Localized Cryptography for Privacy Preservation

Abstract

A method, system, and apparatus, including a computer program encoded on a computer storage medium, are described for preserving user privacy when selecting content. In some aspects, the method includes receiving a data element identifying a set of candidate digital components and, for each candidate digital component, a set of distribution parameters for the candidate digital component. For each candidate digital component, encrypted selection data for the candidate digital component is provided as input to a cryptanalysis application executing within a trusted hardware module of the client device. The encrypted selection data represents the set of distribution parameters for the candidate digital component and is encrypted using a zero-knowledge proof protocol. The cryptanalysis application is configured to determine a degree of match between the selection data and user attributes of a user of the client device.

Description

[Technical field]

[0001] This specification relates to cryptography and data security. [Background technology]

[0002] There are many cryptographic techniques to prevent unauthorized access to data. A zero-knowledge proof is a cryptographic protocol for heuristically proving that a party knows or has some information, without revealing anything about the information itself. For example, a zero-knowledge proof may allow one party to prove to another party that a proposition is true, without revealing any other information. Ring learning with errors (RLWE) is one example of a use of zero-knowledge proofs. Summary of the Invention [Means for solving the problem]

[0003] In general, one innovative aspect of the subject matter described herein can be embodied in a method that includes receiving a data element identifying a set of candidate digital components and, for each candidate digital component, a set of distribution parameters for the candidate digital component; providing, for each candidate digital component, encrypted selection data for the candidate digital component as an input to a cryptanalysis application running within a trusted hardware module of the client device, the encrypted selection data representing the set of distribution parameters for the candidate digital component and encrypted using a zero-knowledge proof protocol, the cryptanalysis application being configured to determine a degree of match between the selection data and user attributes of a user of the client device; receiving as an output of the cryptanalysis application an encrypted result indicative of a degree of match between the selection data and user attributes of the user, the encrypted result being encrypted using the zero-knowledge proof protocol; decrypting the encrypted result for each candidate digital component; selecting a given digital component from the candidate digital components based on the degree of match for each candidate digital component; and displaying the given digital component. Other embodiments of this aspect include corresponding systems, apparatus, and computer programs configured to perform the actions of the methods and encoded on computer storage devices.

[0004] Each of these and other implementations may optionally include one or more of the following features: In some aspects, a cryptographic analysis module determines the degree of match between the selection data and the user attributes by comparing each data item of the selection data with corresponding user attributes of the user. In some aspects, the selection data for each candidate digital component includes contextual data about the environment in which the selected digital component will be displayed.

[0005] In some aspects, the user attribute data is stored in a trusted hardware module, and the user attribute data is encrypted using a zero-knowledge proof protocol. In some aspects, the set of distribution parameters for each candidate digital component is encrypted using a zero-knowledge proof protocol.

[0006] In some aspects, the zero-knowledge proof protocol comprises a ring learning with errors protocol. In some aspects, selecting the given digital component from the candidate digital components based on a degree of match for each candidate digital component comprises selecting the given digital component based on a combination of a degree of match and a publisher amount for each candidate digital component.

[0007] The subject matter described herein can be implemented in certain embodiments to achieve one or more of the following advantages: By storing user data in a trusted hardware module of the user's device, or by using a trusted hardware module to control access to the user data, rather than sending the user data across a public network, such as the Internet, the security and privacy of the user data is protected, and such data can still be used to customize the content displayed to the user, thereby improving the user's experience when viewing digital content. Cryptographic techniques, such as zero-knowledge proofs and ring learning with errors, allow such user data to be used while preventing parties other than the user from accessing and gaining knowledge of any of the user's data. Cryptographic techniques, including zero-knowledge proofs and ring learning with errors, can also prevent the user from accessing and gaining knowledge of any of the content selection criteria used to implement the selection. By preventing the user from learning the details of the selection criteria, the user data can remain private on the user's device, but also prevent third parties from determining information about the selection criteria. For example, by performing content selection using these cryptographic techniques on a user's device in combination with storing candidate content on the user's device, latency and bandwidth consumption in displaying a certifiable digital component can be reduced compared to techniques that require such data to be transmitted to a remote server for content selection.

[0008] Reducing the latency in presenting content reduces the number of errors that occur at the user device while waiting for such content to be selected and / or arrive from a remote server. Because content often needs to be at the user device and ready to display on a mobile device connected by a wireless network within a few hundred milliseconds, reducing the latency in selecting and / or providing content is critical to prevent errors and reduce user frustration. In addition, reducing the need to transmit data reduces the amount of bandwidth consumed to transmit information, reduces the latency in transmitting information, and reduces the amount of processing power required to transmit information and the associated battery power of battery-operated devices (e.g., mobile devices). The cryptographic techniques described herein, coupled with storing user data and / or candidate content on the user device, provide the synergistic effects of improved data security, protected user privacy, and reduced latency in presenting content on the user device.

[0009] Various features and advantages of the foregoing subject matter are described below with reference to the drawings. Additional features and advantages will be apparent from the subject matter described hereinafter and in the claims. [Brief description of the drawings]

[0010] [Figure 1] 1 is a block diagram of an example environment in which a client device displays digital content. [Diagram 2] FIG. 1 is a swim lane diagram of an example process for selecting and displaying a digital component. [Diagram 3] FIG. 2 illustrates an example process for selecting and displaying a digital component. [Figure 4] FIG. 1 is a block diagram of an exemplary computer system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Like reference numbers and designations in the various drawings indicate like elements.

[0012] In general, this document describes systems and techniques for using cryptographic techniques to preserve user privacy in the process of selecting content to display to a user. The techniques described in this document enable such privacy preservation and data security while providing a digital component in a short period of time, e.g., within milliseconds, after a request is received. These techniques can include using zero-knowledge proofs to query whether delivery parameters of a digital component match attributes of a user (or the degree of match between delivery parameters and user attributes) without allowing any party other than the user to learn the user attributes. A content selection module can select a digital component to display based on the results of this process performed on multiple candidate digital components and, optionally, additional information.

[0013] 1 is a block diagram of an exemplary environment 100 in which client devices display digital content. The exemplary environment 100 includes a data communications network 105, such as a local area network (LAN), a wide area network (WAN), the Internet, a mobile network, or a combination thereof. The network 105 connects client devices 110, publishers 140, websites 142, and content management systems 150. The exemplary environment 100 may include many different client devices 110, publishers 140, websites 142, and content management systems 150.

[0014] A website 142 includes one or more electronic resources 145. A resource 145 may be associated with a domain name and may be hosted by one or more servers. An exemplary website is a collection of web pages formatted in HyperText Markup Language (HTML), which may contain text, images, multimedia content, and programming elements such as scripts. Each website 142 is maintained by a content publisher 140, which is an entity that controls, manages, and / or owns the website 142.

[0015] Resources 145 are any data that can be provided by publishers 140 over network 105 and associated with a resource address. Resources include HTML pages, word processing documents, and portable document format (PDF) documents, images, videos, and feed sources, to name just a few. Resources 145 can include content such as words, phrases, pictures, and may include embedded information (e.g., meta information and hyperlinks) and / or embedded instructions, such as scripts.

[0016] The client device 110 is an electronic device capable of communicating over the network 105. Exemplary client devices 110 include personal computers, mobile communication devices, such as smartphones, and other devices capable of sending and receiving data over the network 105. The client device 110 may also include a digital assistant device that receives audio input through a microphone and outputs audio output through a speaker. The digital assistant may be in a listen mode (e.g., ready to receive audio input) when the digital assistant detects a "hot word" or "hot phrase" that activates the microphone to receive audio input. The digital assistant device may also include a camera and / or a display to capture images and present information visually. The digital assistant may be implemented as a hardware device in various forms, including a wearable device (e.g., a watch or glasses), a smartphone, a speaker device, a tablet device, or another hardware device. The client device 110 may also include a digital media device, such as a streaming device that plugs into a television or other display to stream video to the television, gaming system, or virtual reality system.

[0017] The client device 110 typically includes applications 112, such as a web browser and / or native applications, to facilitate sending and receiving data over the network 105. A native application is an application developed for a particular platform or device, e.g., for a mobile device having a particular operating system. A publisher 140 may develop a native application and provide, e.g., make it available for download, to the client device 110. A web browser may request a resource 145 from a web server hosting a website 142 of the publisher 140, e.g., in response to a user of the client device 110 entering a resource address of the resource 145 in the address bar of the web browser or selecting a link that references the resource address. Similarly, a native application may request application content from a remote server of the publisher.

[0018] Some resources, application pages, or other application content may include a digital component slot for displaying the digital component with the resource 145 or application page. Throughout this document, the phrase "digital component" refers to a discrete unit of digital content or information (e.g., a video clip, an audio clip, a multimedia clip, an image, text, or another content unit). A digital component may be stored electronically in a physical memory device as a single file or as a collection of files, and may take the form of a video file, an audio file, a multimedia file, an image file, or a text file, and may also include advertising information, and thus an advertisement is a type of digital component. For example, a digital component may be content that is intended to complement the content of a web page, application content (e.g., an application page), or other resource displayed by the application 112. More specifically, a digital component may include digital content that is related to the resource content, for example, the digital component may relate to the same topic as the web page content or to a related topic. Thus, the provision of a digital component may complement and generally enhance the web page content or application content.

[0019] When an application 112 loads a resource (or application content) that includes one or more digital component slots, the application 112 can request a digital component for each slot. In some implementations, a digital component slot can include a tag or code, e.g., one or more scripts, that, once processed by the application 112, causes the application 112 to request the digital component for display to a user of the client device 110. As described below, the application 112 can request the digital components from the content management system 150 and / or the content selection module 114 of the client device 110.

[0020] The client device 110 includes a content selection module 114 and a trusted hardware module 116. The content selection module 114 is configured to select content, e.g., digital components, for display by the client device 110, e.g., for display by an application 112 executing on the client device 110. To select the digital components, the content selection module 114 can interact with a cryptographic analysis application 118 executing in the trusted hardware module 116. In some implementations, the content selection module 114 is part of the application 112, e.g., an application module of a web browser or a native application.

[0021] The trusted hardware module 116 is a secure hardware computing device, such as a microcontroller or processor, that performs cryptographic functions and / or executes applications and other functions within a secured environment using cryptographic techniques. The trusted hardware module 116 may take the form of an integrated circuit (IC), a plug-in card, or another hardware component that may be located on the client device 110 or otherwise part of the client device 110. Exemplary trusted hardware modules include a trusted platform module (TPM) and a hardware security module (HSM). The trusted hardware module 116 is typically tamper-resistant and includes protocols that limit access to applications running within the trusted hardware module 116.

[0022] The trusted hardware module 116 includes a cryptographic analysis application 118, a user attribute data store 120, and a content data store 122. The user attribute data store 120 is stored in the trusted hardware module 116, for example in encrypted form, to prevent unauthorized access to the user attributes stored in the user attribute data store. The content data store 122 can also be stored in the trusted hardware module 116 or in general data storage of the client device 110, depending on the desired data security level of the digital components and the delivery parameters for the digital components.

[0023] In some implementations, the operating system of the client device 110 controls access to the trusted hardware module 116. For example, the operating system may block access to the cryptoanalysis application 118 from any system or component other than the content selection module 114.

[0024] The user attribute data store 120, which may take the form of a database, table, or other suitable data structure, includes data identifying attributes of users of the client devices 110. The user attributes may include personally identifiable information about the users of the client devices 110, demographic information (e.g., age, gender, income range, etc.), and location information indicative of the location of the client devices 110. In some implementations, the user attributes may include information related to the activities of the user, such as information identifying websites visited by the user, topics of the websites, keywords obtained from the websites, and / or the user's particular user interactions with the websites. The user attributes stored in the user attribute data store 120 may include attributes that enable identification of characteristics consistent with a particular defined purpose, such as a use case for a particular product / service for which the digital component is intended.

[0025] Further to the discussion throughout this document, a user may be provided with controls (e.g., user interface elements with which the user can interact) that allow the user to make choices regarding both whether and when the systems, programs, or features described herein may enable collection of user information (e.g., information about the user's social network, social actions or activities, occupation, user preferences, or the user's current location) and whether the user is sent content or communications from the server. In addition, certain data may be handled in one or more ways such that personally identifiable information is removed before it is stored or used. For example, a user's identification information may be handled such that personally identifiable information cannot be identified for that user, or if location information is obtained, the user's geographic location may be generalized (such as to the city level, zip code level, or state level) such that the user's specific location cannot be identified. Thus, a user may be able to control what information is collected about the user, how that information is used, and what information is provided to the user.

[0026] The content data store 122, which may take the form of a database, table, or other suitable data structure, includes data related to the digital components. The data for a digital component may include, for example, the digital component itself (e.g., a data file containing the digital component), a resource locator indicating a network location where the digital component may be obtained, such as a Universal Resource Locator (URL) or Uniform Resource Identifier (URI), data identifying the digital component, and / or delivery parameters for the digital component. The delivery parameters for a digital component may include keywords and / or other values, such as target keywords, associated with the digital component, for example to indicate the context and environment in which the digital component should be presented and / or attributes of the users for whom the digital component should be presented. That is, the delivery parameters for a digital component may define a target profile of users and contexts for whom the digital component should be displayed. For example, the delivery parameters for a digital component related to football may include: gender: male, age: 18-35, location: United States, interests: sports, football, topic (or URL) of electronic resource: football or sports. In this example, the digital component is eligible for or more likely to be displayed to users having attributes that match these delivery parameters.

[0027] The data for the digital component may also include a quantity that the digital component publisher that issued the digital component is willing to provide to the electronic resource publisher if the electronic resource publisher displays the digital component on one of its electronic resources. This quantity may be referred to as a publisher quantity. In some implementations, the delivery parameters may include various values, each corresponding to a degree of match between the delivery parameters of the digital component and the user attributes of the user.

[0028] The content selection module 114 can request data for a digital component from the content management system 150 in response to a request initiated by a digital component slot of an electronic resource. In some implementations, the content selection module 114 can periodically request data for a digital component from the content management system 150 and store the data in the content data store 122. For example, the content selection module 114 can replace digital components that do not match the user attributes of the user or have a low level of match (e.g., below a specified threshold) with the user attributes of the user. In this example, the content selection module 114 can periodically select a specified number of digital components that have the lowest degree of match (or do not match), or each digital component that has a degree of match (or do not match) below a threshold, and remove data for the selected digital components from the content data store 122. The content selection module 114 can request data for additional digital components to replace the removed data. In some implementations, the content selection module 114 cannot provide the content management system 150 with data identifying the removed digital components. In this manner, content management system 150 will be unable to infer user attributes based on digital components that do not match the user attributes.

[0029] In some implementations, the quantity of the distribution parameters must meet or exceed a threshold quantity parameter to reduce the likelihood that a party may identify a user's attributes based on the degree of match between the distribution parameters and the user's attributes. For example, the threshold quantity can be 25, 50, 100, thousands, or another suitable quantity. The quantities of the user attributes can be of the same or similar magnitude.

[0030] Stages A-G show an exemplary data flow for selecting and displaying digital components. In stage A, the application 112 (or the content selection module 114) sends a request 161 for one or more digital components to the content management system 150. For example, the request 161 can indicate a quantity of requested digital components. If the request 161 is being sent to request digital components for an electronic resource that is or will be displayed by the client device 110, the quantity can be based on the quantity of digital component slots of the electronic resource. If the request 161 is to replace a digital component whose data was previously stored in the content data store 122, the quantity can be equal to or based on the quantity removed from the content data store 122. To send the request, the client device 110 can generate a packetized data request that includes a header and payload data.

[0031] In stage B, the content management system 150 selects one or more digital components from the digital content data storage unit 152 and provides a data element 162 containing data for each digital component. In this example, the data element 162 includes a number "N" of digital components and distribution parameters for each digital component. The data element 162 may also include, for each digital component, a publisher quantity that the provider of the digital component is willing to provide to the publisher of the electronic resource for displaying the digital component.

[0032] In some implementations, content management system 150 encrypts the data for each digital component before providing data elements 162 to client device 110. In some implementations, content management system 150 can encrypt the data for each digital component using a zero-knowledge proof protocol used by cryptanalysis application 118.

[0033] In stage C, the application 112 receives the data element 162 and provides the corresponding data element 163 to the content selection module 114. In other implementations, the content selection module 114, rather than the application 112, can receive the data element 162, for example when the content selection module 114 sends the request 161.

[0034] In stage D, the content selection module 114 interacts with the cryptography analysis application 118 to select a digital component for display with the electronic resource that is or will be displayed by the web browser application or with the content of the native application. The content selection module 114 can identify a set of candidate digital components from which to select the digital component. When a request 161 is sent to the content management system 150 for a current digital component presentation opportunity, the candidate digital components can include each digital component referenced by a data element 162. When data for a digital component is stored on the client device 110, the candidate digital components can include the digital component whose data is stored in the content selection module 114.

[0035] For each candidate digital component, the content selection module 114 provides the cryptographic analysis application 118 with selection data for the candidate digital component. The selection data may include delivery parameters for the candidate digital component. The selection data may also include contextual data related to the context of the environment in which the selected digital component is to be displayed. For example, the contextual data may include data related to the content of the electronic resource (e.g., web page) or native application with which the digital component is to be displayed, the number of digital component slots in the electronic resource or native application, the type of digital component slot (e.g., image or video), the presentation location of the digital component slot within the electronic resource or native application (e.g., top, left, right, bottom, above the fold, below the fold, etc.), the time of day, the day of the week, the date, the geographic location of the client device 110, etc. Data related to the content of the electronic resource or native application may include the topic of the resource / content, the title, keywords extracted from the resource / content, the resource locator (e.g., URL) of the resource, etc.

[0036] The content selection module 114 can submit a query to the cryptanalysis application 118 for each candidate digital component using a zero-knowledge proof protocol. The query can include selection data for the candidate digital component. A variety of zero-knowledge proof protocols can be used. For a zero-knowledge proof to be effective, it must satisfy three properties: completeness (if the assertion is true, the verifier is convinced of this fact by the prover), soundness (if the assertion is false, a cheating prover cannot convince the verifier that it is true, except with a small probability), and zero-knowledgeness (if the proposition is true, the verifier learns nothing other than the fact that the proposition is true).

[0037] In some implementations, the content selection module 114 and the cryptanalysis application 118 use ring learning with errors (RLWE) as a zero-knowledge proof protocol. RLWE is a quantum-robust cryptographic technique based on polynomial arithmetic with coefficients from finite fields.

[0038] 1, the content selection module 114 is the verifier and the cryptanalysis application 118 is the prover. With zero-knowledge proofs, the content selection module 114 cannot learn anything except whether or to what extent the delivery parameters of the digital component match the user attributes of the user.

[0039] The content selection module 114 encrypts the selection data for the candidate digital components, if it is not already encrypted, and provides a query 164 including the encrypted selection data to the cryptanalysis application 118. The cryptanalysis application 118 can compare the encrypted selection data for the candidate digital components with encrypted user attributes stored in the user attribute data store 120. The user attributes can also be encrypted using the same zero-knowledge proof protocol as the selection data for the candidate digital components.

[0040] Based on the comparison, the cryptoanalysis application 118 can determine whether the selection data for the digital component matches the user attributes of the user. In some implementations, the cryptoanalysis application 118 can output an encrypted value indicating whether the selection data for the digital component matches the user attributes of the user. For example, if all data items of the selection data match the corresponding user attributes or at least a specified threshold or a specified percentage of the delivery parameters match their corresponding user attributes, the output value can be "true" and "false" otherwise. In a particular example, for a candidate digital component, the output value can be "true" when at least 75% of the data items of the selection data match their corresponding user attributes.

[0041] In some implementations, the cryptoanalysis application 118 can determine the degree of match between the selection data for the candidate digital component and the user attributes. For example, the degree of match can be based on the percentage that the data items of the selection data match their corresponding user attributes, e.g., equal to or directly proportional to that percentage. In a particular example, if the gender and geographic location specified for the candidate digital component match the gender and geographic location of the user, but the topic of the electronic resource does not match any topic of interest, the degree of match can be 2 / 3 or 66.7%.

[0042] In some implementations, the user attributes can be weighted, for example, based on their importance in digital component selection. In this example, the cryptographic analysis application 118 can determine which data items of the selection data match their corresponding user attributes and determine an aggregate score based on an aggregation (e.g., a weighted sum or weighted average) of the weighted values ​​for the matching user attributes. The degree of match can be the aggregate score.

[0043] In stage E, the cryptoanalysis application 118 outputs encrypted result data 165 for each candidate digital component that indicates whether the selection data for the candidate digital component matches the user attributes of the user and / or the degree of match between the selection data and the user attributes. The cryptoanalysis application 118 provides the encrypted result data 165 to the content selection module 114.

[0044] In stage F, the content selection module 114 decrypts the encrypted results data 165 to obtain clear results data and selects a digital component from the candidate digital components based on at least the results data for each candidate digital component. For example, if the results data for the candidate digital components indicates whether the selection data for the digital component matches the user attributes of the user, the content selection module 114 may select a digital component from the candidate digital components whose selection data matches the user attributes of the user. In some implementations, the content selection module 114 may select a matching digital component with the corresponding highest publisher amount that a provider of the digital component is willing to provide to a publisher of the electronic resource or native application with which the selected digital component will be displayed.

[0045] If the results data for each candidate digital component indicates a degree of match between the selection data for the candidate digital component and the user attributes of the user, the content selection module 114 can select the digital component based on the degree of match and, optionally, the publisher volume for the digital component. As described above, the publisher volume for the digital component may differ based on the degree of match because a digital component provider may be willing to provide more publisher volume for displaying the digital component to users who match the target profile of the digital component.

[0046] In one example, the content selection module 114 can select the digital component with the highest degree of match or the highest publisher amount. In another example, the content selection module 114 can combine the degree of match with the publisher amount (e.g., by multiplying the two values) for each digital component and select the digital component with the largest product of values. In another example, the content selection module 114 can filter each digital component with a degree of match that is less than a specified threshold from the set of candidate digital components. The content selection module 114 can then select digital components from the remaining digital components based on their corresponding publisher amount, for example, by selecting the digital component with the largest publisher amount. The threshold can be a predetermined value or can be a value that corresponds to a particular digital component. For example, the content selection module 114 can rank the digital components based on the degree of match and set the threshold to the value of the 10th highest ranking (or another suitable ranking) digital component, such that the content selection module 114 selects from the top 10 matching digital components.

[0047] In some implementations, the content selection module 114 can use additional data in selecting a digital component. For example, the content selection module 114 can use expected performance metrics for the digital component, such as an expected user interaction rate.

[0048] The content selection module 114 provides digital component data 166 for the selected digital component to the application 112. The digital component data may include the digital component itself or may include a URL for the digital component so that the application 112 can download the digital component. In stage G, the application 112 then displays the selected digital component.

[0049] 2 shows a swim lane diagram of an example process 200 for selecting and displaying a digital component. The operations of process 200 may be implemented, for example, by application 112, content selection module 114, cryptographic analysis application 118, and content management system 150 of FIG. 1. The operations of process 200 may also be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, that when executed by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 200.

[0050] An application 112 sends a request for one or more digital components to a content management system (202). The application 112 can send the request based on electronic resources displayed by the application. In some implementations, the content selection module 114 sends the request to obtain data for the digital components to store on the client device 110, e.g., in a local cache of the client device 110.

[0051] The content management system 150 selects one or more digital components (204). The content management system 150 sends a data element including data for the digital components to the application 112 or to the content selection module 114 (206). As described above, the data for the digital components can include delivery parameters and publisher quantities that the provider of the digital component is willing to provide to the publisher for displaying the digital component with the publisher's electronic resources or native applications. In some implementations, the data for the digital components includes different publisher quantities or sets of publisher quantities that can be selected based on the degree of match between the selection data for the digital components and the user attributes of the user. The data for each digital component can be encrypted according to a zero-knowledge proof protocol used by the cryptoanalysis application 118.

[0052] The application 112 sends 208 a request to the content selection module 114 to select a digital component for display by the application 112. The request may include data elements received from the content management system 150.

[0053] The content selection module 114 sends 210 a request to the cryptoanalysis application 118 for a match analysis to be performed on each of a plurality of candidate digital components. As described above, the request, which may be in the form of a query, includes encrypted selection data for the candidate digital components. The selection data, which may include delivery parameters and contextual data for the digital components, may be encrypted using a zero-knowledge proof protocol used by the cryptoanalysis application 118.

[0054] The cryptanalysis application 118 determines whether the selection data matches user attributes of the user and / or determines the degree of match between the selection data and the user attributes (212). The cryptanalysis application 118 compares the encrypted selection data for the candidate digital component to the encrypted user attributes of the user of the client device 110, e.g., the user of the application 112, using a zero-knowledge proof protocol. As described above, the cryptanalysis application 118 can be executed within the trusted hardware module 116 and can perform cryptographic functions within the trusted hardware module 116.

[0055] The cryptoanalysis application 118 sends (214) a match indicator for each candidate digital component to the content selection module 114. The match indicator may be an encrypted result output by the cryptoanalysis application 118. The match indicator may indicate whether the selection data for the candidate digital components matches a user attribute of the user and / or the degree of match between the selection data for the candidate digital components.

[0056] The content selection module 114 selects (216) a digital component from the candidate digital components for display by the application 112. The content selection module 114 may decode a match indicator for each candidate digital component and select a digital component based at least in part on the match indicator. As described above, the content selection module 114 may select a digital component based on whether each candidate digital component matches a user attribute of the user (e.g., whether the selection data matches the user attribute), the degree of match for each candidate digital component, the publisher volume for each candidate digital component, and / or other data.

[0057] The content selection module 114 sends (218) data about the selected digital components to the application 112. This data may include the digital components themselves or resource locators for obtaining the selected digital components.

[0058] The application 112 displays 220 the selected digital component. The application 112 may display the digital component in a digital component slot of the electronic resource or in the native application.

[0059] The application 112 monitors (222) for user interaction with the displayed digital component. If a user interaction is detected, the application 112 can report the user interaction to the content management system 150 (224). In some implementations, the application 112 can interact with the cryptography application 118, for example via the content selection module 114, to encrypt a notification that includes data indicative of the user interaction. The application 112 can then send the encrypted notification to the content management system 150. Similarly, the application 112 can monitor for conversion events and send an encrypted notification of any detected conversion events.

[0060] In some implementations, the cryptanalysis application 118 encrypts the notification using a zero-knowledge proof protocol. In some implementations, the cryptanalysis application 118 encrypts the notification using an encryption key or signature based on the client device. However, using a device-specific key or signature may allow other entities to identify the user, such as a device identifier. Using zero-knowledge proofs ensures that the user's identity is hidden from observation.

[0061] Additionally, using the cryptographic analysis application 118 to encrypt notifications related to user interaction proves that the user was involved in the sequence of events. This is particularly important because it helps prevent attacks such as click fraud by providing proof of actual user interaction. Essentially, a challenge is presented that is verified by user interaction (a protected OS feature that cannot be interacted with via threads or other automated processes, but only from privileged input such as touching the screen).

[0062] Figure 3 is a diagram of an example process 300 for selecting and displaying a digital component. The operations of process 300 may be implemented, for example, by a client device, such as client device 110 of Figure 1. The operations of process 300 may also be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, that when executed by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 300.

[0063] A client device receives (302) data elements identifying one or more candidate digital components. The data elements may include data for each candidate digital component. The data for each candidate digital component may include the digital component itself, a resource locator for obtaining the candidate digital component, delivery parameters for each digital component, and a publisher amount that a provider of the candidate digital component is willing to provide to a publisher of an electronic resource for displaying the candidate digital component. The data for each digital component may be encrypted using a zero-knowledge proof protocol used by the cryptanalysis application.

[0064] For each digital component, the client device provides encrypted selection data as input to the cryptanalysis application (304). As described above, the cryptanalysis application may execute within a trusted hardware module of the client device. The encrypted selection data may represent a set of delivery parameters for the candidate digital components and may have been encrypted using a zero-knowledge proof protocol used by the cryptanalysis application. As described above, the selection data for the candidate digital components may also include contextual data about the environment in which the selected digital components will be displayed.

[0065] In some implementations, a client device receives a collection of delivery parameters for multiple digital components. The collection can be encrypted together, or the delivery parameters for each digital component can be encrypted separately from each other digital component. The content management system can select multiple digital components for inclusion in the collection based on a resource, such as a web page, requested by a user's client device. The client device provides the delivery parameters for the collection to a cryptographic analysis application for use in selecting digital components for display to the user at the client device.

[0066] The cryptoanalysis application is configured to determine a degree of match between the selection data and user attributes of a user of the client device. The user attributes may be stored within the trusted hardware module, as described above. The cryptoanalysis application may determine a degree of match between the selection data and the user attributes by comparing each data item of the selection data with a corresponding user attribute of the user.

[0067] For each candidate digital component, the client device (e.g., a content selection module of the client device) receives an encrypted result as an output of the cryptanalysis application indicating the degree of match between the selection data and the user attributes of the user (306). The encrypted result may be encrypted using a zero-knowledge proof protocol of the cryptanalysis application.

[0068] The client device decrypts the encrypted results for each candidate digital component 308. A content selection module on the client device can decrypt the encrypted results using a zero-knowledge proof protocol of the cryptanalytic application.

[0069] The client device selects 310 a given digital component from the candidate digital components based on the degree of match for each candidate digital component. As described above, a content selection module of the client device can select a digital component based on the degree of match for each candidate digital component and the publisher volume for each candidate digital component.

[0070] The client device displays the given digital component 312. For example, an application running on the client device can display the given digital component within a digital component slot of an electronic resource, such as a web page, being displayed by a display of the client device.

[0071] 4 is a block diagram of an exemplary computer system 400 that can be used to perform the operations described above. The system 400 includes a processor 410, a memory 420, a storage device 430, and an input / output device 440. Each of the components 410, 420, 430, and 440 can be interconnected using, for example, a system bus 450. The processor 410 is capable of processing instructions for execution within the system 400. In some implementations, the processor 410 is a single-threaded processor. In another implementation, the processor 410 is a multi-threaded processor. The processor 410 is capable of processing instructions stored in the memory 420 or on the storage device 430.

[0072] The memory 420 stores information within the system 400. In one implementation, the memory 420 is a computer-readable medium. In some implementations, the memory 420 is a volatile memory unit. In another implementation, the memory 420 is a non-volatile memory unit.

[0073] The storage device 430 can provide mass storage for the system 400. In some implementations, the storage device 430 is a computer-readable medium. In various different implementations, the storage device 430 can include, for example, a hard disk device, an optical disk device, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other large-capacity storage device.

[0074] The input / output device 440 enables input / output operations of the system 400. In some implementations, the input / output device 440 can include one or more of a network interface device, such as an Ethernet card, a serial communication device, such as an RS-232 port, and / or a wireless interface device, such as an 802.11 card. In another implementation, the input / output device can include a driver device configured to receive input data and send output data to an external device 460, such as a keyboard device, a printer device, and a display device. However, other implementations can be used, such as a mobile computing device, a mobile communication device, a set-top box, a television client device, etc.

[0075] Although an exemplary processing system has been described in FIG. 4, implementations of the subject matter and functional operations described herein can be implemented in other types of digital electronic circuitry, or in computer software, computer firmware, or computer hardware, including the structures disclosed herein and structural equivalents thereof, or in combinations of one or more of them.

[0076] The embodiments of the subject matter and operations described herein can be implemented as digital electronic circuitry, or as computer software, computer firmware, or computer hardware including the structures disclosed herein and their structural equivalents, or as a combination of one or more of them. The embodiments of the subject matter described herein can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions, encoded on a number of computer storage media (or a single computer storage medium) for execution by or for controlling the operation of a data processing apparatus. Alternatively or additionally, the program instructions can be encoded on an artificially generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal, that is generated to encode information so that it can be transmitted to an appropriate receiver device for execution by the data processing apparatus. The computer storage medium can be or be included in a computer-readable storage device, a computer-readable storage substrate, a random-access or serial-access memory array or device, or a combination of one or more of them. Additionally, although a computer storage medium is not a propagating signal, a computer storage medium may be a source or destination of computer program instructions encoded in an artificially-generated propagating signal. A computer storage medium may also be or be contained within one or more separate physical components or media (e.g., multiple CDs, disks, or other storage devices).

[0077] The operations described herein may be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0078] The term "data processing apparatus" encompasses any kind of apparatus, device, and machine for processing data, including, by way of example, a programmable processor, a computer, a system on a chip, or a plurality or combination of the foregoing. The apparatus may include special purpose logic circuitry, such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC). In addition to hardware, the apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting a processor firmware, a protocol stack, a database management system, an operating system, a cross-platform execution environment, a virtual machine, or a combination of one or more of these. The apparatus and execution environment may implement a variety of different computing model infrastructures, such as a web services infrastructure, a distributed computing infrastructure, and a grid computing infrastructure.

[0079] A computer program (also known as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted, declarative or procedural, and can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program can be stored within a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program, or in multiple linked files (e.g., a file containing one or more modules, subprograms, or portions of code). A computer program can be deployed to be executed on one computer or on multiple computers located at one site or distributed across multiple sites and interconnected by a communications network.

[0080] The processes and logic flows described herein may be implemented by one or more programmable processors executing one or more computer programs to perform actions by operating on input data and generating output. The processes and logic flows may also be implemented by, and an apparatus may be implemented as, special purpose logic circuitry, such as an FPGA (field programmable gate array) or ASIC (application specific integrated circuit).

[0081] Processors suitable for executing computer programs include, by way of example, both general-purpose and special-purpose microprocessors. Generally, a processor receives instructions and data from a read-only memory or a random access memory or both. The essential elements of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Generally, a computer also includes one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or is operatively coupled to receive data therefrom or transfer data thereto, or both. However, a computer need not have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), to name just a few. Suitable devices for storing computer program instructions and data include, by way of example, all forms of non-volatile memory, media, and memory devices, including semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.

[0082] To enable interaction with a user, the embodiments of the subject matter described herein can be implemented on a computer having a display device, such as a CRT (cathode ray tube) monitor or LCD (liquid crystal display) monitor, for displaying information to the user, and a keyboard and pointing device, such as a mouse or trackball, by which the user can provide input to the computer. Other types of devices can also be used to enable interaction with the user, for example, feedback provided to the user can be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback, and input from the user can be received in any form, including acoustic input, speech input, or tactile input. In addition, the computer can interact with the user by sending documents to and receiving documents from a device being used by the user, for example, by sending a web page to a web browser on the user's client device in response to a request received from the web browser.

[0083] The embodiments of the subject matter described herein may be implemented in a computing system that includes a back-end component, e.g., as a data server, or includes a middleware component, e.g., an application server, or includes a front-end component, e.g., a client computer having a graphical user interface or a web browser through which a user can interact with an implementation of the subject matter described herein, or includes any combination of one or more such back-end, middleware, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication, e.g., a communications network. Examples of communications networks include local area networks ("LANs") and wide area networks ("WANs"), internetworks (e.g., the Internet), and peer-to-peer networks (e.g., ad-hoc peer-to-peer networks).

[0084] A computing system may include clients and servers. Clients and servers are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. In some embodiments, a server sends data (e.g., HTML pages) to the client devices (e.g., for the purpose of displaying the data to and receiving user input from a user interacting with the client device). Data generated at the client device (e.g., a result of user interaction) can be received at the server from the client device.

[0085] Although this specification contains many specific details of implementations, these should not be construed as limitations on the scope of any invention or what may be claimed, but rather as descriptions of features specific to certain embodiments of a particular invention. Certain features described in the context of separate embodiments herein can also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination. Furthermore, although features may be described above as acting in a certain combination, or even initially claimed as such, one or more features from a claimed combination may, in some cases, be deleted from the combination, and the claimed combination may be directed to a subcombination or a variation of the subcombination.

[0086] Similarly, although operations are depicted in a particular order in the figures, this should not be understood as requiring that such operations be performed in the particular order or sequence depicted, or that all of the operations depicted be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the program components and systems described herein may generally be integrated together in a single software product or packaged in multiple software products.

[0087] Specific embodiments of the present subject matter have been described above. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequence, to achieve desirable results. In certain implementations, multitasking and parallel processing may be advantageous. [Explanation of symbols]

[0088] 100 Environment 105 Data Communication Network 110 Client Devices 112 Applications 114 Content Selection Module 116 Trusted Hardware Module 118 Cryptanalysis Applications 120 User Attribute Data Store 122 Content Data Store 140 Content Publishers 142 websites 145 Electronic Resources 150 Content Management Systems 152 Digital content data storage unit 161 Request 162 Data Elements 163 Data Elements 164 queries 165 Encrypted result data 166 Digital Component Data 200 processes 300 processes 400 Computer Systems 410 Processors, Components 420 Memory, Components 430 Storage devices, components 440 Input / Output Devices, Components 450 System Bus 460 External Devices

Claims

1. A computer-implemented method implemented on a client device, comprising: receiving a data element identifying a set of candidate digital components and, for each candidate digital component, a set of delivery parameters for said candidate digital component corresponding to a request, said request indicating a quantity of digital components requested; For each candidate digital component: providing encrypted selection data for the candidate digital components as input to a cryptanalysis application executing within a trusted hardware module of a client device, the encrypted selection data representing the set of delivery parameters for the candidate digital components and encrypted using a ring learning with errors technique, the cryptanalysis application being configured to determine a degree of match between the selection data and user attributes of a user of the client device; receiving, as an output of the cryptanalysis application, an encrypted result indicative of the degree of match between the selection data and the user attributes of the user, the encrypted result being encrypted using the ring learning with errors method; decrypting the encrypted result for each candidate digital component; selecting a given digital component from the candidate digital components based on the degree of match for each candidate digital component; displaying the given digital component; 23. A computer-implemented method comprising:

2. 2. The computer-implemented method of claim 1, wherein the cryptoanalysis application determines the degree of match between the selected data and user attributes by comparing each data item of the selected data with a corresponding user attribute of the user.

3. 3. The computer-implemented method of claim 1, wherein the selection data for each candidate digital component comprises contextual data about an environment in which the selected digital component is to be displayed.

4. 4. The computer-implemented method of claim 1, wherein data indicative of user attributes is stored within the trusted hardware module, and wherein the data indicative of user attributes is encrypted using the ring learning with errors method.

5. 5. The computer-implemented method of claim 1, wherein the set of distribution parameters for each candidate digital component is encrypted using the ring learning with errors method.

6. The computer-implemented method of claim 1, wherein the step of selecting the given digital component from the candidate digital components based on the degree of match for each candidate digital component includes the step of selecting the given digital component for each candidate digital component based on a combination of the degree of match and publisher volume.

7. one or more processors; one or more storage devices for storing instructions that, when executed by the one or more processors, cause the one or more processors to perform the method of any one of claims 1 to 6; A system comprising:

8. 7. A computer readable storage medium carrying instructions that, when executed by one or more processors, cause the one or more processors to perform the method of any one of claims 1 to 6.

9. A computer program comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 6.

Images