Privacy-Preserving Supplemental Content Protocol With Secret Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current implementations of supplemental content services do not adequately protect user privacy, as user-private data, such as user-to-segment maps, are stored on third-party servers and can be deduced over time, leading to potential leaks of proprietary information.
Innovation Solution
A two-phase secure cryptographic process involving secret sharing and user segment clustering is implemented to ensure that neither the content server nor the supplemental content server learns user-identifying information, using techniques like secret sharing, oblivious transfer, and multi-party computations to select user-specific supplemental content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If user-to-segment map is stored on third-party supplemental content server, then content selection capability is improved, but user privacy protection deteriorates
Solution Approach 1:
The user-to-segment map is divided into two separate secret shares stored on different servers. The content server holds one share while the supplemental content server holds the other share. Neither server can independently access the complete user-private information, thus protecting user privacy while enabling collaborative content selection when shares are combined during the selection process.
Solution Approach 2:
A cryptographic protocol acts as an intermediary mechanism between the content server and supplemental content server. This protocol enables the servers to collaborate on content selection without directly exposing user-private data to each other, using secret sharing and secure computation techniques to mediate the interaction.
2Productivity
If user-private data is stored on supplemental content server, then personalized content delivery is improved, but information leakage risk increases
Solution Approach 1:
The complete user-to-segment map is segmented into multiple secret shares distributed across different servers. The supplemental content server receives only a portion (one secret share) of the user-private information, which is insufficient to reconstruct the full user profile or segments. This segmentation enables personalized content delivery while preventing information leakage.
Solution Approach 2:
Each server is assigned a specific role and receives data with appropriate local quality - the content server has user identification capability while the supplemental content server has content selection capability. The secret shares are distributed such that each server possesses only the specific portion needed for its local function, preventing either server from accessing complete user-private information.
3Reliability
If encryption is applied to user segment data, then data security is improved, but deduction attacks over time remain possible
Solution Approach 1:
Instead of encrypting the complete user-to-segment map, the data is segmented into secret shares distributed across multiple servers. This prevents any single server from having enough information to perform deduction attacks over time, as each server only holds a fragment that is mathematically insufficient to reconstruct user segments or identify users.
Solution Approach 2:
The secret sharing is performed in advance before any content selection operations. By pre-distributing the secret shares and establishing the privacy-preserving structure beforehand, the system prevents future deduction attacks rather than relying on post-hoc encryption or detection of leakage attempts.
Data Source
AI summary
Embodiments of a privacy preserving supplemental content server (PPSCS) implements a privacy preserving protocol with a content server that requests the PPSCS to serve supplemental content for users. In embodiments, a user-to-segment map (USM) containing user-private information is split into secret shares and stored separately at the PPSCS and the content server. When servicing a request, the USM data is used to identify a key segment of a user, which is in turn used to select a supplemental content for the user. Advantageously, the selection process is performed according to the privacy preserving protocol, which guarantees that (a) the content server does not learn any user-private information about the user in the USM, (b) the PPSCS learns at most one user segment of the user (e.g. the key segment), and (c) the PPSCS cannot track the user over time using any user-private information about the user learned during the execution.