc_a_candidate of the digital component selection items along the way. i,1 As described in Table 1 above. Similarly, for each digital component selection i, the computation system MPC2 can determine the second share of the cumulative value acc by traversing all digital component selections in descending order and summing the candidate parameter is_dc_a_candidate of the digital component selections along the way. i,2 ].

[0161] For each digital component selection, computing systems MPC1 and MPC2 determine a secret share (416) indicating whether the cumulative value has a specified value. The specified value can be zero, as shown in columns 3 and 4 of Table 1. As described above, a digital component selection with a cumulative value of zero and a total candidate parameter is_dc_a_candidate of one is the digital component selection with the highest selection value among the candidate digital component selections.

[0162] Computational systems MPC1 and MPC2 can participate in multiple rounds of computation, such as multiple RPCs, as part of a secure MPC process, to compute an equality operation acc with respect to the secret share of each digital component choice i. i == 0. The equality operation is used to determine the cumulative value acc of the digital component selection item i. i Does it have a value of zero? At the end of this process, for each digital component selection i, the calculation system MPC1 has a result acc. i == 0 is a secret share, and for each digital component selection i, the computational system MPC2 has the result acc. i Another secret share of ==0.

[0163] The computing systems MPC1 and MPC2 determine the winner parameter is_dc_the_winner for each digital component selection item i. i The secret share (418). The computing systems MPC1 and MPC2 can be based on the cumulative value acc of each digital component selection item i. i == 0 secret share and candidate parameter is_dc_a_candidate for each number component selection item i i The secret share is used to determine the winner parameter is_dc_the_winneri The winner parameter is_dc_the_winner for each number component selection item i. i It can be a Boolean value that indicates whether digital component selection item i (and its digital component) is the winner of the selection process, for example, whether the digital component of digital component selection item i is selected for distribution to client device 110 in response to a digital component request.

[0164] In some implementations, computing systems MPC1 and MPC2 can execute a secret share multiplication protocol to compute the winner parameter is_dc_the_winner for each selected value regarding the secret share. i ==(is_dc_a_candidate) i ×(acc i == 0). This can include an RPC between computing systems MPC1 and MPC2 to multiply the two secret shares. At the end of the MPC process, computing system MPC1 has the result is_dc_the_winner. i A secret share, denoted as [is_dc_the_winner] i,1 ] = [is_dc_a_candidate i,1 ]x([acc i,1 ]==1). Similarly, the computing system MPC2 has the result is_dc_the_winner. i Another secret share is represented as [is_dc_the_winner] i,2 ] = [is_dc_a_candidate i,2 ]x([acc i,2 [==0]. Note that for all numeric component selections, at most one numeric component selection has a winner parameter is_dc_the_winner equal to one. i This is a digital component selection option that has a digital component selected for distribution to client device 110. All others will be equal to zero.

[0165] Calculation systems MPC1 and MPC2 determine the selection result (420). In some embodiments, calculation systems MPC1 and MPC2 may calculate the selection result based on the winner parameter of the digital component selection item and the digital component information element dc_information_element of the digital component. As mentioned above, the digital component information element dc_information_element of the digital component may include the selection value of the digital component and other data of the digital component.

[0166] Conceptually, the computing systems MPC1 and MPC2 can use the following relation 4 to calculate the selection result parameter "result".

[0167] result = ∑ i is_dc_the_winner i ×dc_informatiom_element i

[0168] In other words, computing systems MPC1 and MPC2 can determine the winner parameter is_dc_the_winner across all digital component selection options. i and the digital component information element dc_information_element i The sum of the products. In this example, if there are no candidate number components, the selection result will have a value of zero, or it will have a value equal to the winner parameter is_dc_the_winner. i The value of the selected numeric component information element `dc_information_element` is equal to one. In another example, the numeric component information element `dc_information_element` can be replaced with the selected value of the numeric component in relation 4. In this example, if there are no candidate numeric component selections, the selection result will have a value of zero, or it will have a value equal to the winner parameter `is_dc_the_winner`. i The value of the selected numeric component selection item that equals one.

[0169] In order to perform calculations within the secret share, the calculation system MPC1 obtains all digital component selections and assigns the digital component information element dc_information_element, which can be in plaintext form, to the digital component selections. i The first secret share of the winner parameter multiplied by the number component selection option [is_dc_the_winner] i,1 The computing system MPC1 can then determine the sum of these products and return the sum to the client device 110 that submitted the digital component request. That is, the computing system MPC1 can use the following relation 5 to determine the sum as the first secret share of the result [result1].

[0170] [result1]=∑ i ([is_dc_the_winner i ×dc_information_element i )

[0171] The computational system MPC2 can perform similar calculations using the following relation 6 to determine the second secret share of the result [result2].

[0172] [result2]=∑ i ([is_dc_the_winner i ×dc_information_element i )

[0173] In some implementations, the performance of the MPC cluster 130 can be improved by replacing multiplications performed in the secret share with bit-by-bit AND operations and summation with bit-by-bit XOR operations (e.g., by reducing computation and round-trip communication between computing systems MPC1 and MPC2). In some implementations, scrambling circuits can be used to evaluate various relations, thereby reducing computation and round-trip communication. For example, in a scrambling circuit implementation, MPC1 can act as a scrambler, and MPC2 can act as an evaluator.

[0174] Computing system MPC1 sends a first share of the selection result [result1] (422) to client device 110. Similarly, computing system MPC2 sends a second share of the selection result [result2] (424) to client device 110. Application 112 can then reconstruct the selection result result in plaintext using the two secret shares [result1] and [result2], for example, by determining the sum of the secret shares (if an additive secret sharing algorithm is used). If the selection result has a value of zero, then MPC cluster 130 has not identified a digital component for distribution to client device 110. Otherwise, the selection result has a value equal to the digital component information element dc_information_element. Application 112 can parse the digital component information element dc_information_element to obtain the selection value and metadata of the digital component. As described above, application 112 can then display the digital component, or perform the selection process using the digital component and other digital components received from SSP 170.

[0175] In some implementations, a mask is used to send the selected digital component to client device 110 to prevent computing systems MPC1 or MPC2 from accessing the selected digital component in plaintext and to reduce latency and bandwidth consumption in sending the digital component to client device 110. In this example, application 112 may select a random number for each digital component request and send the random number along with the digital component request. Application 112 may send the random number to either computing system MPC1 or MPC2. For illustrative purposes, it is assumed that the random number is sent to computing system MPC2.

[0176] Both Application 112 and Computation System MPC2 can independently compute a mask of the same size as the maximum digital component's creative value using the same algorithm and the same input. For example, the i-th bit of the mask can be represented as PRF(random number, i), where PRF represents a pseudo-random function. Both Application 112 and Computation System MPC2 can keep the random number and mask strictly confidential from Computation System MPC1.

[0177] To send the selected digital component to application 112, computing system MPC2 can send the bit-by-bit XOR mask of [result2] to computing system MPC1. Computing system MPC1 then sends the bit-by-bit XOR of [result1] (the bit-by-bit XOR mask of [result2]) as the selection result, for example, as a response to the request for the digital component, to application 112.

[0178] Application 112 can compute a bitwise XOR of [result1] with a bitwise XOR mask of [result2] as the idea of ​​the digital component. This is equivalent to a bitwise XOR of [result1] with [result2]. This reduces the bandwidth required for the maximum idea size while preserving the privacy information retrieval guarantee. As mentioned above, this reduces the response bandwidth relative to sending two secret shares of the selected result. In this way, in this privacy-preserving technique, there is little or no additional latency or bandwidth consumption compared to sending the digital component idea as in other processes.

[0179] Figure 5 This is a diagram illustrating an example process for determining whether a digital component is eligible for selection. The operation of process 500 can be implemented, for example, by computing systems MPC1 and MPC2 of the MPC cluster 130. The operation of process 500 can also be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 500.

[0180] Computing system MPC1 obtains a set of context attributes of the environment in which the selected digital component will be displayed at the client device (502). Computing system MPC2 also obtains the same set of context attributes (504).

[0181] A set of context attributes can be received from client device 110 and / or content platform (e.g., SSP 170 and / or one or more DSPs 150). For example, client device 110 can provide the set of context attributes and digital component requests to computing systems MPC1 and MPC2. As described above, the content platform can also infer the context attributes of the environment. As described above, context attributes can include data about resources that will be displayed with the digital components, data about the user of client device 110, data about application 112 that will display the digital components, data about client device 110, and / or general context data (e.g., date and time of day).

[0182] The set of attributes can be in the form of an attribute vector. In some implementations, each computing system MPC1 and MPC2 receives a corresponding secret share of the set of context attributes, such as a corresponding secret share of the context attribute vector.

[0183] Computing system MPC1 obtains qualification data for digital component selection items (506). Computing system MPC2 also obtains qualification data for digital component selection items (508). The qualification data may include qualification expressions and / or qualification criteria that define the selection values ​​of digital components and digital component selection items that can be included in the context of the digital component selection process.

[0184] Qualification expressions can be in the form of Boolean expressions, which include subexpressions based on qualification criteria and Boolean operators between each pair of subexpressions, such as Boolean AND, Boolean OR, and unary Boolean NOT. The Boolean NOT operator can operate on a single argument, but not multiple arguments. Each subexpression can be based on one or more context attributes. For example, one subexpression might request that the geographic location of the client device 110 displaying the digital component is located in a specific geographic region, while another subexpression might require that the topics of the resources displayed with the digital component have one of the topics in a set of topics. In this example, the qualification expression could be represented as: Client device location = specific geographic region AND resource topic ∈ topic set.

[0185] In some cases, such as when the eligibility of a digital component selection is conditional on a single context attribute, the eligibility expression may consist of only a single subexpression. However, the MPC cluster 130 can support arbitrary Boolean expressions, such as Boolean expressions that include multiple subexpressions and logical operators between them, to provide fine-grained control over how digital components are displayed with resources.

[0186] In some implementations, the content platform provides qualification expressions for digital components. In this case, to protect trade secrets, the content platform may provide computing systems MPC1 and MPC2 with the qualification expressions and corresponding secret shares of the qualification criteria. In this example, computing system MPC1 will receive a first secret share of the qualification expression and a first secret share of the qualification criteria. Similarly, computing system MPC2 will receive a second secret share of the qualification expression and a second secret share of the qualification criteria.

[0187] Content platforms can also provide eligibility expressions and eligibility criteria in plaintext. For example, a content platform can provide eligibility expressions in the form of script functions or other computer-readable code. In such an example, computing systems MPC1 and MPC2 can determine whether a digital component selection is eligible by executing a script or other code in a sandbox environment. The sandbox environment can be isolated from other code execution. Using a sandbox environment can prevent scripts from making any input / output requests or obtaining any data not provided to the sandbox environment, for example, to protect user data privacy and protect computing systems MPC1 and MPC2 from malicious code.

[0188] In some implementations, MPC cluster 130 constructs a qualification expression based on qualification criteria and / or qualification expressions provided by the content platform. For example, DSP 150 may provide a subexpression for one of its digital components that defines when that digital component is eligible. Similarly, SSP 170 may provide a subexpression for a resource that defines attributes of digital components that are not allowed to be displayed with the resource. When a digital component request is for display with a resource, MPC cluster 130 can access the resource's subexpression and the digital component's subexpression and construct a qualification expression. For example, computing systems MPC1 and MPC2 can use the AND operator to combine the subexpression of SSP 170 with the subexpression of DSP 150, since the digital component will need to satisfy both sets of subexpressions to be eligible for display with the resource. If the qualification expression is provided to computing systems MPC1 and MPC2 using a secret share, computing systems MPC1 and MPC2 can use a secure MPC procedure to evaluate whether both sets of subexpressions are satisfied, as described below.

[0189] Compared to using large caches to look up keywords, using qualification expressions reduces the amount of data stored by computing systems MPC1 and MPC2. This also increases the flexibility of publishers and digital component providers in controlling the display of digital components without increasing the data storage requirements of computing systems MPC1 and MPC2. This allows computing systems MPC1 and MPC2 to store more digital components, digital component information, and / or other relevant information in high-speed memory, such as in caches.

[0190] MPC Cluster 130 can support various types of subexpressions and can evaluate each type using a secure MPC process based on a secret share of eligibility criteria. Some example types include set intersection checks, equality tests, comparisons, and truth tables.

[0191] Set intersection checks can be used to determine if an attribute is a member of a set of attributes. This can be used to determine if a digital component has attributes that the publisher of a resource does not want to be displayed with its resource. For example, a publisher might block digital components with content associated with a specific item. Set intersection checks can also be used to check if a specific item matches one of the attributes in a digital component's set of attributes.

[0192] Each digital component option can have a set of attributes, which can be represented as S. dcsi Some attributes of a digital component can be determined by SSP 170 on behalf of the publisher and attached to the digital component options. For example, during the digital component review process, SSP 170 can determine that the digital component is about a specific item and attach that specific item as one of the attributes determined by the SSP to the digital component options. The set of attributes determined by the SSP can be referred to as S... dcsi,SSP .

[0193] SSP 170 can be provided, for example, by giving the expression P∈S dcsi This instructs MPC cluster 130 not to select digital components related to specific items on the publisher's resources, where P represents the excluded attribute (i.e., the specific item), and S... dcsi This indicates the attributes of a digital component, which may include attributes inferred by SSP 170. SSP 170 may instruct MPC cluster 130 that a digital component is not eligible for selection if the attribute is in the digital component's attribute set.

[0194] Similarly, the DSP 150, on behalf of the digital component provider 160 that publishes the digital component, can determine some attributes of the digital component and attach them to the digital component selections. If the DSP only wants the digital component to be displayed along with motion-related resources, the DSP 150 can add the attribute "motion" to the digital component selections as one of the attributes determined by the DSP. The set of attributes determined by the DSP can be called S. dcsi,DSP .

[0195] DSP 150 can instruct MPC cluster 130 to qualify a digital component for selection if a specific attribute (e.g., "motion") is included in the set of context attributes requested by the digital component. To this end, DSP 150 can provide the expression P∈S dcsi Where P represents one or more desired attributes (i.e., motion) that the digital component is qualified for, and Sdcsi This indicates the attribute of the digital component. DSP 150 can instruct MPC cluster 130 that if the attribute is in the attribute set of the digital component, then the digital component is not eligible for selection.

[0196] Equality tests can be used to determine whether an attribute has a specific value. For example, the geographic location of client device 110 can have many different values, while DSP 150 may only want a specific selected value for a digital component to be eligible in one of the possible locations. Equality tests can also be used to determine whether a specific attribute in a set of context attributes has a specific value, or whether a specific attribute in the attributes of a digital component has a specific value. The content platform can instruct MPC cluster 130 to perform equality tests to determine whether a specific attribute in a context attribute or a digital component attribute has a specific value.

[0197] Using well-defined comparison tests, attributes can be ordered. For example, if a digital component selection is only valid for users 60 years of age or older, then that digital component selection could have an expression for the attribute "minimum age" with a value of 60. The DSP 150 can instruct the MPC cluster 130 to compare the minimum age attribute with the user's age, which can be included in the context attribute set.

[0198] Content platforms can generate qualification expressions that include various types of sub-expressions, including one or more set intersection checks, one or more equality tests, and / or one or more comparisons. This provides fine-grained control over the context in which digital components can be displayed and the content of those digital components displayed on publisher resources. Example expressions could be:

[0199] In this example, only when the property S of the digital component... dcsi Excluding specific items, the digital component is eligible only when the client device 110 is in a specific state and the user of the client device 110 is at least the minimum age. Although only the AND operator is used in this example, other Boolean operators such as OR, XOR, NOT, etc. can also be used.

[0200] Computing systems MPC1 and MPC2 evaluate the eligibility expression (510). Computing systems MPC1 and MPC2 evaluate the eligibility expression for each digital component to determine whether that digital component is eligible for selection. As mentioned above, if the eligibility expression and the corresponding eligibility criteria are provided to computing systems MPC1 and MPC2 in plaintext, the evaluation can be performed in a sandbox.

[0201] In some cases, attributes associated with the set of context attributes for digital component options and / or digital component requests may be sensitive or confidential. For example, DSP 150 may not want a particular publisher to know that, due to how resources are categorized, DSP 150 does not allow the display of a specific digital component or set of digital components on a publisher's resources. In another example, SSP 170 may not want to disclose to digital component providers that a particular resource is available for displaying digital components from one provider but not from another.

[0202] To prevent such data leakage, the MPC cluster 130 can use a secure MPC process to determine the eligibility of digital components. Instead of receiving the set of context attributes, eligibility expressions, and eligibility criteria in plaintext, each computing system MPC1 and MPC2 can receive a secret share of the context attribute set, a secret share of the eligibility expression, and a secret share of the eligibility criteria. The computing systems MPC1 and MPC2 can then use the secret shares to perform a secure MPC process to determine the eligibility of digital component options.

[0203] For set intersection checks, attributes can be encoded using vectors, Bloom filters, or distributed point functions (DPFs), depending on the number of attributes to be encoded. If the number of attributes is finite, such as less than 100, 500, or another suitable threshold, vectors can be used effectively. To protect confidential information, a vector or attribute can be split into two vectors of additive secret shares in Z2. For example, if the first element of a vector represents whether a digital component selection is associated with a specific item, and the digital component is indeed associated with that specific item, then there may exist a secret vector S, where S[0] = 1. In this example, the element 0 of vector S represents the specific item. The two vectors of additive secret shares are S1 and S2, where S1[0] XOR S2[0] == 1. In this example, computing system MPC1 can receive the first secret share S1 of vector S, while computing system MPC2 can receive the second secret share S2 of vector S. If the digital component is not associated with the specific item, the expression would be: S[0] = 0 and S1[0] XOR S2[0] == 0.

[0204] Vectors can be used to encode a finite number of attributes of a digital component in a digital component selection, as well as the set of context attributes requested by the digital component. Suppose S1 and S2 represent vectors of secret shares of a digital component selection held by MPC1 and MPC2, respectively. These vectors encode attributes of the digital component (e.g., attributes of the digital component itself or attributes of the environment in which the digital component is eligible or unqualified).

[0205] Suppose P1 and P2 represent vectors of secret shares of a digital component request held by MPC1 and MPC2, respectively. These vectors encode the contextual properties of the digital component request. Conceptually, let common_properties represent reconstruction (S1, S2) = reconstruction (P1, P2). Computation systems MPC1 and MPC2 can compute common_properties within the secret shares by evaluating the secret shares of the vectors and comparing corresponding elements of the vectors using a secure MPC procedure. If an element in common_properties has a value of one, then both the digital component selection and the current digital component request share the same property corresponding to that element. When the data types of S and P are boolean rather than integer, the comparison operation can be optimized to a logical XOR, which requires no additional round trips in the secure MPC protocol.

[0206] To implement the block list—that is, if a digital component selection is not eligible for selection if it is associated with any property specified for the current digital component request—the calculation systems MPC1 and MPC2 will examine the elements in the common_properties calculated in the secret share to protect user privacy. If all elements have a value of zero, the digital component selection will not be blocked for the current request.

[0207] To implement the enabled list—that is, if a cached bid is associated with any property specified for the current digital component request, then the digital component selection option is eligible for selection—computing systems MPC1 and MPC2 will examine the elements in `common_properties`. If all elements have a value of zero, then the digital component selection option is blocked for the current digital component request.

[0208] Several techniques can be used to compute common_properties and check if all elements in common_properties have a value of zero. One technique is the Goldreich-Micali-Wigderson (GMW) with unintended transmission (OT), and another is scrambled circuitry. Both methods utilize a round of online communication between two computing systems, MPC1 and MPC2.

[0209] When there are a large number of attributes (e.g., more than a threshold number of attributes), using vectors may not be as efficient as using Bloom filters or DPFs. If the average number of attributes for digital component options and digital component requests is small compared to the total number of attributes, and if the use case can tolerate a certain level of false positive rate (FPR), then the attributes can be encoded in a Bloom filter. Otherwise, these attributes can be encoded in a DPF. In either solution, the communication bandwidth between the content platform and the MPC cluster 130 is reduced.

[0210] For the equality test, assume that for a digital component selection, MPC1 and MPC2 hold two secret shares [p1] and [p2] of the attributes of the digital component selection, respectively. For a digital component request, SSP 170 sends two secret shares [q1] and [q2] of the attributes (e.g., a set of context attributes) of the digital component request to MP1 and MPC2, respectively. MPC1 and MPC2 compare whether the two secret messages p and q are equal, where p = reconstructed([p1],[p2]) and q = reconstructed([q1],[q2]).

[0211] The following two assertions are equivalent: p and q are equal; and pq = 0. Using this observation, an alternative protocol is that MPC cluster 130 can use secret share computation to compute tmp = pq and determine if tmp is equal to zero. To do this, MPC1 computes [tmp1] = [p1] – [q1], and MPC2 computes [tmp1] = [p2] – [q2]. Computation systems MPC1 and MPC2 can then use GMW or scrambling circuitry to determine if the secret message tmp is equal to zero (i.e., all bits in tmp are zero).

[0212] In addition to the expressions mentioned above, the MPC cluster 130 can support truth tables that define controls for determining whether a digital component option is eligible for selection in response to a digital component request. The MPC cluster 130 can generate the truth table based on the eligibility expression.

[0213] After evaluating various sub-expressions, computation systems MPC1 and MPC2 can evaluate the Boolean operators of the eligibility expressions. Since the results of some sub-expressions can be secret shares held by each computation system MPC1 and MPC2, they can use secure MPC procedures to evaluate the Boolean operators. The result can also be the eligibility parameter `eligibility_check`, indicating whether a numeric component selection is eligible. i The secret share. For example, computing system MPC1 can have a first secret share [eligibility_check]. i.1 The computing system MPC2 has a second secret share [eligibility_check]. i.2 As described above, computing systems MPC1 and MPC2 can then use a secret share of the qualification parameters as part of the process for selecting digital components.

[0214] Figure 6This is a diagram of an example process 600 for determining the highest alternative selection value for a digital component during the selection process. The operation of process 600 can be implemented, for example, by computing systems MPC1 or MPC2 of MPC cluster 130 in cooperation with other computing systems of MPC cluster 130. The operation of process 600 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 600.

[0215] The computing system obtains at least a first share (602) of a set of context attributes of the environment in which the selected digital component will be displayed at the client device. The set of context attributes can be received from the client device 110 and / or a content platform (e.g., an SSP 170 and / or one or more DSPs 150). For example, the client device 110 may provide the set of context attributes and a digital component request to computing systems MPC1 and MPC2. As described above, the content platform can also infer context attributes of the environment. As described above, context attributes may include data about the resources that will be displayed with the digital component, data about the user of the client device 110, data about the application 112 that will display the digital component, data about the client device 110, and / or general context data (e.g., date and time of day).

[0216] The computing system can receive a first secret share of the set of context attributes. Each other computing system in the MPC cluster 130 can receive a corresponding second secret share of the set of context attributes.

[0217] The computing system obtains at least a first share of a qualification expression for each digital component in the set of digital components, the qualification expression defining the relationship between the sets of qualification criteria of the digital components (604). As described above, the qualification expression may include one or more subexpressions, unary Boolean operators such as NOT, and Boolean operators between pairs of subexpressions.

[0218] The computing system can receive a first secret share of the qualification expression and a first secret share of the qualification criteria of the qualification expression. Each other computing system in the MPC cluster 130 can receive a corresponding second secret share of the set of qualification expressions and a corresponding second secret share of the qualification criteria.

[0219] For each digital component, and based on at least a first share of the set of context attributes and at least a first share of the eligibility expression, the computing system determines (606) at least a first share of the eligibility parameters (for selection to be displayed at the client device) that indicates whether the digital component is eligible. The computing system can use Figure 5The process 500 shown and described above determines a first share of the eligibility parameters. As part of process 500, each other computing system in the MPC cluster 130 can determine a second share of the eligibility parameters.

[0220] The computing system collaborates with each other computing system in the MPC cluster to perform a secure MPC process to select a given digital component as the selected digital component from a set of qualified digital components, which includes each digital component having a qualification parameter indicating that the digital component is qualified for selection (608). The computing system can use Figure 4 The process 400 shown and described above collaborates with other computing systems to select digital components.

[0221] As a result of the secure MPC process, the computing system generates a first share (610) of the selection result identifying the selected digital components. Each other computing system in the MPC cluster 130 generates a corresponding second share of the selection result. Figure 4 As part of the process 400 shown and described above, the computing system can determine the share of the selection result.

[0222] The computing system sends the first share (612) of the selection result to the client device. Each other computing system in the MPC cluster 130 also sends a corresponding second share of its selection result to the client device. The client device can then access and display the selected digital component.

[0223] In some implementations, the MPC cluster 130 may use scrambling circuitry for the secure MPC process to determine whether a digital component is a candidate for the selection process, for example, by determining a secret share of the candidate parameters for the digital component. Since each digital component can have many conditions—for example, dozens in some cases—there will be many gates in the scrambling circuitry for each digital component. Reducing the number of gates will reduce the bandwidth cost of executing the secure MPC protocol and significantly reduce the waiting time in selecting digital components.

[0224] There are many repetitive calculations and logical AND operations between the same input or intermediate Boolean variable pairs, for example, for the same number components or for groups of number components. A greedy algorithm can be used to avoid repeated calculations of subexpressions, thereby reducing the number of AND operations.

[0225] In the above process, it can be assumed that the candidate parameter is_dc_a_candidate is in Z PIn this context, the value is either zero or one. MPC cluster 130 iterates through all cached digital components from those with the highest to lowest selected values ​​(e.g., the portion attributed to the publisher). For each cached digital component i, MPC cluster 130 calculates the cumulative value acc. i Then calculate Z P acc in i == 0. The result is converted back to Z2. From Z2 to Z p The conversions and inverse conversions increase the complexity of the protocol. Z using scrambling circuits... p Equality test in acc i == 0 may involve log2(p) gates, which is a significant performance and bandwidth cost.

[0226] MPC cluster 130 can select the candidate parameter is_dc_a_candidate i Remaining in Z2, and calculating the cumulative value acc using Boolean circuits in Z2 at a much lower computational and bandwidth cost. i , then acc i == 0. Therefore, the cumulative value acc i Limited to two possible values: zero if no candidate digit component has a higher selection value than the current selection value of the current digit component i, or one if at least one candidate digit component has a higher selection value than the current selection value of the current digit component. In the above process, the cumulative value can be greater than one as it increments for each candidate digit component.

[0227] Using the updated semantics of the cumulative value acc, MPC cluster 130 can compute the winner parameter is_dc_the_winner. i The accumulated value is calculated by iterating through all cached numeric components from highest to lowest selection value. The accumulated value (acc) of the numeric component with the highest selection value is always zero. No calculation is required.

[0228] The cumulative value acc of the digital component with the second highest selectivity value is always equal to the value of the candidate parameter is_dc_a_candidate of the digital component with the highest selectivity value. This also does not require calculation.

[0229] Assume that MPC cluster 130 has already computed the cumulative value acc for the digital component with the nth highest selectivity value. The cumulative value acc of the digital component with the (n+1)th highest selectivity value can be computed as acc n+1 =acc n ORis_dc_a_candidate n MPC cluster 130 can further calculate the winner parameter is_dc_a_winner.n+1 =is_dc_a_candidate n+1 ANDNOT acc n+1 .

[0230] The MPC cluster 130 can have two gates, and four lines for each cache digital component, such as two input lines (acc). n and is_dc_a_candidate n ) and two output lines (acc) n+1 and is_dc_a_winner n+1 With these enhancements, each cached digital component in the MPC cluster 130 requires only two gates instead of dozens. As mentioned above, this encryption process can be performed as part of the candidate qualification determination.

[0231] Figure 7 This is a block diagram of an example computer system 700 that can be used to perform the operations described above. System 700 includes a processor 710, memory 720, storage device 730, and input / output device 740. Each of components 710, 720, 730, and 740 can be interconnected, for example, using a system bus 750. Processor 710 is capable of processing instructions for execution within system 700. In some embodiments, processor 710 is a single-threaded processor. In another embodiment, processor 710 is a multi-threaded processor. Processor 710 is capable of processing instructions stored in memory 720 or on storage device 730.

[0232] Memory 720 stores information within system 700. In one embodiment, memory 720 is a computer-readable medium. In some embodiments, memory 720 is a volatile memory cell. In another embodiment, memory 720 is a non-volatile memory cell.

[0233] Storage device 730 provides high-capacity storage for system 700. In some embodiments, storage device 730 is a computer-readable medium. In various different embodiments, storage device 730 may include, for example, a hard disk drive, an optical disk drive, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other high-capacity storage device.

[0234] Input / output device 740 provides input / output operations for system 1000. In some embodiments, input / output device 740 may include one or more of the following: a network interface device (e.g., an Ethernet card), a serial communication device (e.g., an RS-232 port), and / or a wireless interface device (e.g., an 802.11 card). In another embodiment, input / output device may include a driver device configured to receive input data and send output data to external device 760 (e.g., a keyboard, printer, and display device). However, other embodiments, such as mobile computing devices, mobile communication devices, set-top box television client devices, etc., may also be used.

[0235] Although already Figure 7 An example processing system is described herein, but implementations of the subject matter and functional operations described herein may be implemented in other types of digital electronic circuits, or in computer software, firmware, or hardware that includes the structures disclosed herein and their equivalents, or in a combination of one or more of them.

[0236] Embodiments of the subject matter and operations described in this specification can be implemented in digital electronic circuits, or in computer software, firmware, or hardware that includes the structures disclosed in this specification and their equivalents, or in a combination of one or more of these. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more computer program instruction modules encoded on a computer storage medium (or media) for execution by or control of the operation of a data processing device. Alternatively or additionally, program instructions can be encoded on artificially generated propagated signals, such as machine-generated electrical, optical, or electromagnetic signals, generated to encode information for transmission to a suitable receiver device for execution by the data processing device. The computer storage medium can be or is included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of these. Furthermore, while the computer storage medium is not a propagated signal, it can be a source or destination of computer program instructions encoded in artificially generated propagated signals. The computer storage medium can also be or be included in one or more separate physical components or media (e.g., multiple CDs, discs, or other storage devices).

[0237] The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0238] The term "data processing apparatus" encompasses all kinds of devices, apparatuses, and machines used for processing data, including, for example, programmable processors, computers, systems-on-a-chip, or a combination thereof. The apparatus may include special-purpose logic circuitry, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits). In addition to hardware, the apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or combinations thereof. The apparatus and execution environment can implement a variety of different computing model infrastructures, such as web services, distributed computing, and grid computing infrastructures.

[0239] A computer program (also known as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but does not need to, correspond to a file in a file system. A program may be stored as a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), as a single file dedicated to the program in question, or as multiple co-located files (e.g., a file storing one or more modules, subroutines, or code sections). A computer program can be deployed to execute on a single computer or on multiple computers located at a site or distributed across multiple sites and interconnected via a communication network.

[0240] The processes and logic flows described in this specification can be executed by one or more programmable processors that execute one or more computer programs to perform actions by manipulating input data and generating outputs. The processes and logic flows can also be executed by special-purpose logic circuitry, and the apparatus can be implemented as special-purpose logic circuitry, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits).

[0241] For example, processors suitable for executing computer programs include both general-purpose and special-purpose microprocessors. Typically, a processor receives instructions and data from read-only memory or random access memory, or both. The basic components of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include, or be operatively coupled to, one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, to receive data from or transfer data to, or both. However, a computer does not need to have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, personal digital assistant (PDA), mobile audio or video player, game console, GPS receiver, or portable storage device (e.g., a Universal Serial Bus (USB) flash drive), etc. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and storage devices, including, for example, semiconductor memory devices such as EPROM, EEPROM, and flash memory devices; disks such as internal hard disks or removable disks; magneto-optical disks; and CD-ROMs and DVD-ROMs. The processor and memory can be supplemented or incorporated by dedicated logic circuitry.

[0242] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, and a keyboard and pointing device, such as a mouse or trackball, that the user can use to provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual, auditory, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Furthermore, the computer can interact with the user by sending documents to and receiving documents from devices used by the user; for example, by sending a web page to a web browser on the user's client device in response to a request received from a web browser.

[0243] Embodiments of the subject matter described in this specification can be implemented in a computing system that includes backend components, such as a data server, or middleware components, such as an application server, or frontend components, such as a client computer with a graphical user interface or web browser through which a user can interact with embodiments of the subject matter described in this specification, or any combination of one or more such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication (e.g., a communication network) of any form or medium. Examples of communication networks include local area networks (“LANs”) and wide area networks (“WANs”), interconnected networks (e.g., the Internet) and peer-to-peer networks (e.g., self-organizing peer-to-peer networks).

[0244] A computing system may include clients and servers. Clients and servers are typically geographically separated and usually interact via a communication network. The client-server relationship arises from computer programs running on their respective computers and involves a client-server relationship. In some embodiments, the server transmits data (e.g., HTML pages) to a client device (e.g., to display data to a user interacting with the client device and to receive user input from that user). Data generated at the client device (e.g., the result of user interaction) can be received from the client device at the server.

[0245] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of what may be claimed, but rather as descriptions of features specific to particular embodiments of a particular invention. Certain features described in this specification in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments. Furthermore, although features may be described above as functioning in certain combinations, and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and the claimed combination may involve sub-combinations or variations thereof.

[0246] Similarly, although operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order or sequence shown, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0247] Therefore, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific order or sequence shown to achieve the desired result. In some embodiments, multitasking and parallel processing may be advantageous.

Claims

1. A computer-implemented method comprising: obtaining, by a first computer of a secure multi-party computation (MPC) system comprising a plurality of computers, at least a first share of a set of contextual attributes of an environment in which a selected digital component is to be displayed at a client device; for each digital component of a set of digital components: obtaining at least a first share of a qualification expression defining a relationship between a set of qualification criteria of the digital component; and determining, based on at least the first share of the set of contextual attributes and at least the first share of the qualification expression, at least a first share of a qualification parameter indicating whether the digital component is qualified for selection for display at the client device; performing, by the first computer in cooperation with one or more second computers of the secure MPC system, a secure MPC process to select a given digital component as the selected digital component from a set of qualified digital components comprising each digital component having a qualification parameter indicating that the digital component is qualified for selection; generating, as a result of the secure MPC process, a first share of a selection result identifying the selected digital component; and sending, by the first computer to the client device, the first share of the selection result, wherein: at least the first share of the set of contextual attributes comprises all of the set of contextual attributes; at least the first share of the qualification expression comprises an entirety of the qualification expression; and determining at least the first share of the qualification parameter indicating whether the digital component is qualified for selection comprises evaluating the qualification expression based on the set of contextual attributes in a sandboxed environment isolated from other code execution.

2. The computer-implemented method of claim 1, wherein obtaining at least a first share of the set of contextual attributes comprises receiving a first secret share of the set of contextual attributes from one of the client device or a content platform.

3. The computer-implemented method of claim 1, wherein determining at least a first share of the qualification parameter indicating whether the digital component is qualified for selection based on at least the first share of the set of contextual attributes and at least the first share of the qualification expression comprises performing a second secure MPC process in cooperation with the one or more second computers to determine the first secret share of the qualification parameter.

4. The computer-implemented method of claim 1, wherein: at least the first share of the set of qualification criteria of a particular digital component comprises a first secret share of an attribute vector of the particular digital component; the set of contextual attributes comprises a vector of the contextual attributes; the qualification expression of the particular digital component comprises a set intersection check; and determining at least the first share of the qualification parameter of the particular digital component comprises determining, using a second secure MPC process in cooperation with the one or more second computers of the secure MPC system, that there is an intersection between at least one element of the attribute vector of the particular digital component and at least one element of the vector of the contextual attributes. ​ ​ 5. The computer-implemented method of claim 4, wherein: the eligibility expression defines the attribute vector of the particular digital component as a block list in which the particular digital component is not eligible for selection when one or more elements of the attribute vector of the particular digital component match one or more corresponding elements of the vector of contextual attributes; and determining at least a first share of the eligibility parameter of the particular digital component comprises setting a value of at least a first share of the eligibility parameter to indicate that the particular digital component is not eligible for selection for display at the client device in response to determining that there is an intersection between at least one element of the attribute vector of the particular digital component and at least one element of the vector of contextual attributes.

6. The computer-implemented method of claim 4, wherein: the eligibility expression defines the attribute vector of the particular digital component as an enable list in which the particular digital component is eligible for selection when one or more elements of the attribute vector of the particular digital component match one or more corresponding elements of the vector of contextual attributes; and determining at least a first share of the eligibility parameter of the particular digital component comprises setting a value of at least a first share of the eligibility parameter to indicate that the particular digital component is eligible for selection for display at the client device in response to determining that there is an intersection between at least one element of the attribute vector of the particular digital component and at least one element of the vector of contextual attributes.

7. The computer-implemented method of claim 1, wherein: at least a first share of the eligibility criteria set of a particular digital component comprises a first secret share of a first Bloom filter that includes attributes of the particular digital component; the set of contextual attributes includes a second Bloom filter that includes the contextual attributes; the eligibility expression of the particular digital component includes a set intersection check; and determining at least a first share of the eligibility parameter of the particular digital component comprises determining, using a second secure MPC process that cooperates with the one or more second computers of the secure MPC system, that there is an intersection between at least one element of the first Bloom filter and at least one element of the second Bloom filter.

8. The computer-implemented method of claim 1, wherein the eligibility expression of a particular digital component includes a comparison between a given attribute of the digital component and a corresponding attribute of the set of contextual attributes.

9. The computer-implemented method of claim 1, wherein the eligibility expression of a particular digital component includes an equality test between a given attribute of the digital component and a corresponding attribute of the set of contextual attributes.

10. The computer-implemented method of claim 1, wherein the eligibility expression of a particular digital component includes a truth table that defines when the particular digital component is eligible for selection.

11. The computer-implemented method of claim 1, wherein the eligibility expression comprises a Boolean expression comprising two or more sub-expressions and a Boolean operator for each pair of sub-expressions.

12. The computer-implemented method of claim 11, wherein the two or more sub-expressions comprise two or more of: (i) a set intersection check, (ii) an equality test, and (iii) a comparison test.

13. The computer-implemented method of claim 1, wherein the set of contextual attributes comprises at least one of: (i) data about a resource with which a selected digital component is to be displayed, (ii) data about a user of the client device, (iii) data about an application in which the digital component is to be displayed, or (iv) data about the client device.

14. A system for selecting a digital component, comprising: one or more processors; and one or more storage devices storing instructions that, when executed by the one or more processors of a first computer, cause the one or more processors to perform operations comprising: obtaining, by a first computer of a secure multi-party computation (MPC) system comprising a plurality of computers, at least a first share of a set of contextual attributes of an environment in which a selected digital component is to be displayed at a client device; for each digital component in a set of digital components: obtaining at least a first share of an eligibility expression defining a relationship between a set of eligibility criteria for the digital component; and determining, based on at least the first share of the set of contextual attributes and at least the first share of the eligibility expression, at least a first share of an eligibility parameter indicating whether the digital component is eligible for selection for display at the client device; performing, by the first computer in cooperation with one or more second computers of the secure MPC system, a secure MPC process to select a given digital component from a set of eligible digital components as the selected digital component, the set of eligible digital components comprising each digital component having an eligibility parameter indicating that the digital component is eligible for selection; generating, as a result of the secure MPC process, a first share of a selection result identifying the selected digital component; and sending, by the first computer to the client device, the first share of the selection result, wherein: at least the first share of the set of contextual attributes comprises all of the set of contextual attributes; at least the first share of the eligibility expression comprises an entirety of the eligibility expression; and determining at least the first share of the eligibility parameter indicating whether the digital component is eligible for selection comprises evaluating the eligibility expression based on the set of contextual attributes in a sandboxed environment isolated from other code execution.

15. The system of claim 14, wherein obtaining at least a first share of the set of contextual attributes comprises receiving a first secret share of the set of contextual attributes from one of the client device or a content platform. ​ ​ 16. The system of claim 14, wherein determining at least a first share of the eligibility parameter that indicates whether the digital component is eligible for selection based on at least a first share of the set of contextual attributes and at least a first share of the eligibility expression comprises executing a second secure MPC process in cooperation with the one or more second computers to determine a first secret share of the eligibility parameter.

17. The system of claim 14, wherein: at least a first share of the set of eligibility criteria for a particular digital component comprises a first secret share of an attribute vector for the particular digital component; the set of contextual attributes comprises a vector of the contextual attributes; the eligibility expression for the particular digital component comprises a set intersection check; and determining at least a first share of the eligibility parameter for the particular digital component comprises using a second secure MPC process in cooperation with the one or more second computers of the secure MPC system to determine that there is an intersection between at least one element of the attribute vector for the particular digital component and at least one element of the vector of contextual attributes.

18. A non-transitory computer-readable storage medium carrying instructions that, when executed by one or more processors of a first computer, cause the one or more processors to perform operations comprising: obtaining, by a first computer of a secure multi-party computation (MPC) system that includes a plurality of computers, at least a first share of a set of contextual attributes of an environment in which a selected digital component is to be displayed at a client device; for each digital component in a set of digital components: obtaining at least a first share of an eligibility expression that defines a relationship between a set of eligibility criteria for the digital component; and determining at least a first share of an eligibility parameter that indicates whether the digital component is eligible for selection based on at least a first share of the set of contextual attributes and at least a first share of the eligibility expression; executing, by the first computer in cooperation with one or more second computers of the secure MPC system, a secure MPC process to select a given digital component as the selected digital component from a set of eligible digital components, the set of eligible digital components comprising each digital component that has an eligibility parameter that indicates that the digital component is eligible for selection; generating, as a result of the secure MPC process, a first share of a selection result that identifies the selected digital component; and sending, by the first computer to the client device, the first share of the selection result, wherein: at least a first share of the set of contextual attributes comprises all of the contextual attributes in the set of contextual attributes; at least a first share of the eligibility expression comprises an entirety of the eligibility expression; and determining at least a first share of the eligibility parameter that indicates whether the digital component is eligible for selection comprises evaluating the eligibility expression based on the set of contextual attributes in a sandbox environment that is isolated from other code execution. ​ ​

Images