Cryptographically Secure Control Using Secure Multiparty Computation

Abstract

This specification describes systems and techniques for using secure MPC to select digital components in a manner that preserves user privacy and protects the security of the data of each party involved in the selection process. In one aspect, a method includes obtaining, by a first computer of a secure multi-party computing (MPC) system, at least a first share of a set of contextual characteristics of an environment in which the selected digital component will be displayed at a client device. For each digital component in the set of digital components, at least a first share of an eligibility formula is obtained, the first share of the eligibility parameter defining a relationship between a set of eligibility criteria for the digital component. A first share of an eligibility parameter is determined based on the at least a first share of the set of contextual characteristics and the at least a first share of the eligibility formula.

Description

[Technical field]

[0001] This specification relates to cryptography and data security. [Background technology]

[0002] Secure multi-party computation (MPC) is a family of cryptographic protocols that prevent access to data by distributing computation across multiple parties, such that outputs are issued only to designated parties, while at the same time preventing any individual party from accessing another party's data or intermediate computations. MPC computation systems typically perform computations using secret shares or other encrypted forms of data and secure exchange of information between the parties. Summary of the Invention [Means for solving the problem]

[0003] In general, one innovative aspect of the subject matter described herein includes obtaining, by a first computer of a secure multi-party computing (MPC) system including a plurality of computers, at least a first share of a set of contextual properties of an environment in which a selected digital component is displayed at a client device; and, for each digital component in the set of digital components, obtaining an eligibility formula defining a relationship between a set of eligibility criteria for the digital components. The present invention may be embodied in a method comprising obtaining at least a first share of a set of context characteristics (a first share of a context characteristic set) based on the at least a first share of the eligibility expression, determining at least a first share of an eligibility parameter indicating whether the digital component is eligible for selection for display at the client device based on the at least a first share of the set of context characteristics and the at least a first share of the eligibility expression, executing by the first computer in cooperation with one or more second computers of the secure MPC system a secure MPC process to select as a selected digital component a given digital component from a set of eligible digital components including each digital component having an eligibility parameter indicating that the digital component is eligible for selection, generating as a result of the secure MPC process a first share of a selection result identifying the selected digital component, and transmitting by the first computer to the client device the first share of the selection result. Other implementations of this aspect include corresponding apparatuses, systems, and computer programs configured to perform aspects of the method encoded in computer storage devices.

[0004] These and other implementations may each optionally include one or more of the following features: In some aspects, obtaining at least a first share of the set of contextual features includes receiving a first secret share of the set of contextual features from one of the client device or the content platform.

[0005] In some aspects, the at least a first share of the set of context characteristics includes all of the context characteristics in the set of context characteristics, and the at least a first share of the eligibility expression includes an entirety of the eligibility expression, and the step of determining the at least a first share of the eligibility parameter indicating whether the digital component is eligible for selection includes evaluating the eligibility expression based on the set of context characteristics within a sandbox environment isolated from the execution of other code.

[0006] In some aspects, the step of determining at least a first share of an eligibility parameter indicating whether the digital component is eligible for selection based on at least a first share of the set of context characteristics and at least a first share of the eligibility formula includes executing a second secure MPC process in cooperation with one or more second computers to determine a first secret share of the eligibility parameter.

[0007] In some aspects, at least a first share of the set of eligibility criteria for the particular digital component includes a first secret share of a vector of characteristics of the particular digital component, the set of context characteristics includes a vector of context characteristics, and the eligibility formula for the particular digital component includes a set intersection check, and the step of determining at least a first share of the eligibility parameters for the particular digital component includes determining, using a second secure MPC process in cooperation with one or more second computers of the secure MPC system, that an intersection exists between at least one element of the vector of characteristics of the particular digital component and at least one element of the vector of context characteristics.

[0008] In some aspects, the eligibility equation defines a vector of characteristics of the particular digital component as a block list in which the particular digital component is ineligible for selection when one or more elements of the vector of characteristics of the particular digital component match one or more corresponding elements of the vector of context characteristics, and the step of determining at least a first share of the eligibility parameter for the particular digital component includes setting a value of the at least a first share of the eligibility parameter to indicate that the particular digital component is ineligible for selection for display at the client device in response to a determination that an intersection exists between at least one element of the vector of characteristics of the particular digital component and at least one element of the vector of context characteristics.

[0009] In some aspects, the eligibility equation defines a vector of characteristics of the particular digital component as an enabled list in which the particular digital component is eligible for selection when one or more elements of the vector of characteristics of the particular digital component match one or more corresponding elements of the vector of context characteristics, and the step of determining at least a first share of the eligibility parameter of the particular digital component includes setting a value of the at least a first share of the eligibility parameter to indicate that the particular digital component is eligible for selection for display at the client device in response to a determination that an intersection exists between at least one element of the vector of characteristics of the particular digital component and at least one element of the vector of context characteristics.

[0010] In some aspects, at least a first share of the set of eligibility criteria for the particular digital component includes a first secret share of a first Bloom filter including characteristics of the particular digital component, the set of context characteristics includes a second Bloom filter including the context characteristics, and the eligibility formula for the particular digital component includes a set intersection check, and the step of determining at least a first share of the eligibility parameters for the particular digital component includes using a second secure MPC process in cooperation with one or more second computers of the secure MPC system to determine that an intersection exists between at least one element of the first Bloom filter and at least one element of the second Bloom filter.

[0011] In some aspects, the eligibility formula for a particular digital component includes a comparison between a given characteristic of the digital component and a corresponding characteristic of the set of context characteristics. In some aspects, the eligibility formula for a particular digital component includes an equivalence test between a given characteristic of the digital component and a corresponding characteristic of the set of context characteristics.

[0012] In some embodiments, the eligibility expression for a particular digital component includes a truth table that defines when the particular digital component is eligible for selection. In some embodiments, the eligibility expression includes a Boolean expression that includes two or more sub-expressions and a Boolean operator for each pair of the sub-expressions. The two or more sub-expressions may include two or more of: (i) a set intersection check, (ii) an equality test, and (iii) a comparison test.

[0013] In some aspects, the set of context characteristics includes at least one of: (i) data about a resource on which the selected digital component is displayed, (ii) data about a user of the client device, (iii) data about an application on which the digital component is displayed, or (iv) data about the client device.

[0014] The subject matter described herein may be implemented in certain embodiments to achieve one or more of the following advantages: Using a secure MPC process executed by two or more computers of a secure MPC system operated by different parties to select a digital component based on a share of user information ensures that the user information cannot be accessed in the clear by either the MPC computer or another party unless there is unauthorized collusion between the MPC computers. In this manner, user data privacy is preserved as long as at least one MPC server is impartial. The secure MPC process may also use the share of information received from the content platform in the digital component selection to preserve confidentiality of the content platform's information such that the information cannot be accessed by either the MPC computer or another entity that obtains the share of the information in some manner.

[0015] In the digital component selection process, the MPC server can select from eligible digital components that meet one or more eligibility conditions while preventing the party from accessing user information in plaintext. Eligibility conditions can include constraints and guidelines on the manner or frequency of delivery of the digital components, among other factors. Conditions can include user group membership, frequency control, muting (e.g., user blocking), k-anonymity to prevent micro-targeting of users, and / or pacing and budget constraints.

[0016] Another exemplary eligibility condition relates to the context in which the digital component is presented, e.g., the resource in which the digital component is displayed, the geographic location of the client device displaying the digital component, and the language settings of the application (e.g., browser) displaying the digital component. Digital component providers can also specify the contexts in which their digital components may and / or may not be displayed. Similarly, resource publishers can specify the features of the digital components that may or may not be displayed with their resources. Rather than using a cache search key that considers all possible combinations of characteristics that may be used to identify eligible digital components for each digital component display opportunity with its associated context, the digital component criteria may be defined using a formula that can be evaluated by the MPC computer with a secret share, for example, using a secure MPC process. In this way, the amount of data stored by the MPC computer is reduced compared to the use of a large cache search key. This also increases the flexibility of publishers' and digital component providers' control of the display of digital components without increasing the data storage requirements of the MPC computer, which allows the MPC computer to store more digital components, information about the digital components, and / or other related information in a high-speed memory, e.g., a high-speed cache.

[0017] Because the selection of digital components is an online process that typically occurs while the content is loading at the client device, it is important that this process is completed quickly, e.g., within a few milliseconds. The techniques described herein enhance the speed at which digital components are selected by reducing the size of data transmitted between the client device and the MPC cluster, by reducing the computational resources required by the MPC cluster, and by reducing the number of round-trip communications performed by the servers of the MPC cluster and the size of the data transmitted between the servers. Reducing the data size between the client device and the server also reduces network bandwidth consumption and the battery consumption of the client device, e.g., when the client device is a mobile device that operates on battery power.

[0018] The MPC cluster can transmit a resulting secret share that identifies the selected digital components that the MPC cluster selected using the secure MPC process. Sending the resulting secret share for only the selected digital components, rather than information for all or a large set of the digital components, similarly reduces latency and consumed bandwidth, processing power, and battery power in transmitting and receiving the results. This also reduces potential leakage of confidential information of the content platform submitting the selection values ​​for the digital components to the MPC cluster, by limiting the number of digital components for which information is provided to the client device.

[0019] Reducing latency in content presentation also reduces the number of errors that occur at user devices while waiting for such content to arrive. Because content must often be provided within milliseconds to mobile devices connected by wireless networks, reducing the latency in selecting and providing content is important to prevent errors and reduce user frustration.

[0020] The details of one or more embodiments of the subject matter described herein are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the subject matter will become apparent from the description, drawings, and claims. [Brief description of the drawings]

[0021] [Figure 1] FIG. 1 is a block diagram of an environment in which an MPC cluster executes a secure MPC process to select digital components for delivery to client devices. [Diagram 2] FIG. 2 illustrates an exemplary data flow within the environment of FIG. 1. [Diagram 3] FIG. 1 illustrates an example process for selecting a digital component for delivery to a client device. [Figure 4] FIG. 1 illustrates an example process for selecting a digital component for delivery to a client device. [Diagram 5] FIG. 1 illustrates an example process for determining whether a digital component is eligible for selection. [Figure 6] FIG. 1 illustrates an example process for selecting a digital component for delivery to a client device. [Figure 7] FIG. 1 is a block diagram of an exemplary computer system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] Like reference numbers and designations in the various drawings indicate like elements.

[0023] Generally, this specification describes systems and techniques for using cryptography, secret sharing, and secure MPC to select a digital component in a manner that preserves user privacy and protects the security of the data of each party involved in the selection process. The techniques described herein enable such privacy preservation and data security while minimizing the size of data transmitted to and from a client device that displays the digital component, while still providing the digital component within a short period of time, such as within milliseconds after a request is received. The techniques also provide flexibility and security for rules and other data specified by the content platform and / or digital component provider to control the environment in which the digital component is displayed and which digital components are displayed with particular electronic resources, e.g., web pages and / or native application content.

[0024] 1 is a block diagram of an environment 100 in which an MPC cluster 130 executes a secure MPC process to select digital components for delivery to client devices 110. The exemplary environment 100 includes a data communications network 105, such as a local area network (LAN), a wide area network (WAN), the Internet, a mobile network, or a combination thereof. The network 105 connects the client devices 110, the secure MPC cluster 130, publishers 140, websites 142, content platforms, e.g., a supply-side platform (SSP) 170, and a demand-side platform (DSP) 150. The exemplary environment 100 may include many different client devices 110, secure MPC clusters 130, publishers 140, websites 142, DSPs 150, and SSPs 170.

[0025] A website 142 contains one or more electronic resources 145. A resource 145 is associated with a resource identifier that is unique within a domain, such as a domain name, path, etc., and may be hosted by one or more servers. An exemplary website is a collection of web pages formatted in HyperText Markup Language (HTML), which may contain text, images, multimedia content, and programming elements such as scripts. Each website 142 is maintained by a content publisher 140, which is an entity that controls, manages, and / or owns the website 142.

[0026] Resources 145 are any data that can be provided by publishers 140 over network 105 and associated with a resource address. Resources include HTML pages, word processing documents, and portable document format (PDF) documents, images, videos, and feed sources, to name just a few examples. Resources 145 can include content such as words, phrases, pictures, etc., and may include embedded information (e.g., metadata information and hyperlinks) and / or embedded instructions, such as, for example, scripts.

[0027] The client device 110 is an electronic device capable of communicating over the network 105. Exemplary client devices 110 include personal computers, mobile communication devices, e.g., smartphones, and other devices capable of sending and receiving data over the network 105. The client device 110 can also include a digital assistant device that accepts audio input through a microphone and outputs audio output through a speaker. When the digital assistant detects a "hot word" or "hot phrase" that activates the microphone to accept audio input, the digital assistant can enter a listening mode (e.g., ready to accept audio input). The digital assistant device can also include a camera and / or a display for capturing images and visually presenting information. The digital assistant can be implemented in different forms of hardware devices, including a wearable device (e.g., a watch or glasses), a smartphone, a speaker device, a tablet device, or another hardware device. The client device 110 can also include a digital media device, e.g., a streaming device that plugs into a television or other display to stream video to the television, a gaming system, or a virtual reality system.

[0028] The client device 110 typically includes applications 112, such as a web browser and / or native applications, to facilitate sending and receiving data over the network 105. A native application is an application developed for a particular platform or device, e.g., for a mobile device having a particular operating system. A publisher 140 can develop a native application and provide, e.g., make available for download, to the client device 110. A web browser can request a resource 145 from a web server hosting a website 142 of the publisher 140, e.g., in response to a user of the client device 110 entering a resource address for the resource 145 in the address bar of the web browser or selecting a link that references a resource address. Similarly, a native application can request application content from a remote server of the publisher.

[0029] Some resources, application pages, or other application content may include a digital component slot for displaying the digital component along with the resource 145 or application page. As used throughout this specification, the phrase "digital component" refers to a separate unit of digital content or information (e.g., a video clip, an audio clip, a multimedia clip, an image, text, or another unit of content). A digital component may be stored electronically in a physical memory device as a single file or as a collection of files, and the digital component may take the form of a video file, an audio file, a multimedia file, an image file, or a text file, and may include advertising information, and thus an advertisement is a type of digital component. For example, a digital component may be content intended to supplement the content of a web page, application content (e.g., an application page), or other resource displayed by the application 112. More specifically, a digital component may include digital content related to the resource content, for example, the digital component may relate to the same topic as the web page content, or to a related topic. Thus, provisioning of a digital component may supplement and generally enhance the web page or application content.

[0030] When an application 112 loads a resource (or application content) that includes one or more digital component slots, the application 112 can request a digital component for each slot. In some implementations, a digital component slot may include code, e.g., one or more scripts, that, when processed by the application 112, causes the application 112 to request the digital component for display to a user of the client device 110. As described below, the application 112 can request the digital component from the MPC cluster 130 and / or one or more SSPs 170.

[0031] Some publishers 140 use an SSP 170 to manage the process of acquiring digital components for digital component slots of their resources 145 and / or applications 112. An SSP 170 is a technology platform implemented in hardware and / or software that automates the process of acquiring digital components for resources and / or applications. Each publisher 140 can have a corresponding SSP 170 or multiple SSPs 170. Several publishers 140 may use the same SSP 170.

[0032] Digital component providers 160 can create (or otherwise publish) digital components that appear in publisher resources 145 and digital component slots of applications 112. For example, digital component providers 160 can create digital components that include content related to the digital component provider 160. In a particular example, a digital component of a product manufacturer can include content related to the product.

[0033] A digital component provider 160 can use DSP 150 to manage the provisioning of its digital components for display in a digital component slot. DSP 150 is a technology platform implemented in hardware and / or software that automates the process of delivering digital components for display in resources and / or applications. DSP 150 can interact with multiple SSPs 170 on behalf of digital component provider 160 to provide digital components for display in resources 145 and / or applications 112 of multiple different publishers 140. In general, DSP 150 can receive requests for digital components (e.g., from SSP 170) and, based on the request, generate (or select) selection values ​​for one or more digital components created by one or more digital component providers 160 and provide data related to the digital components (e.g., the digital components themselves or creative elements including code that allows the digital components to be downloaded) and the selection values ​​to SSP 170. The selection value can be the amount that digital component provider 160 is willing to provide for display of or user interaction with the digital component. SSP 170 may then select a digital component for display on client device 110 and provide client device 110 with data that causes client device 110 to display the digital component, e.g., by providing the digital component or code that enables download of the digital component. As described in more detail below, MPC cluster 130 may select digital components for client device 110 to display in a manner that preserves user privacy.

[0034] In some cases, it is beneficial for a user to receive digital components related to web pages, application pages, or other electronic resources that the user has previously visited and / or interacted with. To deliver such digital components to the user, the user may be assigned to a user group, e.g., a user interest group, a cohort of similar users (e.g., who performed similar actions or visited similar electronic resources), or other group types involving similar user data. For example, a user may be added to a user group when the user visits a particular resource or performs a particular action in the resource (e.g., interacts with a particular item displayed on a web page or adds an item to a virtual cart). User groups may be generated and updated by the digital component provider 160. That is, each digital component provider 160 may assign users to the digital component provider's 160 user groups when the users visit the digital component provider's 160 electronic resources. User groups may also be created and / or updated by the content platform, e.g., by the DSP 150 and / or the SSP 170.

[0035] To protect user privacy, a user's group membership may be maintained at the user's client device 110 by, for example, one of the applications 112, the operating system of the client device 110, or another trusted program, rather than by the digital component provider, the content platform, or other party. In a particular example, a trusted program (e.g., a web browser or an operating system) may maintain a list of user group identifiers ("user group list") for a user using a web browser or another application (e.g., for a user logged into the browser, application, or client device 110). The user group list may include a user group identifier for each user group that includes the user as a member. The digital component provider 160 or the content platform that creates user groups may specify user group identifiers for those user groups. The user group identifiers for a user group may be descriptive of the group (e.g., a gardening group) or a code that represents the group (e.g., a non-descriptive alphanumeric sequence). The user group list for a user may be stored in secure storage at the client device 110 and / or may be encrypted when stored to prevent others from accessing the list.

[0036] When an application 112 displays a resource (e.g., a web page), application content, or digital component related to a digital component provider 160, the resource, application content, or digital component may request that the application 112 add one or more user group identifiers to a user group list. In response, the application 112 may add the one or more user group identifiers to the user group list, and may securely store the user group list. For example, a web page where a user selects to view more information about a particular item may add the user to a user group associated with that particular item.

[0037] In some embodiments, the MPC cluster 130 can use the user's user group membership to select digital components that may be of interest to the user or may otherwise be beneficial to the user / user device. For example, such digital components or other content may include data that improves the user experience, improves the performance of the user device, or benefits the user or client device 110 in some other way. However, the user group identifier of the user's user group list may be provided and used to select the digital components in a manner that prevents the computational systems MPC1 and MPC2 of the MPC cluster 130 from accessing the user group identifier for the user in the clear, thereby preserving user privacy when using user group membership data to select the digital components. The MPC cluster 130 can also use other criteria to select the digital components, as described in more detail below. Clear text is text that is not computationally tagged, formatted in a special way, or written in code, or data in a form that can be seen or used without the need for a key or other decryption device or other decryption process, including binary files.

[0038] The exemplary secure MPC cluster 130 includes two computing systems MPC1 and MPC2 that execute a secure MPC process to select digital components for delivery to a user's client device, for example, based on a user's group membership and / or contextual data (e.g., contextual characteristics of the environment in which the selected digital components are displayed), but without access to the clear text group membership, contextual data, or other user information, or signals derived from such user information. Although the exemplary MPC cluster 130 includes two computing systems, more computing systems may be used, so long as the MPC cluster 130 includes more than two computing systems. For example, the MPC cluster 130 may include three computing systems, four computing systems, or another suitable number of computing systems. Using more computing systems in the MPC cluster 130 may provide more security, but may also increase the complexity of the MPC process. Each computing system MPC1 and MPC2 may be a server or other suitable type of computer.

[0039] The computing systems MPC1 and MPC2 may be operated by different entities. In this way, each entity may not have access in the clear to the user's group membership or other user information, or signals derived from such user information. For example, one of the computing systems MPC1 or MPC2 may be operated by a trusted party different from the user, the publisher 140, the DSP 150, the SSP 170, and the digital component provider 160. For example, an industry group, a government group, or a browser developer may maintain and operate one of the computing systems MPC1 and MPC2. Other computing systems may be operated by different ones of these groups, such that different trusted parties operate each computing system MPC1 and MPC2. Advantageously, the different parties operating the different computing systems MPC1 and MPC2 may not have an incentive to collude to compromise user privacy. In some implementations, the computing systems MPC1 and MPC2 are architecturally separated and monitored to not communicate with each other outside of running the secure MPC process described herein.

[0040] Each computing system MPC1 and MPC2 can store digital components (e.g., creations of digital components), selection values ​​of the digital components, and other information of the digital components. For example, computing systems MPC1 and MPC2 can cache selection values ​​that have been previously received from SSP 170 and / or DSP 150 as part of a previous digital component selection process, or that have been provided to computing systems MPC1 and MPC2 in other manners, e.g., previously provided for use in the digital component selection process. In this manner, MPC cluster 130 can use the selection values ​​to select digital components for delivery to client device 110 in response to future digital component requests received from client device 110.

[0041] Digital components for which selection values ​​and other information are stored by the MPC cluster 130 for the digital component selection process may be referred to herein as stored digital components. However, the digital components themselves are not necessarily stored by the MPC cluster 130. Instead, the MPC cluster 130 may store data, such as, for each stored digital component, that references a network location from which the digital component can be downloaded. In some implementations, the digital component itself is stored and returned directly to the application 112 by the MPC cluster 130. Such implementations reduce the need for the application 112 to fetch the digital component and / or other information of the digital component in an additional request that may consume device battery and bandwidth and may leak additional signals for the server hosting the digital component itself to track the device.

[0042] For each stored digital component, each computing system MPC1 and MPC2 can store a selection value or a vector of values ​​that can be used by the computing systems MPC1 and MPC2 to determine the selection value of the digital component. The selection value of the digital component can be based on the context in which the digital component is displayed. For example, the digital component provider 160 may give the digital component a higher selection value, for example, if the digital component is related to a particular topic, so that it is displayed on resources related to the particular topic (e.g., web pages related to travel) than with respect to other topics. As another example, the digital component provider 160 may give the digital component a higher selection value so that it is displayed to users with particular characteristics, interests, intents, previous interactions with the digital component, etc. Thus, the DSP 150 can provide the computing systems MPC1 and MPC2 with multiple selection values ​​(or multiple selection value vectors) of a given digital component, with each selection value or vector being for a different combination of context and user characteristics.

[0043] Each selection value or vector and its corresponding digital component may be referred to as a digital component selection item. A digital component selection item may include the digital component itself, the selection value or vector, information about the digital component (e.g., metadata for the digital component), an eligibility expression that defines relationships between a set of eligibility criteria, and / or condition data.

[0044] The eligibility expression is used to determine whether a digital component selection item is eligible for delivery to the client device 110 based on the context in which the digital component is displayed at the client device 110. Eligibility criteria are criteria for the eligibility expression. The eligibility expression can be in the form of a Boolean expression including multiple sub-expressions and Boolean operators between the sub-expressions. An exemplary eligibility expression can be as follows: URL = example.com AND Location = United States. The DSP 150 can provide the computing systems MPC1 and MPC2 with the eligibility expression of the digital component and the corresponding selection value (or data such as one or more vectors that can be used to determine the selection value) as, for example, part of the digital component selection item. Exemplary eligibility expressions, eligibility criteria, and techniques for evaluating eligibility expressions are described below.

[0045] The condition data of a digital component selection item defines the conditions that must be met for the digital component selection item (and thus the digital components and selection values ​​of the selection item) to be a candidate for a given digital component selection process. A stored digital component may have zero or more corresponding conditions. In some implementations, to be a candidate for selection, a digital component selection item must be eligible based on the digital component eligibility criteria, and each of the conditions of the digital component selection item must be satisfied.

[0046] One exemplary condition is that the user to whom the selected digital component is provided is a member of the user group corresponding to the stored digital component. This condition can be referred to as a user group membership condition. In this example, the computing systems MPC1 and MPC2 can store, in relation to (e.g., as part of) the digital component selection item, a set of one or more user group identifiers corresponding to the digital component. These user group identifiers identify the user groups to which the stored digital component may be provided. That is, the digital component selection item is merely a candidate for a digital component selection process that is executed to select a digital component to provide to a user who is a member of at least one of the user groups identified by the set of one or more user group identifiers for the digital component selection item.

[0047] Another exemplary condition for stored digital components is a frequency cap condition indicating that a digital component or a particular category of digital components can only be provided to the same user a certain maximum number of times over a given duration. Another exemplary condition for digital components is a block digital component condition indicating that the digital component has been blocked by a user, e.g., muted. For these exemplary conditions, the computing systems MPC1 and MPC2 can receive and store, for each of a plurality of users, a probabilistic data structure, e.g., a Cuckoo filter or a Bloom filter, representing the digital components that cannot be provided to the user. For example, the probabilistic data structure can represent a universal identifier of the digital components that have been blocked by the user directly or due to the frequency at which the digital components are displayed to the user being exceeded over a given duration.

[0048] The computing systems MPC1 and MPC2 can receive from the user's client device 110, for example, a probabilistic data structure in encrypted form that prevents either of the computing systems MPC1 and MPC2 from accessing the identifiers in plaintext. For example, an application 112 running on the user's client device 110 can generate a Bloom filter that represents identifiers of block digital components that are blocked due to frequency capping or blocked by the user. The application 112 can then provide data to each computing system MPC1 and MPC2 that enables the computing systems MPC1 and MPC2 to cooperate and query the Bloom filter using a secure MPC process to determine whether a given digital component is blocked for that user. The computing systems MPC1 and MPC2 use this secure MPC process to calculate secret shares of the block digital component conditions.

[0049] In some implementations, the identifiers of the blocked digital components are included in the same probabilistic data structure as the user group identifiers and may be queried using either the same or a different set of hash functions. However, the target false positive rate of the block digital components may be lower than the false positive rate of the user group identifiers. Thus, Bloom filters for the block digital components may be generated and queried using fewer hash functions than the user group identifiers. To reduce the data size of the Bloom filters for the block digital components, the user group identifiers may be represented by different Bloom filters than the block digital components. This reduces the latency in transmitting the Bloom filters over the network, reduces the bandwidth consumed in transmitting the Bloom filters, and reduces the battery power usage for transmitting the Bloom filters.

[0050] Another exemplary condition for a stored digital component is a pacing condition that paces the delivery of the digital component over a certain duration. The computing systems MPC1 and MPC2 can store data indicating the total number of times a digital component may be provided over a certain duration and / or the maximum budget of the digital component over that duration. The computing systems MPC1 and MPC2 can use this information to pace the frequency with which the digital component may be a candidate for the digital component selection process based on this condition (e.g., all conditions for a digital component must be met for the digital component to be a candidate). In some embodiments, the computing systems MPC1 and MPC2 can implement a feedback controller, such as, for example, a proportional-integral-derivative (PID) controller, that uses the secret share to pace the stored digital components with the pacing condition.

[0051] In this example, the computing systems MPC1 and MPC2 can store set points of PID controllers for the digital components and can maintain measurement variables of the PID controllers for the digital components. Generally, a PID controller is a feedback controller that uses an error value, which is the difference between a target set point and the measurement variable, to determine an output that drives the measurement variable toward the set point. In the context of pacing the delivery of digital components to client devices, the set points for a campaign can be impression rates, interaction rates, conversion rates, and / or resource depletion rates (e.g., budget consumption rates). Similarly, the measurement variables can be impression rates, interaction rates, conversion rates, and / or resource depletion rates over a given duration. The computing systems MPC1 and MPC2 can also store tuning parameters for each PID controller. The set points, measurement variables, and tuning parameters can be stored in secret shares (each computing system MPC1 and MPC2 stores a corresponding share of each parameter) or in plain text, depending on the targeted privacy / data security.

[0052] Another exemplary condition is the k-anonymity condition. The k-anonymity condition may include a k-anonymity rule that requires that a digital component is eligible (or selected) for distribution to at least k users over a given duration. The concept of k-anonymity ensures that data for a particular user is indistinguishable from data for a threshold number k of other users. The system may enforce the k-anonymity rule by, for example, ensuring that a particular digital component is delivered to a client device 110 in response to a request for one or more digital components, and that the same digital component may be or has been viewed to a set of at least k users or by at least k applications 112 within a particular time period. In some implementations, each of the k applications 112 to which the digital component may be or has been distributed must be for a different user. In this example, the computing systems MPC1 and MPC2 may store a value k for the digital component and maintain the number of users to which the digital component may be distributed.

[0053] Determining the number of users to which the digital component may be visible can include running a counterfactual digital component selection process in parallel with each actual digital component selection process. In this counterfactual digital component selection process, all digital components may be candidates if they satisfy all conditions other than the k-anonymity condition. In the counterfactual digital component selection process, if a digital component is selected for at least k users or k applications 112, the digital component would have been visible to k users in the absence of the k-anonymity condition. When this occurs, digital components that satisfy the k-anonymity condition (assuming other conditions for the digital components, if any, are satisfied) may be included in the actual digital component selection process, which does not include digital components that do not satisfy the k-anonymity condition.

[0054] In some embodiments, each digital component selection item is stored in the form of a digital component information element dc_information_element, which can be a byte array having a selection value and other information of the digital component, including, for example, the creative work itself. The byte array can have a specific format that can be parsed by the application 112 or a trusted program of the client device 110 and the computing systems MPC1 and MPC2 to obtain the selection value and metadata. In some embodiments, the digital component information element can include the digital component itself.

[0055] In addition to the descriptions throughout this specification, the systems, programs, or features described herein may provide the user with controls (e.g., user interface elements with which the user can interact) that allow the user to make choices regarding both whether and when collection of user information (e.g., information about the user's social network, social activities or activities, occupation, user preferences, or the user's current location) may be enabled, and whether content or communications from the server are sent to the user. In addition, some data may be processed in one or more ways before being stored or used, such that personally identifiable information is removed. For example, the user's identification information may be handled such that personally identifiable information cannot be determined about the user, or the user's geographic location may be generalized (such as to the city, zip code, or state level) when location information is obtained, such that the user's specific location cannot be determined. Thus, the user can control what information is collected about the user, how that information is used, and what information is provided to the user.

[0056] Some calculations performed on secret shares by the MPC cluster are shown herein as being products or sums of secret share values. To increase the speed at which these calculations are performed, multiplications can be performed on secret shares using AND operations, such as bitwise AND, and additions can be performed on secret shares using XOR operations, such as bitwise XOR. In some cases, when a plaintext integer is multiplied by a secret share that represents 0 or 1 in Z2 (i.e., the modulo 2 of the sum of two shares is 0 or 1), no multiplication or bitwise AND is required. Instead, each computing system can evaluate its share and return its integer if its share is 1, or 0 if its share is 0.

[0057] Figure 2 illustrates an example data flow within the environment 100 of Figure 1. This description includes two types of selection values: selection values ​​that are conditioned on sensitive user information, such as user group membership or other confidential business information, or parameters whose changes in value may allow unscrupulous parties to infer confidential information, i.e., "conditional selection values," and selection values ​​that are not conditioned on sensitive information, i.e., "unconditional selection values." To protect user privacy, conditions on the "conditional selection values" are evaluated within the MPC cluster 130 instead of the SSP 170 or DSP 150 to determine whether the "conditional selection values" are candidates for the digital component selection process.

[0058] This structure enables MPC cluster 130 to protect user privacy and trade secret information and to prove its trustworthiness to application providers, such as the provider of application 112. In this example, MPC cluster 130 relies on a secure two-party computation (2PC) architecture, which applies cryptographic techniques to ensure that there is no leakage of confidential user data or trade secret information when at least one of the two computational systems of MPC cluster 130 is honest. If MPC cluster 130 includes more than two computational systems, the current MPC protocol can be extended or other MPC protocols can be used.

[0059] The MPC cluster 130 executes a secure 2PC protocol to evaluate and apply conditions to evaluate the eligibility of candidate digital components, executes a selection process to select digital components based on the selection values, and receives impressions and user interaction (e.g., digital component selection) notifications to update parameters on which those conditions depend. All of these processes may be performed using secure 2PC and secret sharing techniques. This protocol is described in detail with reference to Figures 3-6.

[0060] In phase A, the application 112, in cooperation with a trigger element from a content platform such as the SSP 170, sends a request for a digital component to the MPC cluster 130. The application 112 can include multiple requests for digital components together in one combined request to fetch multiple digital components. The MPC cluster 130 can then serve each request in the combined request independently or make one or more selection decisions collectively. In this example, the requests are for a single digital component and include requests for a digital component selected based on confidential information or a digital component selected without using confidential information. The MPC cluster 130 can respond to the request by selecting a particular digital component that corresponds to a particular selection value in a set of selection values, each of which is mapped to a respective particular digital component. These selection values ​​can be selection values ​​previously cached or otherwise stored in the MPC cluster 130 and / or selection values ​​generated by a platform such as the DSP 150 or the SSP 170, just-in-time (JIT) selection values. The JIT selection value is generated directly in response to need, increasing efficiency and reducing waste because the selection value is generated only when the digital component is needed. For example, the JIT selection value can be generated when a digital component slot becomes available, which is indicated by receiving a request for the digital component. Thus, the MPC cluster 130 can select a digital component from a set of digital components that includes stored digital components whose information is stored at the MPC cluster 130 and digital components whose JIT selection values ​​have been received for the current digital component request.

[0061] In some implementations, the selected value of a digital component can be determined using two or more vectors. The MPC cluster 130 can store, for the digital component, a first vector of values ​​that can be used to determine the selected value of the digital component. The first vector of values ​​can be used to determine the selected value of the digital component when the digital component is selected. Thus, the first vector of values ​​can also be referred to as a digital component-based vector. A digital component-based vector can include multiple elements across two or more dimensions, with each element representing a particular characteristic of a digital component presentation opportunity. For example, a digital component-based vector of values ​​can include elements related to a geographic location or region associated with the digital component, a language, an age or age range to which the digital component is associated, a particular URL of a web page or other electronic resource, a particular product or service, whether the digital component works well when it is displayed above the fold or when it is displayed below the fold, a type of digital component, a size of the digital component, a time of day when the digital component is most appropriate to be displayed, and / or other suitable characteristics of the digital component. In some implementations, for example those employing neural networks, the digital component-based vector of values ​​may be an embedding of the user group as well as other users and / or digital component signals within some abstract vector space.

[0062] The value of each element may reflect an amount of increase or decrease in the selection value of the digital component based on a current digital component presentation opportunity having the characteristic corresponding to the element. For example, if DSP 150 desires that a digital component be displayed to a user in Atlanta but not to a user in Dallas, the value of the Atlanta element may be a positive value greater than a value of 1, and the value of the Dallas element may be a positive value less than 1, such as 0, or a negative value. As described in more detail below, the value of the digital component-based vector may be part of a vector dot product calculation to determine the selection value of the digital component.

[0063] The request includes information to be used in the digital component selection process, including potentially sensitive information, such as a user group identifier for a user group with which the application 112 is mapped or otherwise associated, and non-sensitive information, such as a contextual signal from the application 112 regarding the context in which the digital component is to be presented and / or displayed (e.g., contextual characteristics of the environment in which the selected digital component is displayed). As described in more detail below, the design of the system 110 improves protection of user data that may be sensitive or confidential.

[0064] The trigger element can be, for example, a tag that detects the presence of a digital component slot in an Internet location visited by the application 112. The trigger element can be, for example, placed in that Internet location and can notify the application 112 of the presence of a digital component slot for which a digital component should be requested.

[0065] In phase B, the MPC cluster 130 sends a digital component request to the SSP 170 based on non-sensitive information such as the context signal. This request is referred to as a "context request." The context request may include various context signals and non-sensitive user information collected directly by the Internet location (e.g., the content publisher) that triggered the request for the digital component. For example, the context signal may include analytics data, language settings, and other data that assists the content publisher in providing a good user experience. However, the context request provided to the SSP 170 does not include sensitive information such as user group identifiers.

[0066] In stage C, the SSP 170 forwards the context request to one or more DSPs 150. In this particular example, for simplicity, the SSP 170 forwards the context request to a single DSP 150. For example, the SSP 170 may forward the context request to the DSP 150. In this example, the DSP 150 may have a digital component and a selection value mapped to the digital component or may use the context signal to determine the selection value of the digital component.

[0067] In stage D, one or more DSPs 150 return selection values ​​in response to the context request. For example, DSP 150 returns one or more selection values ​​that are mapped to the digital component in response to the context request. DSP 150 may return the selection values ​​in the form of digital component selection items that include the selection values, additional information about the digital component, and optionally the digital component itself, for example in the form of a creative work. DSP 150 may return any number of selection values ​​in response to the context request.

[0068] In some embodiments, DSP 150 may additionally return a selection value in response to a digital component request based on sensitive information, such as user group information. These selection values ​​are "conditional selection values" because they are conditioned on the sensitive information and therefore on the MPC cluster 130 receiving a request containing sensitive information that matches the sensitive information on which the selection value is conditioned. For each selection value that DSP 150 provides, DSP 150 optionally includes a time-to-live (TTL) parameter, i.e., information such as the maximum period for which MPC cluster 130 may cache or otherwise store the selection value, e.g., store a digital component selection item. This TTL parameter allows MPC cluster 130 to cache the selection value received from DSP 150. In some embodiments that do not use a TTL parameter, MPC cluster 130 does not cache the received selection value, but instead discards the selection value after the selection value has been used in a selection process, e.g., a selection process corresponding to a digital component request sent in stages A, B, and C. If the digital component selection item is stored by the MPC cluster 130, the MPC cluster 130 can include the digital component selection item in future digital component selection processes for future digital component requests received from a client device.

[0069] DSP150 may also provide, for example, as part of a digital component selection item, the eligibility formula and its corresponding eligibility criteria, as well as condition data that defines any conditions that must be met for the digital component selection item to be a candidate for selection. This information may be provided in plain text or in shares, e.g., secret shares, depending on the target level of privacy protection and / or the target level of data security. If secret shares are used, DSP150 may provide SSP170 with a first secret share of the eligibility formula, a first secret share of the eligibility criteria, and a first secret share of the condition data for each condition. DSP150 may also provide SSP170 with a second secret share of the eligibility formula, a second secret share of the eligibility criteria, and a second secret share of the condition data for each condition. SSP170 may provide MPC1 with the first secret share and MPC2 with the second secret share such that neither MPC1 nor MPC2 can access any of the information in the plain text absent fraudulent collusion.

[0070] When the vector is used to determine the selection value, the DSP 150 may generate and return a second vector of values. The DSP 150 may generate the second vector of values ​​based on the context signal of the digital component request transmitted in stages B and C. The second vector may be referred to as a context vector. The context vector may include the same elements corresponding to the same features as the digital component-based vector. However, the DSP 150 may determine the value of the context vector for the current digital component request based on the context signal of the digital component request. In contrast, the value of the digital component-based vector of the DSP 150 is stored as the MPC cluster 130 and is pre-determined based on, for example, the user group corresponding to the digital component-based vector.

[0071] For each DSP 150 that provides a context vector, the MPC cluster 130 may determine the selected value for each stored digital component of the DSP 150 by determining a dot product of the digital component-based vector and the context vector provided by the DSP 150. If the DSP 150 has multiple digital component-based vectors stored by the MPC cluster 130, e.g., for different digital components, the MPC cluster 130 determines, for each digital component-based vector, the dot product of the context vector and the digital component-based vector.

[0072] In some implementations, a third vector can be used based on the user profile of the user to whom the digital component request is submitted. This vector can have the same dimensions and characteristics as the other vectors, but with values ​​based on the user profile of the user.

[0073] For example, the value of a location element for Austin in the user profile vector may have a positive value if the user is in Austin, or a negative or zero value if the user is not in Austin, the value of the same location element in the context vector may have a positive value if the publisher content currently being shown to the user is highly relevant to Austin, and the value of the same location element in the digital component-based vector of a digital component is positive if the digital component is relevant to Austin. To calculate the dot product of the three vectors, the computation systems MPC1 and MPC2 first perform element-wise multiplications between corresponding elements, one from each of the three vectors, and then sum the results. For example, if the three vectors are respectively V1={v 1,1 ...v 1,n},V2={v 2,1 ...v 2,n} and V3={v 3,1 ...v 3,n}, then the dot product between the three vectors is:

number

[0074] In stage E, SSP 170 receives the digital component selection item from DSP 150 and provides the digital component selection item to MPC cluster 130. In some embodiments, SSP 170 can process the digital component selection item before sending the digital component selection item to MPC cluster 130.

[0075] For example, SSP 170 may apply selection value rules to determine, for example, how a selection value affects a post-publication value for a particular content provider. The post-publication value may, for example, indicate the amount provided to publisher 140 for displaying a digital component along with publisher 140's resources or application content. SSP 170 then performs a selection process to determine the top unconditional selection value, i.e., the unconditional selection value that results in the highest post-publication value. The unconditional selection value is not conditioned on sensitive information, and therefore content selection rules such as budget and pacing rules, advertiser and digital component exclusions, etc., may be applied by SSP 170 (or DSP 150) rather than MPC cluster 130. SSP 170 then forwards the following to MPC cluster 130, which are JIT selection values: all selection values ​​that enable caching in MPC cluster 130 (selection values ​​with TTL values) and all selection values ​​whose post-publication value is equal to or greater than the post-publication value of the top unconditional selection value.

[0076] In some implementations, DSP 150 and / or SSP 170 can infer characteristics of the environment in which the selected digital component request will be displayed. For example, DSP 150 and / or SSP 170 can infer the rough location of client device 110 where the digital component will be displayed, the topic of the resource where the digital component will be displayed, the time and / or date where the digital component will be displayed, etc. SSP 170 can provide the inferred characteristics along with the digital component selection item to MPC cluster 130. In some implementations, MPC cluster 130 can infer the rough location of client device 110 where the digital component will be displayed based on information not available to DSP 150 and SSP 170 (such as the IP address of the client device).

[0077] In phase F, the MPC cluster 130 updates its cache with received JIT selection values ​​that enable caching (i.e., have TTL values). In addition, the MPC cluster 130 applies selection rules, such as user group membership rules, frequency control, pacing rules, and rules to prevent micro-targeting to all selection values ​​received in phase E of a particular user and previously cached selection values, to select valid candidates for the selection process. The rules may include constraints and guidelines on the manner or frequency of delivery of the digital components, among other factors. The rules include frequency control, muting, resource exhaustion, and pacing constraints. In some embodiments, JIT digital components that have conditions evaluated by the MPC cluster 130 may be ignored for the current digital component selection process. For example, ignoring these digital components for the current selection process may provide performance benefits, such as, for example, reduced latency in selecting and providing digital components. The MPC cluster 130 then performs a final selection process among all eligible candidates, selects a winning digital component, and then returns data about the selected digital component to the application 112 in response to a digital component request. The application of the rules and the selection of the digital component may be performed using a secure MPC process using secret shares, as described with reference to Figures 3-6.

[0078] In phase G, the selected digital component is rendered by the application 112. The application 112 then provides an impression notification to the MPC cluster 130. The impression notification includes data that allows the MPC cluster 130 to update information related to update parameters that enable the MPC cluster 130 to enforce, for example, the selection rules for future digital component requests received in subsequent occurrences of phase A. In some embodiments, the application 112 may provide an interaction notification to the MPC cluster 130 when a user interacts with the digital component, such as clicking on the digital component. In some embodiments, the application 112 may send the impression or interaction notification G to the MPC cluster 130 by piggybacking it on a future component request A to reduce the number of network communications and the battery / bandwidth consumption of the mobile device, as well as the processing / computational cost of the MPC cluster 130.

[0079] 3 is a swim lane diagram of an exemplary process 300 for selecting a digital component for delivery to a client device. The operations of process 300 may be performed, for example, by client device 110, computing systems MPC1 and MPC2 of MPC cluster 130, and DSP 150. The operations of process 300 may be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices may cause the one or more data processing devices to perform the operations of process 300. Although process 300 and other processes below are described with respect to MPC cluster 130 of two computing systems, MPC clusters having three or more computing systems may also be used to perform similar processes. In addition, the operations of process 300 may be performed by SSP 170.

[0080] The DSP 150 provides information about the digital component (302). This information may include a selection value and additional information (e.g., eligibility formula, eligibility criteria, and / or condition data for the condition) for the digital component. In some embodiments, the DSP 150 provides the selection value and additional information to the MPC cluster 130 via an SSP (not shown in FIG. 3 for simplicity). For example, the DSP 150 may provide the selection value and additional information in response to a digital component request and designate the digital component corresponding to the selection value as a stored digital component that is to be stored in the MPC cluster 130.

[0081] As described above, the DSP 150 can provide the MPC cluster 130 with one or more digital component selection items for one or more digital components. Each digital component selection item can have a corresponding digital component, a selection value, and other information as described above. To provide different selection values ​​for different contextual environments, the DSP 150 can provide multiple digital component selection items for the same digital component, each digital component selection item can have a different eligibility formula or different eligibility criteria and different selection values. The MPC cluster 130 can store the digital component selection items in a fast memory, such as a cache, for future digital component requests received from the client device 110.

[0082] In some embodiments, DSP 150 can provide a digital component-based vector of values ​​for the digital components instead of static selected values ​​for the digital components. In such examples, the digital component-based vector of values ​​can be stored instead of the selected values.

[0083] The client device 110 receives the content (304). For example, the client device 110 can receive an electronic resource (e.g., a web page) for display by a web browser or application content for display by a native application. The content can include one or more digital component slots that include computer readable code, e.g., scripts that, when executed, cause the client device 110 to request a digital component for each slot. The client device 110 can render the content on a display of the client device 110.

[0084] The client device 110 identifies (306) a set of user group identifiers. The set of user group identifiers can be user group identifiers of user groups that include the user of the application 112 or client device 110 as a member. For example, the set of user group identifiers can be user group identifiers in a user group list. The application 112 or trusted program that renders the content can identify the set of user group identifiers by, for example, accessing the user group list from secure storage on the client device 110.

[0085] The client device 110 generates (308) a probabilistic data structure. To securely and efficiently generate a digital component request based on the sensitive information, the application 112 can use a probabilistic data structure, such as a Cuckoo filter or a Bloom filter. In this example, the probabilistic data structure is a Cuckoo filter. An example of using a Bloom filter is described with reference to FIG. 8. In general, a Cuckoo filter includes an array of buckets, each of which can hold b fingerprints. An item's fingerprint is a bit string derived from the hash of the item. A Cuckoo filter uses n hash functions that allow an item to be placed in n different buckets in any of the b positions. Typically, a Cuckoo filter is identified by the number of fingerprints in each bucket and the number of buckets. For example, a (2, 4) Cuckoo filter has two buckets, and each bucket in the Cuckoo array can store up to four fingerprints. Thus, the total capacity of a Cuckoo filter is 2 x 4, or 8 fingerprints.

[0086] Depending on the configuration of the Cuckoo filter, an item can be inserted into the Cuckoo filter in one of N possible positions, e.g., N=2. The application 112 determines all possible positions at which the item will be inserted using N pseudorandom functions (PRFs) parameterized by either a user group identifier or an identifier from the set of blocked identifiers and two random variables generated by the application 112. For example, assume that the two random variables generated by the application 112 are rand_var1a and rand_var1b. In some implementations, the application 112 and the MPC cluster 130 agree on a PRF in advance, and PRF(x,y)∈[0,2 k −1], where k is the number of bits for each item in the Cuckoo filter bucket.

[0087] Each position of the Cuckoo filter may be occupied by a user group identifier or a blocked identifier, or may be empty. A blocked identifier is an identifier for which the application 112 has blocked a digital component based on, for example, a frequency control, or an identifier for which a user has chosen to block a digital component for a user group. The application 112 may generate a Cuckoo filter table whose elements are PRF(ug_id, rand_var1a), PRF(blocked_uid, rand_var1b), and 0, where ug_id is an identifier for a user group generated by applying an HMAC to a label for the user group based on the domain of the content provider, blocked_uid is an identifier from the set of blocked identifiers, and 0 represents an empty item. The process is repeated for all user group identifiers. In some embodiments, the same probabilistic data structure, such as, for example, a Cuckoo filter or a Bloom filter, may store both user group identifiers and blocked identifiers. In other embodiments, the user group identifiers and blocked identifiers are stored in a dedicated probabilistic data structure.

[0088] The application 112 can generate a vector B based on the Cuckoo filter table generated for the user group identifiers and / or blocked identifiers. Each value B in the vector B i is B i = (A i - PRF(rand_var2, i) mod p, where A is the Cuckoo filter table and i is the index into vector B and Cuckoo filter table A. When application 112 initiates a request for a digital component in a digital component slot, application 112 sends rand_var1a, rand_var1b, and rand_var2 to computation system MPC1 as parameters of the request. Application 112 also sends vector B, rand_var1a, and rand_var1b to computation system MPC2 as parameters of the request. PRF(rand_var2, i) and B i are held by the computation systems MPC1 and MPC2, respectively, and Z p A in i Since neither of the computing systems MPC1 nor MPC2 has access to both of the secret shares, neither of these computing systems can recreate the Cuckoo filter table while preserving user privacy.

[0089] Steps 306 and 308 are optional steps that may be omitted in some embodiments. For example, MPC cluster 130 may provide the digital component without considering the user's user group membership. In embodiments in which user group membership is used, client device 110 may encrypt and / or compress the user group membership data in a manner other than using a probabilistic data structure.

[0090] The client device 110 sends a digital component request (310) to the MPC cluster 130. The digital component request may include contextual data related to the context in which the selected digital component is displayed, such as contextual characteristics of the environment in which the selected digital component is displayed. The contextual data may include data about the resource in which the digital component is displayed, data about the user of the client device 110, data about the application 112 that displays the digital component, data about the client device 110, and / or general contextual data (e.g., date and time).

[0091] Data about the resource may include a URL for the resource, a topic for the resource, a number of digital component slots for the resource, a type of digital component slot, a location within the resource of the digital component slot, etc. Data about the user may include demographic data (e.g., age, gender, etc.), user group membership, and / or other suitable user data. Data about the application 112 may include a name of the application (e.g., a particular web browser or a native application), a category of the application (e.g., a browser, a video streaming application, a map application, etc.), and / or other suitable data for the application 112. Data about the client device 110 may include rough geographic location information indicating a broad area of ​​the client device 110 (e.g., a city, state, zip code, etc.), the type of client device 110, the size of the client device's display, etc.

[0092] When some or all of the context data and / or user data may be considered private, client device 110 may transmit the data using encryption or other techniques to prevent any unauthorized entities from obtaining such information. To prevent these entities, as well as computing systems MPC1 and MPC2 of MPC cluster 130, from accessing the plaintext context data, client device 110 may generate respective shares, e.g., secret shares, of the context data and transmit the shares to each computing system of MPC cluster 130. For example, client device 110 may transmit a first secret share of the context data to computing system MPC1 and a second secret share of the context data to computing system MPC2. In this way, neither computing system MPC1 nor MPC2 can reconstruct the plaintext context data unless there is unauthorized collusion.

[0093] In some embodiments, the application 112 may be configured to transmit some of the contextual data, e.g., contextual data that is deemed sensitive, using secret shares, while transmitting some of the contextual data in plaintext or encrypted using encryption techniques that allow the computing systems MPC1 and MPC2 to access the plaintext contextual data. This allows the MPC cluster 130 to transmit this contextual data to the SSP 170 for delivery to the DSP 150, so that the DSP 150 can use at least some of the contextual data to select digital components and / or selected values ​​of the digital components. In some embodiments, the client device 110 or the application 112 generates a contextual digital component request, encrypts it into a blob using the public key of the SSP 170, and inserts the blob as a parameter into the digital component request. In such an embodiment, the MPC cluster 130 can transfer the contextual data intended for the SSP 170 as an encrypted blob without accessing the plaintext contextual data.

[0094] In embodiments including a probabilistic data structure for representing user group membership, the digital component request may include parameters of a Cuckoo filter. For example, client device 110 may send a digital component request including rand_var1a, rand_var1b, and rand_var2 to computing system MPC1. Client device 110 may also send a digital component request including vector B, rand_var1a, and rand_var1b to computing system MPC2. Both digital component requests may also include context signals, such as, for example, the URL of the electronic resource, the number of digital component slots of the resource, the geographic location of client device 110, and / or other suitable context signals, such as, for example, a search key, that may be used to select a digital component.

[0095] The MPC cluster 130 sends a contextual digital component request to the SSP 170 (312). This digital component request may include the context signal, but does not include sensitive user data, such as a user group identifier that identifies a user group of which the user is a member. For example, the contextual digital component request may include the cleartext context data received from the client device 110, but does not include any context data sent as a private share from the client device 110. In some embodiments, the contextual digital component request is generated by the SSP's tag on the publisher's page rendered on the client device 110, or by the SSP's software development kit (SDK) on the publisher's application installed on the client device 110.

[0096] The SSP 170 sends the context digital component request to one or more DSPs 150 (314). Each DSP 150 can respond to the request with one or more conditional selection values ​​of the digital component and / or one or more unconditional selection values ​​of the digital component. For each digital component, the response can include data identifying the digital component, the selection value of the digital component, and metadata (or other additional information) of the digital component. For example, the response can include a digital component selection item, e.g., a digital component information element dc_information_element, for each digital component. Each DSP 150 can select one or more digital components for inclusion in the digital component selection process based on the context signal and determine or identify a selection value for each selected digital component. In some embodiments, the DSP 150 can generate a context vector for each of the one or more digital components based on the context signal.

[0097] Each DSP 150 may send its response to SSP 170 (316). SSP 170 may send the response to MPC cluster 130 (318). As described above, DSP 150 and / or SSP 170 may infer additional contextual data about the environment in which the selected digital component is displayed at client device 110, e.g., based on the contextual data received from MPC cluster 130. If so, SSP 170 may also include this additional contextual data in the response to MPC cluster 130.

[0098] The MPC cluster 130 performs a secure MPC process to select (320) digital components to provide for display at the client device 110. This selection may include identifying a set of digital components and their corresponding selection values ​​that are eligible for the digital component selection process, e.g., identifying digital component selection items, based on the context signal, e.g., using eligibility expressions and / or eligibility criteria. This may also include identifying candidate digital component selection items from the set of eligible digital component selection items that are candidates for selection. The candidate digital component selection items may include unconditional digital components for which the DSP 150 provided an unconditional selection value or vector, and conditional digital components for which each condition of the digital component is satisfied. A conditional digital component selection item is considered a candidate for the digital component selection process only when all conditions of the digital component selection item are satisfied.

[0099] Based on the selection value of the candidate digital component selection item, the MPC cluster 130 may select a digital component selection item from the candidate digital component items for which to provide the digital component to the client device 110 in response to the digital component request. For a digital component selection item having a selection value determined using a vector, the MPC cluster 130 may determine the selection value of the digital component selection item by determining a dot product of the vector, e.g., a digital component-based vector, a context vector, and optionally a user profile vector.

[0100] The MPC cluster 130 transmits the secret share of the selection result to the client device 110 (322). In some embodiments, the MPC cluster 130 may also transmit a selection process identifier of the digital component selection process to the client device 110. The selection process identifier may uniquely identify the digital component selection process from which the selection result was generated. For example, the computing systems MPC1 and MPC2 may each generate a respective selection process identifier SPID for each digital component request for which the computing systems MPC1 and MPC2 perform a selection process to generate a selection result for which they provide to the client device 110. In some embodiments, the selection process identifier SPID may be a nonce or an opaque alphanumeric or numeric string.

[0101] Transmitting secret shares of results relating to only selected digital components, rather than information about all or a large set of digital components, similarly reduces latency and consumed bandwidth, processing power, and battery power in transmitting and receiving the results. This also reduces potential leakage of confidential information for content platforms submitting digital component selection values ​​to the MPC cluster 130 by limiting the number of digital components for which information is provided to the client device.

[0102] The MPC cluster 130 may also store data for selection values ​​that were part of the selection process that were keyed by a SPID or otherwise linked to a SPID. For example, the computing system MPC1 may store a table or other data structure that includes data for selection values ​​with keys based on SPID1 generated by the computing system MPC1 for the selection process. Similarly, the computing system MPC2 may store a table or other data structure that includes data for selection values ​​with keys based on SPID2 generated by the computing system MPC2 for the selection process. This allows the MPC cluster 130 to update process variables for the feedback controller based on data received from the client device 110. In some embodiments, the client device 110 or the application 112 generates the SPID. In some embodiments, MPC1 and MPC2 infer the SPID from the digital component request 310.

[0103] The selection result may be in the form of a byte array that includes information about the digital component of the selected digital component selection item. For example, the selection result may be a byte array that includes the selection value of the digital component and metadata and / or other additional information of the digital component. The computing systems MPC1 and MPC2 may determine secret shares of the selection result using a secure MPC process, as described in more detail below. The computing system MPC1 may send a first secret share of the selection result to the client device 110, and the computing system MPC2 may send a second secret share of the selection result to the client device 110. To prevent the computing systems MPC1 and MPC2 from learning the selected digital component, the computing systems MPC1 and MPC2 may be prevented from sharing their secret shares of the selection result with each other. For example, MPC1 and MPC2 may independently encrypt their respective secret shares with the client device's public key, which may be a parameter in the digital component request.

[0104] Transmitting secret shares of results relating to only selected digital components, rather than information about all or a large set of digital components, similarly reduces latency and consumed bandwidth, processing power, and battery power in transmitting and receiving the results. This also reduces potential leakage of confidential information of content platforms submitting digital component selection values ​​to the MPC cluster by limiting the number of digital components for which information is provided to the client device.

[0105] The client device 110 determines (324) a digital component corresponding to the selection result. For each selection result for which the client device 110 receives two secret shares from the computing systems MPC1 and MPC2, the client device 110 can determine the selection result from the two secret shares. For example, using an additive secret share library as described in more detail below, the client device 110 can add the two secret shares of the selection result together to obtain the selection result in plaintext. This gives the client device 110 access to the selection value for the digital component, as well as metadata for the digital component, such as an identification of the digital component, a location from which the client device 110 can download the digital component, etc. In some embodiments, the byte array includes the digital component itself, such that the client device 110 can access the digital component after reconstructing the secret shares of the selection result.

[0106] The client device 110 displays (326) the digital component. For example, the application 112 may display the digital component having the content received in step 304. In some implementations, the client device 110 may display the digital component of the selection.

[0107] In some embodiments, the client device 110 can request digital components based on user group membership (or other user signals) from the MPC cluster 130. The client device 110 can also request digital components based on context signals from the SSP 170. These context signals can include the same context signals described above, and optionally additional context signals, such as the number of digital component slots of the resource, the type of digital component slot, the type and / or format of the digital components that may be displayed with the resource. The SSP 170 can select one or more digital components based on the context signals and the selection values ​​for the digital components, and can provide the client device 110 with one or more of the selected digital components (or data identifying the digital components) and the selection values ​​for the digital components. The client device 110 can then select a digital component for display with the resource from a set of digital components, including the digital components of the selection results received from the MPC cluster 130 and the digital components selected by the SSP 170. If the resource includes multiple digital component slots, the client device 110 can request a respective digital component for each slot from the MPC cluster 130 and the SSP 170.

[0108] The client device 110 sends one or more event notifications (328) to the MPC cluster 130. For example, assuming that the selected digital component received from the MPC cluster 130 is displayed by an application 112 on the client device 110, the application 112 may send a digital component impression notification in response to displaying the digital component. In another example, the application 112 may send a user interaction notification in response to detecting a user interaction, such as, for example, selecting / clicking on the digital component.

[0109] For a user interaction notification, the application 112 can generate a secret share of the click parameter clicked, which is a Boolean parameter that can have a value of 1 if the user interacts with the digital component or a value of 0 if the user does not interact with the digital component within a specified duration after the digital component is displayed. Thus, in this example, either value can indicate that the digital component is displayed, but a value of 1 can indicate that the user has interacted with the digital component. The application 112 can send a first notification to the computer system MPC1 that includes SPID1 received from the computing system MPC1 and a first secret share of the click parameter [clicked1]. Similarly, the application 112 can send a second notification to the computer system MPC2 that includes SPID2 received from the computing system MPC2 and a second secret share of the click parameter [clicked2]. In another example, the notification can separately indicate whether the digital component was displayed at the client device 110, for example, using a secret share similar to the click parameter.

[0110] The impression and user interaction notifications allow the MPC cluster 130 to update the process variables of a feedback controller used to adjust the pace of delivering the digital component. For example, if the process variable is an impression rate, the MPC cluster 130 can use the impression notification to update the count of impressions of the digital component (or the campaign including the digital component). If the process variable is a user interaction rate, the MPC cluster 130 can use the click parameters to update the number of user interactions for the digital component (or the campaign including the digital component). In a particular example, the computing system MPC1 can use SPID1 to obtain the stored data of the selection process, and the computing system MPC2 can use SPID2 to obtain the stored data of the selection process. The MPC cluster 130 can then implement a secure MPC process to update the process variables (e.g., impression rate, interaction rate, conversion rate, and / or resource exhaustion rate) of the campaign of the digital component displayed by the application 112. Similarly, the MPC cluster 130 can use these notifications to update the counts used to determine whether a digital component satisfies the k-anonymity condition.

[0111] 4 is a swim lane diagram of an example process 400 for selecting a digital component for delivery to a client device. The operations of process 400 may be performed, for example, by computing system MPC1 or computing system MPC2 of MPC cluster 130. The operations of process 400 may be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices may cause the one or more data processing devices to perform the operations of process 400.

[0112] The computing systems MPC1 and MPC2 determine and / or identify the selected value of the digital component (402). The computing systems MPC1 and MPC2 may determine the selected value in response to a digital component request received from the client device 110. As described with reference to FIG. 3, the computing system MPC1 may receive from the client device 110 a digital component request including context data and optional data of a probabilistic data structure representing a user group identifier of a user of the client device 110. The data of the probabilistic data structure may include parameters rand_var1a, rand_var1b, and rand_var2. Similarly, the computing system MPC2 may receive from the client device 110 the context data and the parameters, i.e., vector B, rand_var1a, and rand_var1b. The context data may include context characteristics of the environment in which the selected digital component is displayed, as described above.

[0113] Client device 110 may transmit the context data to computing systems MPC1 and MPC2 in a variety of ways. In some implementations, client device 110 may transmit a first secret share of the context data to computing system MPC1 and a second secret share of the context data to computing system MPC2. If some of the context data is considered non-sensitive, client device 110 may transmit this non-sensitive context data in the clear to each computing system MPC1 and MPC2.

[0114] In some implementations, client device 110 can encode the context characteristics into a vector and transmit the vector to each computing system MPC1 and MPC2, or transmit respective secret shares of the vector to computing systems MPC1 and MPC2. The elements of the vector (optionally when not in vector form) can be represented as integers. For example, locations can be represented as integers by assigning an integer to each possible location or using a location's zip code.

[0115] The selection values ​​may include stored digital component selection values ​​whose data is stored by each computing system MPC1 and MPC2, as well as JIT selection values ​​received for the digital component selection process from SSP 170. For situations in which the selection values ​​may be determined using vectors, each computing system MPC1 and MPC2 may determine the selection values ​​by determining the dot product of the vectors of the digital components.

[0116] Computing system MPC1 identifies eligible digital components 404. Computing system MPC2 also identifies eligible digital components 406. Eligible digital components are digital components that have digital component selection items that are eligible for selection based on context data of the digital component request.

[0117] In some embodiments, the computing systems MPC1 and MPC2 use a digital component eligibility formula to determine whether each stored and / or JIT digital component is eligible. The output of the eligibility check may be an eligibility parameter indicating whether the digital component selection item (and its digital component and corresponding selection value) is eligible for selection for delivery to the client device 110 for display in response to a digital component request. In some embodiments, the eligibility parameter eligibility_check for digital component selection item "i" may be i In some embodiments, the eligibility parameter eligibility_check for digital component selection item i may be in plain text. i The computation system MPC1 generates the first secret share [eligbility_check i.1 ], and the computation system MPC2 has a second secret share [eligbility_check i.2 ] may be a secret share. The brackets are used to represent the secret share of the parameter. An exemplary process for determining whether a digital component is eligible for selection is described with reference to FIG. 5.

[0118] For each eligible digital component, computing systems MPC1 and MPC2 determine (408) whether the digital component selection item is a candidate for being selected for delivery to client device 110 in response to the digital component request. Candidate digital component selection items are eligible digital component selection items that meet the eligibility criteria for a digital component if the digital component is a conditional digital component. Each unconditional digital component that is eligible based on the context is also a candidate digital component. Computing systems MPC1 and MPC2 can determine the candidate digital component selection items using a secure MPC process such that neither computing system MPC1 nor MPC2 can identify the candidate digital components in the clear.

[0119] For the user group membership condition, the computation systems MPC1 and MPC2 calculate a user group membership condition parameter ug_check for each eligible digital component selection item "i". i The user group membership condition parameter ug_check maintained by the computation system MPC1 can be used to compute the respective secret shares of i The first secret share of [ug_check i,1 ] and the user group membership condition parameter ug_check maintained by the computation system MPC2. i The second secret share of i,2 ] can be expressed as

[0120] For an embodiment in which a Cuckoo filter is used to represent a user's user group membership, computing system MPC1, in cooperation with computing system MPC2, calculates [ug_check i,1 ] is calculated.

number

[0121] In Relation 1, Π denotes the multiplication of multiple items, where ug_id(x) is a function used to extract the user group identifier ug_id associated with the selection value x, and {F1, ...F N} is a set of hash functions for computing possible indexes of items in the Cuckoo filter table A, and rand_val1a is a random value received in the digital component request. x,1 ] is the xth element in array [M1]. == is an equality test between a plaintext integer and a secret share of a secret integer. The result of == is a secret share of a secret integer that is either 0 (not equal) or 1 (equal). Here, [M i,1 ] = [PRF(rand_val2a, i)1].

[0122] Similarly, the calculation system MPC2, in cooperation with the calculation system MPC1, calculates [ug_check i,2 ] is calculated.

number

[0123] Here, [M i,2 ] value = B i It is.

[0124] For digital component selection items that are conditioned on the user group membership of the user for whom the digital component is selected, the computation systems MPC1 and MPC2 may further include a user group membership conditioned parameter ug_check i Secret Share [ug_check i,1 ] and [ug_check i,2]. The combination of the two secret shares may be a Boolean value representing whether the user is a member of the user group corresponding to the digital component. For example, a value of 1 may represent that the user is a member and a value of 0 may represent that the user is not a member. For digital component selection items that are not conditioned on the user's user group membership, the computing systems MPC1 and MPC2 may compute the secret shares [ug_check i,1 ] and [ug_check i,2 ] can be used as the default value.

[0125] In an embodiment where a Bloom filter is used to represent a user's user group membership, the computing systems MPC1 and MPC2 can query the Bloom filter. The result is that the computing system MPC1 calculates, for each hash function of the Bloom filter, a first secret share of the user group membership condition parameter [ug_check i,1 Similarly, the computation system MPC2 determines, for each hash function of the Bloom filter, a second secret share of the user group membership condition parameters [ug_check i,2 For a digital component to satisfy the user group membership condition, the user group membership condition parameters of each hash value of the Bloom filter, i.e., ug_check iwould have to have a Boolean value of true, i.e. 1. To check if a user belongs to a particular user group, assuming the Bloom filter has N hash functions that hash to N array indexes, all the Boolean values ​​of the N indexes must be 1 or true. At the implementation level, each ug_check parameter can be the result of a bitwise AND of N secret shares. The secret shares of each hash value can be included in the final calculation of the secret shares of the candidate parameters of the digital component selection item.

[0126] The calculation systems MPC1 and MPC2 also cooperate to calculate the blocked digital component parameter blocked_check for each digital component selection item i that is conditioned for frequency control or muting. i Each secret share [blocked_check i,1 ] and [blocked_check i,2

[0046] may also be calculated. The combination of the two secret shares may be a Boolean value representing whether the digital component satisfies a block digital component condition based on a frequency control (e.g., the digital component has not been provided to the user more than a threshold number of times during a certain duration) and / or based on whether the user has chosen not to have the digital component displayed to the user. For example, a Boolean value of true or 1 may represent that the digital component may be displayed to the user based on these factors, and a Boolean value of false or 0 may represent that the digital component may not be displayed to the user based on these factors.

[0127] To determine the secret share of the block digital component parameters, the computing systems MPC1 and MPC2 can use a share, e.g., an array, of a Bloom filter that represents an identifier of the block digital component. The application 112 can generate a Bloom filter that represents an identifier of the block digital component and send data representing the Bloom filter to the computing systems MPC1 and MPC2. The computing systems MPC1 and MPC2 can then query the Bloom filter using the array representing the Bloom filter to determine the secret share [blocked_check i,1 ] and [blocked_check i,2 ] can be obtained.

[0128] The calculation systems MPC1 and MPC2 may also cooperate to calculate, for example, a pacing control check parameter pacing_check for each digital component selection item i that is paced using a feedback controller. i Each secret share [pacing_check i,1 ] and [pacing_check i,2

[0046] may also be calculated. The combination of the two secret shares may be, for example, a Boolean value representing whether the digital component selection item satisfies a pacing condition based on the output of the feedback controller. For example, if the digital component is being served too frequently in relation to a target impression rate, the output of the feedback controller may indicate that the digital component is not eligible for this digital component selection process. A Boolean value of true or 1 may represent that the digital component selection item satisfies a pacing condition, e.g., not being throttled for this selection process, and a Boolean value of false or 0 may represent that the digital component selection item does not meet a pacing condition, e.g., being throttled for this selection process.

[0129] To enforce resource exhaustion (e.g., budget) and pacing rules, the computational systems MPC1 and MPC2 can randomly block digital components from participating in the digital component selection process using a probability determined using a feedback controller and a resource exhaustion condition. If the campaign that includes the digital component does not have any additional resources, the probability is set to 1. In other aspects, if the campaign is ahead of the delivery schedule, e.g., a pacing control check parameter pacing_check i has a value of 0. i,1 ] and [pacing_check i,2 The probability is higher so that the computing systems MPC1 and MPC2 are more likely to block the digital component from the digital component selection process by calculating [ ]. If the campaign is after the delivery schedule, the probability is lower.

[0130] The computation systems MPC1 and MPC2 can periodically compute a pacing selector parameter pacing_selector for each campaign in the additive secret shares using a feedback controller. Conceptually, the pacing selector parameter is a throttling probability scaled up by a multiple of the maximum range.

[0131] For each digital component request and each digital component selection item, the computation systems MPC1 and MPC2 compute a secret number that is uniformly distributed within [0, maximum range]. If that random number is less than or equal to the pacing selector parameter pacing_selector, the computation systems MPC1 and MPC2 then compute a pacing control check parameter pacing_check, for example. i has a value of 0. i,1 ] and [pacing_check i,2] to block the digital component selection item from participating in the digital component selection process.

[0132] To protect user privacy and secret information of participants in the digital component selection process, both the random number and the pacing selector parameter are in the additive secret share. The comparison between the two secret shares can be performed using a garbled circuit protocol. By limiting both secret shares to 6 or 7 bits, the comparison protocol can require one or two rounds of communication between the computational systems MPC1 and MPC2.

[0133] To determine the pacing selector parameter of the campaign, the computing system may calculate the amount of resources used for each campaign as resources_used_campaign = Σ(clearing_value × is_dc_the_winner), the sum over the digital component selection process including the digital components of the campaign, where the parameter clearing_value is the clearing value of the digital component selection process, and is_dc_the_winner is the winner parameter of the digital component in the digital component selection process. This calculation may be performed in secret shares, such that each computing system MPC1 and MPC2 holds a secret share of the amount of resources used. The computing systems MPC1 and MPC2 may then calculate the resource exhaustion parameter resources_exhausted for the campaign by determining whether the amount of resources used, i.e., resources_used_campaign, is greater than the total amount of resources allocated to the campaign in the secret share.

[0134] The computation systems MPC1 and MPC2 may compute a pacing selector parameter pacing_selector for each campaign as pacing_selector = resources_exhausted x maximum range + (1 - resources_exhausted) x output, where the parameter output is the output of the feedback controller. This computation may use a single RPC between the computation systems MPC1 and MPC2 to compute the multiplications in the secret shares. However, the computation may be performed offline periodically to prevent any added latency.

[0135] The computation systems MPC1 and MPC2 cooperate to determine a k-anonymity check parameter kanonymity_check for each digital component selection item i that must satisfy a k-anonymity condition, which in some embodiments may be applied to all digital components. i [kanonymity_check i,1 ] and [kanonymity_check i,2

[0046] A secret share for each of the k-anonymity conditions may also be calculated. The combination of the two secret shares may be a Boolean value representing whether the digital component selection item satisfies the k-anonymity condition. For example, a value of 1 may represent that the digital component selection item satisfies k-anonymity, and a value of 0 may represent that the digital component selection item does not satisfy k-anonymity and should be blocked from the digital component selection process.

[0136] For each condition of each conditional digital component (e.g., a digital component having at least one condition), each computing system MPC1 and MPC2 can store a corresponding secret share of the parameter of each condition of the digital component selection item corresponding to the digital component. In this way, as long as at least one MPC computing system is fair, neither computing system MPC1 nor MPC2 knows the value of the parameter in the clear. Each digital component selection item may be conditioned on zero or more conditions. For a given digital component selection process, some digital component selection items may have different conditions and / or a different amount of conditions than other digital component selection items.

[0137] In some embodiments, the only condition that a digital component selection item must satisfy to be included in the digital component selection process is the eligibility condition based on the context data. In this example, other conditions (e.g., k-anonymity, pacing, etc.) are not considered.

[0138] Although some exemplary conditions are provided above, other conditions may also be used. In general, the computing systems MPC1 and MPC2 may calculate the secret share of the condition parameter using a secure MPC process. The criteria and techniques for determining the condition parameter may vary. In some embodiments, the secret share of the condition parameter may be received from another computing system, for example, such that the computing systems MPC1 and MPC2 do not calculate the condition parameter.

[0139] The computing systems MPC1 and MPC2 can use the secret share of the conditional parameters to determine whether a conditional digital component selection item (and thus its digital components and corresponding selection values) is a candidate for the digital component selection process. The computing systems MPC1 and MPC2 can use the secret share of the conditional digital component selection item's conditional parameters to determine the candidate parameter is_dc_a_candidate for each conditional digital component selection item i. i In general, when a conditional digital component is conditioned on each of the conditions described above, the candidate parameters of digital component i can be calculated using relation 3 below. is_dc_a_candidate i =ug_check i AND blocked_check i AND pacing_check i AND kanonymity_check i

[0140] In this example, only the AND operator is used, but other Boolean operators such as OR, XOR, and NOT may also be used. Since the value of each condition parameter is in a secret share, the computing systems MPC1 and MPC2 cooperate in a secure MPC process using round-trip remote procedure calls (RPCs) to use the secret shares of the condition parameters to find the corresponding secret shares of the candidate parameters of digital component selection item i, [is_dc_a_candidate i,1 ] and [is_dc_a_candidate i,2 ] can be determined using any suitable secret sharing algorithm for determining a logical AND operation to determine the secret share [is_dc_a_candidate i,1 ] and [is_dc_a_candidate i,2The computation systems MPC1 and MPC2 can determine the secret shares of the candidate parameters using only the secret shares of the condition parameters of their conditions. At the end of this secure MPC process, the computation system MPC1 determines the first secret share of the candidate parameter [is_dc_a_candidate i,1 ] and the computation system MPC2 calculates a second secret share [is_dc_a_candidate i,2 ] is held.

[0141] In some embodiments, computing systems MPC1 and MPC2 evaluate relation 3 for each digital component using a garbled circuit protocol. In this example, one of computing systems MPC1 or MPC2 may construct the garbled circuit. For this example, assume that computing system MPC1 constructs the garbled circuit. Computing system MPC1 knows its own secret share, and also knows that there is only one possible bit pattern that computing system MPC2's secret share must hold for the candidate parameter of the digital component to be true or 1. With such properties, computing system MPC1 needs only a maximum of 50 gates to construct the garbled circuit, for example, when there are about 50 Boolean parameters in total in relation 3.

[0142] In relation 3, there is only one user group membership condition parameter ug_check i However, if Bloom filters are used to represent the user group membership of a user, then relationship 3 must be satisfied by the respective user group membership condition parameters ug_check iSimilarly, if the block digital components are represented using a Bloom filter, then relation 3 defines the respective block digital component parameters blocked_check i In relation 3, pacing_check i is only present if the owner of the digital component enables pacing checks.

[0143] The computing system MPC1 determines an order of the digital component selection items based on the selection values ​​(410). Similarly, the computing system MPC2 determines an order of the digital component selection items based on the selection values ​​(412). These two orders should be exactly the same because the input of the ordering process is the same on the two computing systems MPC1 and MPC2. Each computing system MPC1 and MPC2 can determine an order of the digital component selection items. Each order can include the candidate digital components and other digital components evaluated for candidate eligibility in step 408. For example, the order can include all available digital components available to the digital component selection process, all eligible digital components of the digital component selection process (e.g., eligible based on context data), or all digital components maintained by the MPC cluster 130. The order can be from the digital component selection item with the highest selection value to the digital component selection item with the lowest selection value. In some implementations, the selected value used for the order may be, for example, a value that will be provided to the publisher 140 of the resource with which the selected digital component will be displayed after any sharing with the DSP 150 and / or SSP 170.

[0144] When the selection values ​​form plaintext, the computing systems MPC1 and MPC2 do not have to perform any round-trip computation to determine the order of the digital component selection items. Instead, each computing system MPC1 and MPC2 can independently order the digital component selection items. When the selection values ​​are stored as secret shares in each computing system MPC1 and MPC2, and each computing system MPC1 and MPC2 has a respective secret share of each selection value, the computing systems MPC1 and MPC2 can perform a secure MPC process using round-trip computation to order the digital component selection items based on the selection values. When a link exists between two or more selection values, the computing systems MPC1 and MPC2 can deterministically break the link using other metadata of the digital component selection items corresponding to those selection values.

[0145] Computing systems MPC1 and MPC2 determine (414) a secret share of the cumulative value of each candidate digital component selection item. Conceptually, the cumulative value for a given digital component selection item represents the total number of candidate digital component selection items from the beginning of the sequence up to the given digital component selection item, excluding the given digital component selection item even though the given digital component selection item is a candidate. That is, the cumulative value represents the number of candidate digital component selection items that are more preferred and / or eligible for selection than the given digital component selection item. This concept is illustrated in Table 1 below. [Table 1]

[0146] In some embodiments, the cumulative value for a given digital component selection item represents the total number of candidate digital component selection items from the beginning of the sequence to the given digital component selection item, including the given digital component selection item if the given digital component selection item is a candidate. In this example, the fourth column represents whether the cumulative value is equal to 1 instead of 0. For brevity, the remaining discussion is for the first example in which the cumulative value for a given digital component selection item represents the total number of candidate digital component selection items from the beginning of the sequence to the given digital component selection item, excluding the given digital component selection item even if the given digital component selection item is a candidate.

[0147] Conceptually, in Table 1, an accumulation value (acc) is incremented for each digital component selection item having a candidate parameter is_dc_a_candidate equal to 1 as one progresses from the beginning of the sequence to the end of the sequence. As described below, the calculation of the accumulation value acc is performed in secret shares. For example, the accumulation value acc of the digital component selection item having the highest selection value is 0 because the candidate parameter is_dc_a_candidate of the highest selection value is equal to 0. The candidate parameter is_dc_a_candidate of the second highest digital component selection item (the digital component selection item having the second highest selection value) is equal to 1, but the accumulation value acc for the second highest digital component selection item is also 0 because none of the digital component selection items above the second highest digital component selection item have a candidate parameter is_dc_a_candidate equal to 1. Going down the order, the accumulated value acc of the candidate parameter is_dc_a_candidate of the third highest selected digital component selection item (the digital component selection item having the third highest selection value) is incremented to a value of 1 based on the candidate parameter is_dc_a_candidate of the second highest digital component selection item having a value of 1. Because the candidate parameter is_dc_a_candidate of the third highest digital component selection item is 0, the accumulated value acc of the fourth highest digital component selection item (the digital component selection item having the fourth highest selection value) is not incremented and has a value of 0, like the third highest digital component selection item.

[0148] Using Table 1, the computing systems MPC1 and MPC2 select for delivery to the client device 110 a digital component of the digital component selection item that corresponds to a selected value in which the overall candidate parameter is_dc_a_candidate has a value of 1 and the accumulated value acc has a value of 0 as shown in the fourth column of Table 1. This represents a digital component that corresponds to the highest ordered selected value in which the candidate parameter is_dc_a_candidate has a value of 1. To maintain user privacy and ensure that user data is not leaked, since the candidate parameter is_dc_a_candidate is within the secret shares of the computing systems MPC1 and MPC2, the computing systems MPC1 and MPC2 determine the secret shares of the accumulated value acc of each digital component and use a round-trip computation to determine which digital components have an accumulated value acc equal to 0 and a candidate parameter is_dc_a_candidate equal to 1.

[0149] The computation systems MPC1 and MPC2 may determine their secret shares of the accumulated value acc of each digital component selection item independently without any round-trip computation in accordance with a secret share algorithm in some embodiments. For example, the computation system MPC1 may determine, for each digital component selection item i, a first share [acc i,1 Similarly, the calculation system MPC2 can determine, for each digital component selection item i, a second share [acc i,2 ] can be determined.

[0150] The computing systems MPC1 and MPC2 determine 416 for each digital component selection item a result secret share indicating whether the cumulative value has a specified value. The specified value may be a value of 0, as shown in columns 3 and 4 of Table 1. As noted above, a digital component selection item with a cumulative value of 0 and an overall candidate parameter is_dc_a_candidate of 1 is the digital component selection item with the highest selection value among the candidate digital component selection items.

[0151] The computation systems MPC1 and MPC2 perform an equality operation acc on the secret share of each digital component selection item i. i To calculate == 0, it may involve multiple rounds of calculations, e.g., multiple RPCs, as part of a secure MPC process. The equality operation is the accumulated value acc of digital component selection item i. i has a value of 0. At the end of this process, the calculation system MPC1 calculates for each digital component selection item i the result acc i == 0, and the computation system MPC2 calculates, for each digital component selection item i, the result acc i == 0 for the other secret share.

[0152] The calculation systems MPC1 and MPC2 calculate the winner parameter is_dc_the_winner for each digital component selection item i. i The computation systems MPC1 and MPC2 determine (418) a secret share of the accumulated value acc for each digital component selection item i. i == 0 for the secret share and candidate parameter is_dc_a_candidate for each digital component selection item i i Based on the secret share of the winner parameter is_dc_the_winner iThe winner parameter is_dc_the_winner for each digital component selection item i can be determined. i may be a Boolean value indicating whether digital component selection item i (and its digital component) is the winner of the selection process, e.g., whether the digital component of digital component selection item i is selected for delivery to the client device 110 in response to the digital component request.

[0153] In some embodiments, the computing systems MPC1 and MPC2 execute a secret share multiplication protocol to multiply, for each selected value, a winner parameter is_dc_the_winner in terms of the secret share. i ==(is_dc_a_candidate i ×(acc i ==0). This may involve one RPC between computation systems MPC1 and MPC2 to multiply the two secret shares. At the end of this MPC process, computation system MPC1 can compute [is_dc_the_winner i,1 ] = [is_dc_a_candidate i,1 ] x ([acc i,1 ] == 1) i Similarly, the computation system MPC2 has one secret share of [is_dc_the_winner i,2 ] = [is_dc_a_candidate i,2 ] x ([acc i, 2 ] == 0) i For all digital component selection items, at most one digital component selection item has a winner parameter is_dc_the_winner equal to 1. iNote that the parameter , which is the digital component selection item that has the digital components selected for delivery to the client device 110. All other parameters are equal to 0.

[0154] The computing systems MPC1 and MPC2 determine a selection result (420). In some embodiments, the computing systems MPC1 and MPC2 can calculate the selection result based on the winner parameter of the digital component selection item and the digital component information element dc_information_element of the digital component. As described above, the digital component information element dc_information_element of the digital component can include the selection value of the digital component and other data of the digital component.

[0155] Conceptually, the computational systems MPC1 and MPC2 can compute the selection result parameter "result" using relationship 4 below. result=Σ i is_dc_the_winner i ×dc_information_element i

[0156] That is, the calculation systems MPC1 and MPC2 calculate the winner parameter is_dc_the_winner across all digital component selection items. i and the digital component information element dc_information_element i In this example, the selection result is a winner parameter, is_dc_the_winner, that has a value of 0 if there is no candidate digital component, or is_dc_the_winner, that is equal to 1. iIn another example, the digital component information element dc_information_element can be replaced with the selection value of the digital component in relation 4. In this example, the selection result has a value of 0 if there is no candidate digital component selection item, or a winner parameter is_dc_the_winner equal to 1. i A selected digital component having either a value equal to the selection value of the selection item or a value equal to the selection value of the selection item.

[0157] To perform the calculations on the secret shares, the calculation system MPC1 takes all the digital component selection items and can make a plaintext of the digital component information element dc_information_element of the digital component selection items. i , the first secret share of the winner parameter of the digital component selection item [is_dc_the_winner i,1 ]. The computing system MPC1 can then determine the sum of these products and return the sum to the client device 110 that submitted the digital component request. That is, the computing system MPC1 can determine the sum using relationship 5 below, with the resulting first secret share [result1]: [result1]=Σ i ([is_dc_the_winner i ]×dc_information_element i )

[0158] The calculation system MPC2 can carry out a similar calculation to determine a second share of the result [result2], using relationship 6 below. [result2]=Σ i ([is_dc_the_winner i]×dc_information_element i )

[0159] In some embodiments, performance of MPC cluster 130 may be improved (e.g., by reducing calculations and round-trip communication between calculation systems MPC1 and MPC2) by replacing multiplications performed on secret shares with bitwise AND operations and additions with bitwise XOR operations. In some embodiments, a garbler circuit may be used to evaluate various relationships, resulting in reduced calculations and round-trip communication. For example, in a garbler circuit implementation, MPC1 may act as a garbler and MPC2 may act as an evaluator.

[0160] The computing system MPC1 transmits a first share of the selection result [result1] to the client device 110 (422). Similarly, the computing system MPC2 transmits a second share of the selection result [result2] to the client device 110 (424). The application 112 can then reconstruct the selection result in plaintext using the two secret shares [result1] and [result2], for example by determining the sum of the secret shares if an additive secret share algorithm is employed. If the selection result has a value of 0, the MPC cluster 130 has not identified a digital component for delivery to the client device 110. Otherwise, the selection result has a value equal to the digital component information element dc_information_element. The application 112 can parse the digital component information element dc_information_element to obtain the selection value and metadata of the digital component. The application 112 can then display the digital component or perform a selection process using the digital component and other digital components received from the SSP 170, as described above.

[0161] In some embodiments, the selected digital components are transmitted to the client device 110 using a mask to prevent either computing system MPC1 or MPC2 from gaining access to the selected digital components in the clear and to reduce latency and bandwidth consumption in transmitting the digital components to the client device 110. In this example, the application 112 may select a nonce for each digital component request and transmit the nonce with the digital component request. The application 112 may transmit the nonce to one of the computing systems MPC1 or MPC2. For purposes of illustration, it is assumed that the nonce is transmitted to the computing system MPC2.

[0162] Both application 112 and computing system MPC2 can independently compute a mask of the same size as the largest digital component creation using the same algorithm and the same input. For example, the i-th bit of the mask can be represented as PRF(nonce, i), where PRF represents a pseudorandom function. Both application 112 and computing system MPC2 can keep the nonce and mask strictly secret from computing system MPC1.

[0163] To send the selected digital component to application 112, computing system MPC2 can send the [result2] bitwise XOR mask to computing system MPC1. Computing system MPC1 then sends the [result1] bitwise XOR([result2] bitwise XOR mask) to application 112 as the selected result, e.g., in response to the digital component request.

[0164] The application 112 computes the bitwise XOR mask of [result1] bitwise XOR([result2] bitwise XOR mask) as the digital component creation, which is equivalent to [result1] bitwise XOR[result2]. This reduces the bandwidth required for the maximum creation size while preserving private information extraction guarantees. This reduces the bandwidth of the response to the transmission of the two secret shares of the selection result, as described above. Thus, there is little or no additional latency or bandwidth consumption in this privacy-preserving technique relative to the transmission of the digital component creation as in other processes.

[0165] 5 is a diagram of an exemplary process for determining whether a digital component is eligible for selection. The operations of process 500 may be performed, for example, by computing system MPC1 or computing system MPC2 of MPC cluster 130. The operations of process 500 may be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices may cause the one or more data processing devices to perform the operations of process 500.

[0166] A computing system MPC1 obtains 502 a set of context characteristics of the environment in which the selected digital component will be displayed at a client device. A computing system MPC2 also obtains 504 the same set of context characteristics.

[0167] The set of context characteristics may be received from the client device 110 and / or the content platform, e.g., SSP 170 and / or one or more DSPs 150. For example, the client device 110 may provide the set of context characteristics to the computing systems MPC1 and MPC2 along with the digital component request. The content platform may also infer the context characteristics of the environment, as described above. As described above, the context characteristics may include data about the resource on which the digital component is displayed, data about the user of the client device 110, data about the application 112 displaying the digital component, data about the client device 110, and / or general context data (e.g., date and time).

[0168] The set of characteristics may be in the form of a vector of characteristics. In some embodiments, each computing system MPC1 and MPC2 receives a respective secret share of the set of context characteristics, e.g., a respective secret share of the vector of context characteristics.

[0169] Computing system MPC1 obtains eligibility data for the digital component selection items (506). Computing system MPC2 also obtains eligibility data for the digital component selection items (508). The eligibility data may include eligibility expressions and / or eligibility criteria that define the contextual circumstances in which the digital components and selection values ​​of the digital component selection items are available for inclusion in the digital component selection process.

[0170] The eligibility expression can be in the form of a Boolean expression that includes sub-expressions based on the eligibility criteria and a Boolean operator between each pair of sub-expressions, such as Boolean AND, Boolean OR, and unary Boolean NOT. The Boolean NOT operator may operate on a single parameter rather than operating on multiple parameters. Each sub-expression may be based on one or more context characteristics. For example, one sub-expression may require that the geographic location of the client device 110 displaying the digital component is located within a particular geographic region, and another sub-expression may require that the topic of the resource on which the digital component is displayed has one of a set of topics. In this example, the eligibility expression may be expressed as follows: client device location = particular geographic region AND resource topic ∈ set of topics.

[0171] In some cases, for example, when the eligibility of a digital component selection item is conditioned by a single context characteristic, the eligibility expression may include only a single sub-expression, but the MPC cluster 130 can support any Boolean expression, for example, a Boolean expression that includes multiple sub-expressions and logical operators between the sub-expressions, for fine-grained control over how a digital component is displayed with a resource.

[0172] In some implementations, the content platform provides the eligibility formula for the digital component. In such a case, to protect business confidential information, the content platform can provide each secret share of the eligibility formula and the corresponding eligibility criteria to the computing systems MPC1 and MPC2. In this example, the computing system MPC1 receives a first secret share of the eligibility formula and a first secret share of the eligibility criteria. Similarly, the computing system MPC2 receives a second secret share of the eligibility formula and a second secret share of the eligibility criteria.

[0173] The content platform may also provide the eligibility expressions and eligibility criteria in plain text. For example, the content platform may provide the eligibility expressions in the form of script functions or other computer-readable code. In such an example, the computing systems MPC1 and MPC2 may determine whether the digital component selection items are eligible by executing the script or other code in a sandbox environment. The sandbox environment may be isolated from the execution of other code. Using the sandbox environment may prevent the script from making any input / output requests or obtaining any data that is not provided to the sandbox environment, for example, to preserve user data privacy and protect the computing systems MPC1 and MPC2 from malicious code.

[0174] In some embodiments, the MPC cluster 130 builds the eligibility formula based on eligibility criteria and / or eligibility formula provided by the content platform. For example, the DSP 150 may provide a sub-formula for one of its digital components that defines when the digital component is eligible. Similarly, the SSP 170 may provide a sub-formula for a resource that defines characteristics of the digital component that are not allowed to be displayed with the resource. When the digital component request is for displaying the digital component with the resource, the MPC cluster 130 may access the sub-formula for the resource and the sub-formula for the digital component to build the eligibility formula. For example, the computing systems MPC1 and MPC2 may combine the sub-formula of SSP 170 with the sub-formula of DSP 150 using an AND operator, since both sets of sub-formulas must be satisfied for the digital component to be eligible to be displayed with the resource. If the eligibility formula is provided to the computing systems MPC1 and MPC2 using secret shares, the computing systems MPC1 and MPC2 may evaluate whether both sets of sub-formulas are satisfied using a secure MPC process, as described below.

[0175] Using eligibility expressions reduces the amount of data stored by computing systems MPC1 and MPC2 compared to using large cache search keys, which also increases the flexibility of publishers' and digital component providers' control of the display of digital components without increasing the data storage requirements of computing systems MPC1 and MPC2, which allows computing systems MPC1 and MPC2 to store more digital components, information about the digital components, and / or other related information in high speed memory, e.g., a high speed cache.

[0176] The MPC cluster 130 can support various types of sub-expressions and can evaluate each type using a secure MPC process based on a secret share of eligibility criteria. Some example types include set intersection checks, equality tests, comparisons, and truth tables.

[0177] A set intersection check may be used to determine if a characteristic is a member of a set of characteristics. This may be used to determine if a digital component has a characteristic that a publisher of a resource does not want to appear with the resource. For example, a publisher may block a digital component that has content related to a particular item. A set intersection check may be used to check if a particular item matches one of the characteristics in the set of characteristics of the digital component.

[0178] Each digital component selection item is dcsi Some characteristics of the digital component may be determined by the SSP 170 on behalf of the publisher and attached to the digital component selection item. For example, during the digital component review process, the SSP 170 may determine that the digital component is about a particular item and attach the particular item as one of the SSP-determined characteristics to the digital component selection item. The set of SSP-determined characteristics may be expressed as S dcsi,SSP It can be called.

[0179] SSP170 is, for example, the formula P ∈ S dcsi The MPC cluster 130 can be instructed not to select digital components related to a particular item on the publisher's resources by providing a dcsirepresents a characteristic of the digital component, which may include characteristics inferred by SSP 170. SSP 170 may indicate to MPC cluster 130 that the digital component is not eligible for selection if the characteristic is within the set of characteristics of the digital component.

[0180] Similarly, some characteristics of a digital component may be determined by the DSP 150 on behalf of the digital component provider 160 that issues the digital component and attached to the digital component selection item. If the DSP wants the digital component to be displayed only with resources related to sports, the DSP 150 may add the characteristic "sports" to the digital component selection item as one of the DSP-determined characteristics. The set of DSP-determined characteristics may be S dcsi,DSP It can be called.

[0181] The DSP 150 can instruct the MPC cluster 130 to allow a digital component to be eligible for selection if a particular characteristic, e.g., “sports”, is included in the set of context characteristics of the digital component request. To do so, the DSP 150 can instruct the MPC cluster 130 to allow a digital component to be eligible for selection if a particular characteristic, e.g., “sports”, is included in the set of context characteristics of the digital component request. dcsi where P represents one or more desired characteristics (i.e., sports) for which the digital component is qualified, and S dcsi represents a characteristic of a digital component. The DSP 150 can indicate to the MPC cluster 130 that the digital component is not eligible for selection if the characteristic is within the set of characteristics of the digital component.

[0182] An equality test may be used to determine whether a characteristic has a particular value. For example, the geographic location of the client device 110 may have many different values, while the DSP 150 may want a particular selection value of a digital component to be eligible only in one of the possible locations. An equality test may be used to determine whether a particular characteristic in a set of context characteristics has a particular value, or whether a particular characteristic of the characteristics of a digital component has a particular value. The content platform may instruct the MPC cluster 130 to perform an equality test to determine whether a particular characteristic of either the context characteristic or the digital component characteristic has a particular value.

[0183] Characteristics can be ordered by clearly defined comparison tests. For example, if a digital component selection item is only valid for users over the age of 60, the digital component selection item can have an expression with a characteristic "minimum age" that has a value of 60. The DSP 150 can instruct the MPC cluster 130 to compare the minimum age characteristic with the user's age, which may be included in the set of context characteristics.

[0184] The content platform can generate eligibility expressions that include multiple types of sub-expressions, including one or more set intersection checks, one or more equality tests, and / or one or more comparisons. This provides fine-grained control over the context in which the digital component may be displayed and the content of the digital component displayed on the publisher resource. An example expression could be as follows:

number

[0185] In this example, the characteristic S of the digital component dcsidoes not contain the specified item, the location of the client device 110 is within a specified state, and the age of the user of the client device 110 is equal to or greater than a minimum age. Although only the AND operator is used in this example, other Boolean operators such as OR, XOR, NOT, etc. may also be used.

[0186] The computing systems MPC1 and MPC2 evaluate the eligibility formula (510). The computing systems MPC1 and MPC2 evaluate the eligibility formula of each digital component to determine whether the digital component is eligible for selection. As described above, the evaluation may be performed in a sandbox if the eligibility formula and corresponding eligibility criteria are provided to the computing systems MPC1 and MPC2 in plaintext.

[0187] In some situations, the set of characteristics associated with a digital component selection item and / or the context characteristics of a digital component request may be confidential or sensitive. For example, DSP 150 may not want to inform a particular publisher that DSP 150 will not allow a particular digital component or set of digital components to be displayed on the publisher's resources because of how the resources are categorized. In another example, SSP 170 may not want to reveal to a digital component provider that a particular resource is available to display digital components of one provider but not digital components of another provider.

[0188] To prevent such data from being leaked, MPC cluster 130 can use a secure MPC process to determine whether a digital component is eligible. Instead of receiving the set of context characteristics, the eligibility formulas, and the eligibility criteria in plaintext, each computing system MPC1 and MPC2 can receive a respective secret share of the set of context characteristics, a respective secret share of the eligibility formulas, and a respective secret share of the eligibility criteria. Then, computing systems MPC1 and MPC2 can run a secure MPC process using the secret shares to determine whether a digital component selection item is eligible.

[0189] For the set intersection check, the characteristics may be encoded using, for example, a vector, a Bloom filter, or a distributed point function (DPF), depending on the number of characteristics to be encoded. If the number of characteristics is limited, e.g., less than 100, 500, or other suitable threshold, a vector may be used efficiently. To protect the secret information, the vector or characteristic may be split into two vectors of additive secret shares of Z2. For example, if the first element of the vector represents whether the digital component selection item is associated with a particular item, and if the digital component is indeed associated with a particular item, there may be a secret vector S where S[0] = 1. In this example, element 0 of vector S represents the particular item. The two vectors of additive secret shares are S1 and S2, respectively, where S1[0] XOR S2[0] == 1. In this example, a computing system MPC1 may receive a first secret share S1 of vector S, and a computing system MPC2 may receive a second secret share S2 of vector S. If no digital component is associated with a particular item, then the equations are S[0] = 0 and S1[0] XOR S2[0] == 0.

[0190] The vector may be used to encode a limited number of characteristics of the digital component of the digital component selection item and a set of context characteristics of the digital component request. Let S1 and S2 denote the vector of secret shares for the digital component selection items held by MPC1 and MPC2, respectively. This vector encodes characteristics about the digital component, e.g., characteristics of the digital component or characteristics of the environment in which the digital component is or is not eligible.

[0191] Let P1 and P2 represent vectors of secret shares for digital component requests held by MPC1 and MPC2, respectively. This vector encodes the contextual properties of the digital component request. Conceptually, let common_properties represent reconstruct(S1, S2) = reconstruct(P1, P2). The computational systems MPC1 and MP2 can use a secure MPC process to compute common_properties on the secret shares by evaluating the secret shares of the vectors and comparing corresponding elements of the vectors. If an element of common_properties has a value of 1, then both the digital component selection item and the current digital component request share the same property corresponding to the element. When the data types of S and P are Boolean rather than integer, the comparison operation can be optimized to a logical XOR, which does not require an extra round trip in the secure MPC protocol.

[0192] To implement the block list such that a digital component selection item is ineligible for selection if it is associated with any property specified for the current digital component request, the computing systems MPC1 and MPC2 check the elements of common_properties, computed with a secret share to protect the user's privacy: If all elements have value 0, the digital component selection item is not blocked for the current request.

[0193] To implement a valid list such that a digital component selection item is eligible for selection if a cached bid is associated with any characteristic specified for the current digital component request, the computing systems MPC1 and MPC2 check the elements of common_properties: If all elements have value 0, the digital component selection item is blocked for the current digital component request.

[0194] There are several techniques that can be used to compute the common_properties and check whether all elements of the common_properties have the value 0. One technique is Goldreich-Micali-Wigderson (GMW) with Oblivious Transfer (OT), another technique is Garbled Circuits. Both techniques utilize one online round of online communication between two computing systems MPC1 and MPC2.

[0195] When there are a large number of features (e.g., above a threshold number of features), using vectors may not be as efficient as using Bloom filters or DPFs. If the average number of features of the digital component selection items and digital component requests is small compared to the total number of features, and if the use case can tolerate a certain level of false positive rate (FPR), the features can be coded with Bloom filters. Otherwise, the features may be coded with DPFs. In either solution, the communication bandwidth between the content platform and the MPC cluster 130 is reduced.

[0196] For the equality test, assume that for a digital component selection item, MPC1 and MPC2 hold two secret shares [p1] and [p2] of the characteristics of the digital component selection item, respectively. For a digital component request, SSP170 sends two secret shares [q1] and [q2] of the characteristics of the digital component request (e.g., a set of context characteristics) to MPC1 and MPC2, respectively. MPC1 and MPC2 compare the two secret messages p and q for equality, where p = reconstruct([p1], [p2]) and q = reconstruct([q1], [q2]).

[0197] The following two assertions, p and q being equal, are equivalent to pq = 0. With this observation, an alternative protocol is that MPC cluster 130 may use secret share computation to compute tmp = pq and determine whether tmp is equal to 0. To do so, MPC1 computes [tmp1] = [p1] - [q1] and MPC2 computes [tmp1] = [p2] - [q2]. Then, computation systems MPC1 and MPC2 may use GMW or garbling circuits to determine whether the secret message tmp is equal to 0 (i.e., all bits of tmp are 0).

[0198] In addition to the above expressions, the MPC cluster 130 may support truth tables that define controls for determining whether a digital component selection item is eligible for selection in response to a digital component request. The MPC cluster 130 can generate the truth tables based on the eligibility expressions.

[0199] After evaluating the various sub-expressions, the computation systems MPC1 and MPC2 can evaluate the Boolean operator of the eligibility expression. The result of some of the sub-expressions can be a secret share held by each computation system MPC1 and MPC2, so that the computation systems MPC1 and MPC can evaluate the Boolean operator using a secure MPC process. The result of this is also an eligibility parameter eligibility_check that indicates whether the digital component selection item is eligible. i For example, the computing system MPC1 may generate a first secret share [eligibility_check i.1 ], and the computing system MPC2 may have a second secret share [eligbility_check i.2 ]. The computing systems MPC1 and MPC2 can then use secret shares of the eligibility parameters as part of the process for selecting digital components, as described above.

[0200] 6 is a diagram of an example process 600 for determining a best other selection value of a digital component in a digital component selection process. The operations of process 600 may be performed, for example, by computing system MPC1 or MPC2 of MPC cluster 130 in cooperation with other computing systems of MPC cluster 130. The operations of process 600 may be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices may cause the one or more data processing devices to perform the operations of process 600.

[0201] The computing system obtains (602) at least a first share of a set of contextual characteristics of an environment in which the selected digital component is displayed at the client device. The set of contextual characteristics may be received from the client device 110 and / or a content platform, e.g., SSP 170 and / or one or more DSPs 150. For example, the client device 110 may provide the set of contextual characteristics to the computing systems MPC1 and MPC2 along with the digital component request. The content platform may also infer the contextual characteristics of the environment, as described above. As described above, the contextual characteristics may include data about the resource in which the digital component is displayed, data about the user of the client device 110, data about the application 112 displaying the digital component, data about the client device 110, and / or general contextual data (e.g., date and time).

[0202] The computing system may receive a first secret share of the set of context characteristics. Each other computing system in the MPC cluster 130 may receive a second secret share of each of the set of context characteristics.

[0203] The computing system obtains, for each digital component in the set of digital components, at least a first share of a eligibility expression that defines a relationship between a set of eligibility criteria of the digital components (604). As described above, a eligibility expression may include one or more sub-expressions, unary Boolean operators such as NOT, and Boolean operators between pairs of sub-expressions.

[0204] The computing system may receive a first secret share of the eligibility formula and a first secret share of the eligibility criteria for the eligibility formula. Each other computing system in the MPC cluster 130 may receive a second secret share for each of the set of eligibility formulas and a second secret share for each of the eligibility criteria.

[0205] The computing system determines, for each digital component, at least a first share of a eligibility parameter indicating whether the digital component is eligible for selection for display at a client device based on at least a first share of the set of context characteristics and at least a first share of the eligibility formula (606). The computing system may determine the first share of the eligibility parameter using process 500 shown in FIG. 5 and described above. Each other computing system of the MPC cluster 130 may determine a second share of the eligibility parameter as part of process 500.

[0206] The computing system, in cooperation with each other computing system in the MPC cluster, executes a secure MPC process to select as a selected digital component a given digital component from a set of eligible digital components, with each digital component having an eligibility parameter indicating that the digital component is eligible for selection (608). The computing system may use the process 400 shown in FIG. 4 and described above to select a digital component in cooperation with the other computing systems.

[0207] The computing system generates 610 a first share of a selection result that identifies the selected digital component as a result of the secure MPC process. Each other computing system in the MPC cluster 130 generates a respective second share of the selection result. The computing systems may determine their shares of the selection result as part of the process 400 shown in FIG. 4 and described above.

[0208] The computing system sends 612 a first share of the selection to the client device, and each other computing system in MPC cluster 130 sends its respective second share of the selection to the client device, so that the client device can access and display the selected digital components.

[0209] In some implementations, the MPC cluster 130 can use the garbling circuitry for a secure MPC process to determine whether a digital component is a candidate for the selection process, e.g., to determine secret shares of candidate parameters for the digital component. Because there can be many conditions, possibly dozens, per digital component, there are many gates in the garbling circuitry for each digital component. Reducing the number of gates reduces the bandwidth cost for running the secure MPC protocol and significantly reduces the latency in selecting a digital component.

[0210] For example, there are many repetitive computations and logical AND calculations between the same pairs of inputs or intermediate Boolean variables for the same digital component, or for groups of digital components. To avoid duplicate computations of sub-expressions and thus reduce the number of AND operations, a greedy method may be used.

[0211] In the above process, the candidate parameter is_dc_a_candidate is Z P The selected value may be assumed to be within the range of 0 to 1. The MPC cluster 130 iterates through all cached digital components from the digital components with the selected value (e.g., the portion attributed to the publisher) from highest to lowest. For each cached digital component i, the MPC cluster 130 calculates the cumulative value acc i Calculate Z P In acc iCalculate == 0. The result is converted back to Z2. Convert Z2 to Z p Conversion to and from Z increases the complexity of the protocol. p Equivalence test in acc i == 0 can take log2(p) gates, which is a significant performance and bandwidth cost.

[0212] The MPC cluster 130 determines the candidate parameter is_dc_a_candidate i Z2 and, at much lower computation and bandwidth cost, the accumulated value acc is calculated in Z2 by a Boolean circuit. i , then acc i == 0. To do this, we use the accumulated value acc i is limited to two possible values: 0 if none of the candidate digital components have a higher selection value than the current selection value of the current digital component i, or 1 if at least one candidate digital component has a higher selection value than the current selection value of the current digital component i. In the process described above, the cumulative value could be greater than 1 when incremented for each candidate digital component.

[0213] With the updated semantics of the cumulative value acc, the MPC cluster 130 iterates over all cached digital components from the highest selected value to the lowest selected value, as follows: i The accumulated value acc for the digital component with the highest selection value is always 0. No calculation is required.

[0214] The accumulated value acc for the digital component with the second highest selection value is always equal to the value of the candidate parameter is_dc_a_candidate of the digital component with the highest selection value. Again, no calculation is required.

[0215] Assume that the MPC cluster 130 has already calculated the accumulated value acc for the digital component with the nth highest selection value. The accumulated value acc for the digital component with the (n+1)th highest selection value is acc n+1 = acc n OR is_dc_a_candidate n The MPC cluster 130 may calculate the winner parameter is_dc_a_winner as n+1 = is_dc_a_candidate n+1 AND NOT acc n+1 can be further calculated.

[0216] The MPC cluster 130 has four lines for each cached digital component, e.g., two input lines (acc n and is_dc_a_candidate n ) and two output lines (acc n+1 and is_dc_a_winner n+1 ) With these extensions, the MPC cluster 130 may need only two gates per cached digital component, instead of dozens of gates. This cryptographic process may be performed as part of determining the suitability of the candidates, as described above.

[0217] 7 is a block diagram of an exemplary computer system 700 that may be used to perform the operations described above. System 700 includes a processor 710, a memory 720, a storage device 730, and an input / output device 740. Each of the components 710, 720, 730, and 740 may be interconnected, for example, using a system bus 750. Processor 710 is capable of processing instructions for execution within system 700. In some implementations, processor 710 is a single-threaded processor. In another implementation, processor 710 is a multi-threaded processor. Processor 710 is capable of processing instructions stored in memory 720 or on storage device 730.

[0218] The memory 720 stores information within the system 700. In one implementation, the memory 720 is a computer-readable medium. In some implementations, the memory 720 is a volatile memory unit. In another implementation, the memory 720 is a non-volatile memory unit.

[0219] The storage device 730 is capable of providing mass storage for the system 700. In some implementations, the storage device 730 is a computer-readable medium. In various different implementations, the storage device 730 may include, for example, a hard disk device, an optical disk device, a storage device shared over a network by multiple computing devices (e.g., a cloud storage device), or some other mass storage device.

[0220] The input / output device 740 performs input / output operations for the system 1000. In some implementations, the input / output device 740 may include one or more of a network interface device, e.g., an Ethernet card, a serial communication device, e.g., and an RS-232 port, and / or a wireless interface device, e.g., and an 802.11 card. In another implementation, the input / output device may include a driver device configured to receive input data and send output data to an external device 760, e.g., a keyboard, a printer, and a display device. However, other implementations may be used, such as a mobile computing device, a mobile communication device, a set-top box, a television client device, etc.

[0221] Although an exemplary processing system is illustrated in FIG. 7, implementations of the subject matter and functional operations described herein can be implemented in other types of digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed herein and their structural equivalents, or in combinations of one or more of them.

[0222] The subject embodiments and operations described herein may be implemented in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed herein and structural equivalents thereof, or in a combination of one or more of them. The subject embodiments described herein may be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on computer storage medium(s) for execution by or to control the operation of a data processing device. Alternatively or additionally, the program instructions may be encoded on an artificially generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal, that is generated to encode information for transmission to a suitable receiver device for execution by the data processing device. The computer storage medium may be or may be included in a computer readable storage device, a computer readable storage substrate, a random or serial access memory array or device, or a combination of one or more of them. Moreover, although a computer storage medium is not a propagating signal, a computer storage medium may be a source or destination of computer program instructions encoded in an artificially generated propagated signal. A computer storage medium may also be, or be contained in, one or more separate physical components or media (eg, multiple CDs, disks, or other storage devices).

[0223] The operations described herein may be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0224] The term "data processing apparatus" encompasses any kind of apparatus, device, and machine for processing data, including, by way of example, a programmable processor, a computer, a system on a chip, or a plurality or combination of the above. The apparatus may include special-purpose logic circuitry, such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC). In addition to hardware, the apparatus may also include code that creates an execution environment for the computer program in question, such as code that constitutes a processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or one or more combinations thereof. The apparatus and execution environment may implement a variety of different computing model infrastructures, such as web services, distributed computing infrastructures, and grid computing infrastructures.

[0225] A computer program (also referred to as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted, declarative or procedural, and can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may correspond to a file in a file system, but need not. A program can be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program, or in multiple cooperating files (e.g., files that store one or more modules, subprograms, or portions of code). A computer program can be deployed to run on one computer or on multiple computers located at one site or distributed across multiple sites and interconnected by a communication network.

[0226] The processes and logic flows described herein may be performed by one or more programmable processors executing one or more computer programs to perform actions by operating on input data and generating output. The processes and logic flows may also be performed by, and devices may be implemented as, special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit).

[0227] Processors suitable for executing computer programs include, by way of example, both general-purpose and special-purpose microprocessors. Generally, a processor will receive instructions and data from a read-only memory or a random access memory, or both. The essential elements of a computer are a processor for performing actions according to instructions, and one or more memory devices for storing instructions and data. Generally, a computer also includes one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or is operatively coupled to receive data from or transfer data to them, or both. However, a computer is not required to have such devices. Moreover, a computer may be incorporated into another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), to name just a few examples. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, non-volatile media, and non-volatile memory devices, including, by way of example, semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices, magnetic disks, e.g., internal hard disks or removable disks, magneto-optical disks, and CD-ROM and DVD-ROM disks. The processor and memory may be augmented by, or incorporated in, special purpose logic circuitry.

[0228] To provide for interaction with a user, embodiments of the subject matter described herein may be implemented on a computer having a display device, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, for displaying information to the user, as well as a keyboard and a pointing device, such as, for example, a mouse or trackball, by which the user can provide input to the computer. Other types of devices may also be used to provide for interaction with the user. For example, feedback provided to the user may be any form of sensory feedback, for example, visual feedback, auditory feedback, or tactile feedback, and input from the user may be received in any form, including acoustic input, speech input, or tactile input. Additionally, the computer may interact with the user by sending documents to a device used by the user and receiving documents from the device, for example, by sending a web page to a web browser on the user's client device in response to a request received from the web browser.

[0229] An embodiment of the subject matter described herein may be implemented in a computing system that includes back-end components, e.g., as a data server, or includes middleware components, e.g., an application server, or includes front-end components, e.g., a client computer having a graphical user interface or web browser through which a user may interact with an embodiment of the subject matter described herein, or includes any combination of one or more such back-end, middleware, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication, e.g., a communications network. Examples of communications networks include local area networks ("LANs") and wide area networks ("WANs"), internetworks (e.g., the Internet), and peer-to-peer networks (e.g., ad-hoc peer-to-peer networks).

[0230] A computing system may include clients and servers. Clients and servers are generally remote from each other and typically interact through a communication network. The relationship of clients and servers arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. In some embodiments, the server sends data (e.g., HTML pages) to the client devices (e.g., to display the data to and receive user input from a user interacting with the client device). Data generated at the client device (e.g., the result of a user interaction) may be received at the server from the client device.

[0231] Although this specification contains many specific implementation details, these should not be interpreted as limitations on the scope of any invention or what may be claimed, but rather as descriptions of features specific to certain embodiments of a particular invention. Some features described in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented in multiple embodiments separately or in any suitable subcombination. Moreover, although features may be described above as working in some combinations and may even be initially claimed as such, one or more features from the claimed combination may, in some cases, be deleted from the combination, and the claimed combination may be directed to a subcombination or a variation of the subcombination.

[0232] Similarly, although operations are shown in the figures in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown, or in a sequential order, or that all of the illustrated operations be performed, to achieve desirable results. In some situations, multitasking and parallel processing may be advantageous. Moreover, the separation of various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the program components and systems described may generally be incorporated together in a single software product or packaged in multiple software products.

[0233] Thus, specific embodiments of the present subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some implementations, multitasking and parallel processing may be advantageous. [Explanation of symbols]

[0234] 100 Environment 105 Data Communication Network 110 Client Devices 112 Applications 130 Secure MPC Cluster 140 Publisher 142 websites 145 Electronic Resources, Resources 150 DSP 160 Digital Component Providers 170 SSP 310 Digital Component Requirements 400 processes 500 processes 700 Computer Systems 710 Processor 720 Memory 730 Storage Devices 740 Input / Output Devices 750 System Bus 760 External Devices 1000 Systems

Claims

1. 1. A computer-implemented method, comprising: obtaining, by a first computer of a secure multi-party computing (MPC) system including a plurality of computers, at least a first share of a set of contextual characteristics of an environment in which a selected digital component is displayed at a client device, the at least first share of the set of contextual characteristics including all of the contextual characteristics in the set of contextual characteristics; For each digital component in the set of digital components: (i) obtaining, by the first computer, at least a first share of a qualification equation defining a relationship between a set of qualification criteria for the digital components, the at least first share of the qualification equation including an entirety of the qualification equation; (ii) determining, by the first computer, at least a first share of a suitability parameter indicating whether the digital component is eligible for selection for display at the client device based on the at least a first share of the set of context characteristics and the at least a first share of the suitability formula; and executing, by the first computer in cooperation with one or more second computers of the secure MPC system, a secure MPC process to select as the selected digital component a given digital component from a set of eligible digital components, each digital component having an eligibility parameter indicating that the digital component is eligible for selection; generating, by the first computer, a first share of a selection result as a result of the secure MPC process, the first share identifying the selected digital components; transmitting, by the first computer, the first share of the selections to the client device; 4. A computer-implemented method comprising:

2. 2. The computer-implemented method of claim 1, wherein obtaining at least a first share of the set of contextual features comprises receiving a first secret share of the set of contextual features from one of the client device or a content platform.

3. The step of determining the at least a first share of the eligibility parameter indicating whether the digital component is eligible for selection includes evaluating the eligibility expression based on the set of context characteristics within a sandbox environment isolated from execution of other code.

2. The computer-implemented method of claim 1.

4. 2. The computer-implemented method of claim 1, wherein determining the at least a first share of the eligibility parameter indicating whether the digital component is eligible for selection based on the at least a first share of the set of context characteristics and the at least a first share of the eligibility formula comprises executing a second secure MPC process in cooperation with the one or more second computers to determine a first secret share of the eligibility parameter.

5. A computer-implemented method comprising: obtaining, by a first computer of a secure multi-party computing (MPC) system including a plurality of computers, at least a first share of a set of contextual characteristics of an environment in which the selected digital component is displayed at a client device; For each digital component in the set of digital components: (i) obtaining, by the first computer, at least a first share of a fitness equation defining a relationship between a set of fitness criteria for the digital components; (ii) determining, by the first computer, at least a first share of a suitability parameter indicating whether the digital component is eligible for selection for display at the client device based on the at least a first share of the set of context characteristics and the at least a first share of the suitability formula; executing, by the first computer in cooperation with one or more second computers of the secure MPC system, a secure MPC process to select as the selected digital component a given digital component from a set of eligible digital components, each digital component having an eligibility parameter indicating that the digital component is eligible for selection; generating, by the first computer, a first share of a selection result as a result of the secure MPC process, the first share identifying the selected digital components; transmitting, by the first computer, the first share of the selections to the client device; Including, the at least a first share of the set of eligibility criteria for a particular digital component comprises a first secret share of a vector of characteristics of the particular digital component; the set of context characteristics comprises a vector of the context characteristics; the well-formedness equation for the particular digital component includes a set intersection check; determining the at least a first share of the eligibility parameter of the particular digital component includes using a second secure MPC process in cooperation with the one or more second computers of the secure MPC system to determine that an intersection exists between at least one element of the vector of characteristics of the particular digital component and at least one element of the vector of context characteristics; Computer-implemented method.

6. the eligibility expression defines the vector of characteristics of the particular digital component as a block list in which the particular digital component is ineligible for selection when one or more elements of the vector of characteristics of the particular digital component match one or more corresponding elements of the vector of context characteristics; determining the at least a first share of the eligibility parameter of the particular digital component includes, in response to determining that an intersection exists between the at least one element of the vector of characteristics of the particular digital component and the at least one element of the vector of context characteristics, setting a value of the at least a first share of the eligibility parameter to indicate that the particular digital component is ineligible for selection for display at the client device.

6. The computer-implemented method of claim 5.

7. the eligibility expression defines the vector of characteristics of the particular digital component as a valid list in which the particular digital component is eligible for selection when one or more elements of the vector of characteristics of the particular digital component match one or more corresponding elements of the vector of context characteristics; determining the at least a first share of the eligibility parameter of the particular digital component comprises, in response to determining that an intersection exists between the at least one element of the vector of characteristics of the particular digital component and the at least one element of the vector of context characteristics, setting a value of the at least a first share of the eligibility parameter to indicate that the particular digital component is eligible for selection for display at the client device.

6. The computer-implemented method of claim 5.

8. A computer-implemented method comprising: obtaining, by a first computer of a secure multi-party computing (MPC) system including a plurality of computers, at least a first share of a set of contextual characteristics of an environment in which the selected digital component is displayed at a client device; For each digital component in the set of digital components: (i) obtaining, by the first computer, at least a first share of a fitness equation defining a relationship between a set of fitness criteria for the digital components; (ii) determining, by the first computer, at least a first share of a suitability parameter indicating whether the digital component is eligible for selection for display at the client device based on the at least a first share of the set of context characteristics and the at least a first share of the suitability formula; executing, by the first computer in cooperation with one or more second computers of the secure MPC system, a secure MPC process to select as the selected digital component a given digital component from a set of eligible digital components, each digital component having an eligibility parameter indicating that the digital component is eligible for selection; generating, by the first computer, a first share of a selection result as a result of the secure MPC process, the first share identifying the selected digital components; transmitting, by the first computer, the first share of the selections to the client device; Including, the at least a first share of the set of eligibility criteria for a particular digital component comprises a first secret share of a first Bloom filter comprising a characteristic of the particular digital component; the set of context features includes a second Bloom filter that includes the context features; the well-formedness equation for the particular digital component includes a set intersection check; determining the at least a first share of the eligibility parameter of the particular digital component includes using a second secure MPC process in cooperation with the one or more second computers of the secure MPC system to determine that an intersection exists between at least one element of the first Bloom filter and at least one element of the second Bloom filter; Computer-implemented method.

9. The computer-implemented method of claim 1 , wherein the eligibility formula for a particular digital component includes a comparison between a given characteristic of the digital component and a corresponding characteristic of the set of context characteristics.

10. The computer-implemented method of claim 1 , wherein the eligibility formula for a particular digital component comprises an equivalence test between a given characteristic of the digital component and a corresponding characteristic of the set of context characteristics.

11. 10. The computer-implemented method of claim 1, wherein the eligibility formula for a particular digital component comprises a truth table that defines when the particular digital component is eligible for selection.

12. 2. The computer-implemented method of claim 1, wherein the well-formedness expression comprises a Boolean expression including two or more sub-expressions and a Boolean operator for each pair of sub-expressions.

13. 13. The computer-implemented method of claim 12, wherein the two or more sub-expressions include two or more of: (i) a set intersection check, (ii) an equality test, and (iii) a comparison test.

14. 2. The computer-implemented method of claim 1, wherein the set of contextual characteristics includes at least one of: (i) data about a resource on which the selected digital component is displayed; (ii) data about a user of the client device; (iii) data about an application on which the digital component is displayed; or (iv) data about the client device.

15. 1. A system comprising: one or more processors; one or more storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform the method of any one of claims 1 to 14; A system comprising:

16. A computer-readable storage medium carrying instructions that, when executed by one or more processors, cause the one or more processors to perform the method of any one of claims 1 to 14.

17. A computer program comprising instructions which, when executed by one or more computers, cause the one or more computers to carry out the method of any one of claims 1 to 14.

Images