Systems and methods for establishing a link between identifiers without disclosing specific identifying information

Systems and methods may be used for establishing a link between user identifiers of different systems without disclosing specific user identifying information. One method includes generating a matching relationship based on double encrypted one or more first data sets of a first party system and double encrypted one or more second data sets of a second party system. The matching relationship indicates one or more links between match keys associated with the first party system and the match keys associated with the third party system. The method includes assigning bridge identifiers for user identifiers associated with the first party system and the user identifiers associated with the third party system based on the matching relationship.

BACKGROUND

Web data may include user identifiable information that businesses store in protected databases. Businesses that manage systems that store user identifiable information may desire to establish a link between the identifiers of two parties without disclosing specific user identifying information.

SUMMARY

One illustrative method is a method for establishing a link between user identifiers of different systems without disclosing specific user identifying information. The method includes encrypting, by a first party system, one or more first data sets each including a match key and a user identifier associated with the first party system and sending, by the first party system, the encrypted one or more first data sets to a third party system. The method includes receiving, by the first party system from the third party system, one or more encrypted second data sets each including a match key and a user identifier associated with the third party system and receiving, by the first party system from the third party system, one or more double encrypted first data sets, the one or more double encrypted first data sets including the encrypted one or more first data sets further encrypted by the third party system. The method further includes encrypting, by the first party system, the encrypted one or more second data sets received from the third party system to generate one or more double encrypted second data set. The method includes generating, by the first party system, a matching relationship based on the double encrypted one or more first data sets and the double encrypted one or more second data sets, the matching relationship indicating one or more links between the match keys associated with the first party system and the match keys associated with the third party system and assigning, by the first party system, bridge identifiers for the user identifiers associated with the first party system and the user identifiers associated with the third party system based on the matching relationship, the bridge identifier being a link between the user identifiers associated with the first party system and the user identifiers associated with the third party system.

In some implementations, the method includes selecting, by the third party system, the user identifiers associated with the third party system for the one or more second data sets to be random points on an elliptic curve and encrypting, by the third party system, the one or more second data sets by exponentiating the selected user identifiers associated with the third party system of the one or more second data sets with a third party deterministic exponent.

In some implementations, the method includes pruning, by the first party system, the matching relationship by removing links from the matching relationship so that each match key associated with the third party system has one link to the match keys of the first party system and each match key associated with the first party system has one link to the match keys of the third party system.

In some implementations, the method includes pruning, by the first party system, the matching relationship by removing one or more of the links between the match keys by determining match keys of the third party system that have more than one link. In some implementations, removing the links of the matching relationship causes some of the user identifiers of the first and third party system to be matched and some of the user identifiers of the first and third party system to not be matched. In some implementations, assigning, by the first party system, bridge identifiers for the user identifiers associated with the first party system and the user identifiers associated with the third party system based on the matching relationship includes assigning both the matched and the unmatched user identifiers of the first party system and the third party system the bridge identifiers.

In some implementations, the method includes exponentiating, by the first party system, one or more first tuples with a first exponent, each first tuple linking the user identifiers associated with the first party system to the bridge identifiers. In some implementations, the method includes sending, by the first party system to the third party system, the one or more exponentiated first tuples. Furthermore the method includes sending, by the first party system to the third party system, one or more second tuples, each second tuple linking one of the user identifiers associated with the third party system to one of the bridge identifiers. In some implementations, the method includes generating, by the third party system, a bridge identifier map by exponentiating the bridge identifiers of the one or more second tuples with a second exponent, exponentiating, by the third party system, the one or more exponentiated first tuples with the second exponent, and sending, by the third party system to the first party system, the one or more exponentiated first tuples. The method may further include generating, by the first party system, a bridge identifier map for the first party system by removing the first exponent from the one or more exponentiated first tuples.

In some implementations, the method includes encrypting, by the first party system, the first data set by encrypting the user identifiers associated with the first party system with an El-Gamal key and encrypting the match keys associated with the first party system with a first party deterministic key. In some implementations, the method includes encrypting, by the third party system, the one or more first data sets to generate one or more double encrypted first data sets by encrypting the encrypted match keys associated with the first party system with a third party deterministic encryption key and raising the encrypted user identifiers encrypted with the El-Gamal key to an exponent.

In some implementations, the method includes sending, by the first party system to the third party system, a first party El-Gamal key, the first party El-Gamal key is a public key of the first party system and receiving, by the first party system from the third party system, a third party El-Gamal key, the third party El-Gamal key is a public key of the third party system. In some implementations, the method includes encrypting, by the first party system, the one or more first data sets include encrypting, by the first party system, the one or more first data sets with the first party El-Gamal key and a first party deterministic key. In some implementations, the method further includes encrypting, by the third party system, the encrypted one or more first data sets with a third party deterministic key to generate one or more double encrypted first data sets and encrypting, by the third party system, the encrypted one or more second data sets by encrypting the match keys associated with the third party system with the third party deterministic key.

In some implementations, the method includes encrypting, by the first party system, each of the assigned bridge identifiers with the first party El-Gamal key and the second party El-Gamal key, sending, by the first party system to the third party system, one or more first tuples including the encrypted bridge identifiers and associated user identifiers associated with the first party system, and sending, by the first party system to the third party system, one or more second tuples including the encrypted bridge identifiers and associated user identifiers associated with the third party system.

In some implementations, the method includes generating, by the third party system, a bridge identifier map for the third party system by decrypting the one or more second tuples with the third party El-Gamal key, de-exponentiating, by the third party system, the one or more first tuples and send the de-exponentiated one or more first tuples to the first party system, and generating, by the first party system, a bridge identifier map for the first party system by decrypting the one or more first tuples with the first party El-Gamal key.

Another implementation of the present disclosure is a first party system for establishing a link between user identifiers of different systems without disclosing specific user identifying information, the first party system including a processing circuit operably coupled to a memory. The processing circuit is configured to encrypt one or more first data sets each including a match key and a user identifier associated with the first party system, send the encrypted one or more first data sets to a third party system, receive, from the third party system, one or more encrypted second data sets each including a match key and a user identifier associated with the third party system, and receive, from the third party system, one or more double encrypted first data sets, the one or more double encrypted first data sets are the encrypted one or more first data sets encrypted by the third party system. The processing circuit is configured to encrypt the encrypted one or more second data sets received from the third party system to generate one or more double encrypted second data sets, generate a matching relationship based on the double encrypted one or more first data sets and the double encrypted one or more second data sets, the matching relationship indicating one or more links between the match keys associated with the first party system and the match keys associated with the third party system, and assign bridge identifiers for the user identifiers associated with the first party system and the user identifiers associated with the third party system based on the matching relationship, the bridge identifier being a link between the user identifiers associated with the first party system and the user identifiers associated with the third party system.

In some implementations, the processing circuit is configured to prune the matching relationship by removing links from the matching relationship so that each match key associated with the third party system has one link to the match keys of the first party system and each match key associated with the first party system has one link to the match keys of the third party system.

In some implementations, the processing circuit is configured to prune the matching relationship by removing one or more of the links between the match keys by determining match keys of the third party system that have more than one link.

In some implementations, the processing circuit is configured to exponentiate one or more first tuples with a first exponent, each first tuple linking the user identifiers associated with the first party system to the bridge identifiers and send, to the third party system, the one or more exponentiated first tuples. In some implementations, the processing circuit is configured to send, to the third party system, one or more second tuples, each second tuple linking one of the user identifiers associated with the third party system to one of the bridge identifiers. The third party system can generate bridge identifier map by exponentiating the bridge identifiers of the one or more second tuples with a second exponent. The processing circuit can be configured to receive, from the third party system, the one or more exponentiated tuples exponentiated with the second exponent and generate a bridge identifier map for the first party system by removing the first exponent from the one or more exponentiated first tuples.

Another illustrative method is a method for establishing a link between user identifiers of different systems without disclosing specific user identifying information. The method includes encrypting, by a first party processing circuit, one or more first data sets each including a match key and a user identifier associated with the first party system, sending, by the first party processing, the encrypted one or more first data sets to a third party processing circuit, and receiving, by the first party processing circuit from the third party processing circuit, one or more encrypted second sets each including a key and a user identifier associated with the third party processing circuit. The method includes receiving, by the first party processing circuit from the third party processing circuit, one or more double encrypted first data sets, the one or more double encrypted first data sets are the encrypted one or more first data sets encrypted by the third party processing circuit, encrypting, by the first party processing circuit, the encrypted one or more second data sets received from the third party processing circuit to generate one or more double encrypted second data sets, and generating, by the first party processing circuit, a matching relationship based on the double encrypted one or more first data sets and the double encrypted one or more second data sets, the matching relationship indicating one or more links between the match keys associated with the first party processing circuit and the match keys associated with the third party processing circuit. Further, the method includes pruning, by the first party processing circuit, the matching relationship by removing one or more of the links between the match keys by determining match keys of the third party processing circuit that have more than one link and assigning, by the first party processing circuit, bridge identifiers for the user identifiers associated with the first party processing circuit and the user identifiers associated with the third party processing circuit based on the pruned matching relationship, the bridge identifier being a link between the user identifiers associated with the first party processing circuit and the user identifiers associated with the third party processing circuit, the bridge identifier being a link between the user identifiers associated with the first party system and the user identifiers associated with the third party system.

In some implementations, the method includes selecting, by the third party processing circuit, the user identifiers associated with the third party processing circuit for the one or more second data sets to be random points on an elliptic curve and encrypting, by the third party processing circuit, the one or more second data sets by exponentiating the selected user identifiers associated with the third party processing circuit of the one or more second data sets with a third party deterministic exponent.

In some implementations, the method includes pruning, by the first party processing circuit, the matching relationship includes removing links from the matching relationship so that each match key associated with the third party processing circuit has one link to the match keys of the first party processing circuit and each match key associated with the first party processing circuit has one link to the match keys of the third party processing circuit.

In some implementations, the method includes exponentiating, by the first party processing circuit, one or more first tuples with a first exponent, each first tuple linking the user identifiers associated with the first party processing circuit to the bridge identifiers, sending, by the first party processing circuit to the third party processing circuit, the one or more exponentiated first tuples, and sending, by the first party processing circuit to the third party processing circuit, one or more second tuples, each second tuple linking one of the user identifiers associated with the third party processing circuit to one of the bridge identifiers. In some implementations, the method includes generating, by the third party processing circuit, a bridge identifier map by exponentiating the bridge identifiers of the one or more second tuples with a second exponent, exponentiating, by the third party processing circuit, the one or more exponentiated first tuples with the second exponent, sending, by the third party processing circuit to the first party processing circuit, the one or more exponentiated first tuples, and generating, by the first party processing circuit, a bridge identifier map for the first party processing circuit by removing the first exponent from the one or more exponentiated first tuples.

In some implementations, the encrypting, by the first party processing circuit, the first data set includes encrypting the user identifiers associated with the first party processing circuit with an El-Gamal key and encrypting the match keys associated with the first party processing circuit with a first party deterministic key. In some implementations, the method further includes encrypting, by the third party processing circuit, the one or more first data sets to generate one or more double encrypted first data sets by encrypting the encrypted match keys associated with the first party processing circuit with a third party deterministic encryption key and raising the encrypted user identifiers encrypted with the El-Gamal key to an exponent.

In some implementations, the method includes sending, by the first party processing circuit to the third party processing circuit, a first party El-Gamal key, the first party El-Gamal key is a public key of the first party processing circuit and receiving, by the first party processing circuit from the third party processing circuit, a third party El-Gamal key, the third party El-Gamal key is a public key of the third party processing circuit. In some implementations, the method includes encrypting, by the first party processing circuit, the one or more first data sets includes encrypting, by the first party processing circuit, the one or more first data sets with the first party El-Gamal key and a first party deterministic key. In some implementations, the method includes encrypting, by the third party processing circuit, the encrypted one or more first data sets with a third party deterministic key to generate one or more double encrypted first data sets and encrypting, by the third party processing circuit, the encrypted one or more second data sets by encrypting the match keys associated with the third party processing circuit with the third party deterministic key. The method may include encrypting, by the first party processing circuit, each of the assigned bridge identifiers with the first party El-Gamal key and the second party El-Gamal key, sending, by the first party processing circuit to the third party processing circuit, one or more first tuples including the encrypted bridge identifiers and associated user identifiers associated with the first party processing circuit and sending, by the first party processing circuit to the third party processing circuit, one or more second tuples including the encrypted bridge identifiers and associated user identifiers associated with the third party processing circuit.

In some implementations, the method includes generating, by the third party processing circuit, a bridge identifier map for the third party processing circuit by decrypting the one or more second tuples with the third party El-Gamal key, de-exponentiating, by the third party processing circuit, the one or more first tuples and send the de-exponentiated one or more first tuples to the first party processing circuit, and generating, by the first party processing circuit, a bridge identifier map for the first party processing circuit by decrypting the one or more first tuples with the first party El-Gamal key.

DETAILED DESCRIPTION

Referring generally to the FIGURES, systems and methods for establishing a link between user identifiers of a first party system and user identifiers of a third party system without disclosing specific identifying information are shown and described, according to various illustrative implementations. Content systems can store personal identifiable information (PII) shared by users who visit a business's website, e.g., to view content or conduct transactions. PII may be, for example, an email address, a phone number, a phone identifier number, a cookie identifier, etc. Content systems can map the PII to user identifiers (IDs) that distinguish users from each other. For example, if a user is associated with an Email Address A and a Phone Number A, the content system may map the Email Address A and the Phone Number A to a single user ID, user ID A.

One approach to establishing this linkage involves the third party system providing, to the company, a user ID paired with hashed PII data. Cryptographic hashing functions are designed to be practically non-invertible (i.e., irreversible). Since the hashing function is irreversible, possession of hashed data does not result in possession of the corresponding input data. The hashed PII data is the output from applying a hashing function to the PII data, allowing for comparison of PII data elements without revealing the PII data itself.

In some implementations, the data partner may provide a user ID for a user and a hashed value of the user's email address. The company then compares the third party system's hashed PII data to the first party system's hashed PII data to establish a link between the user ID of the third party system and the user ID of the first party system. This approach works well when using only a single PII data element, such as when matching a user ID of a first party system and a user ID of a third party system based only on one PII, e.g., a user's email address.

However, to match on multiple PII data elements (e.g., both a user's email and phone number), the third party system must provide a user ID paired with both a hashed email and a hashed phone number. Consequently, this reveals internal data linkages to the first party system, i.e., it reveals the third party system's email address to phone number links for the particular user. Sharing information between the first party system and third party system to match on multiple PII data elements in this manner may provide enough information to reveal the identity of a specific user linked to the PII data elements.

Accordingly, the present disclosure is directed to systems and methods for establishing a link between the user IDs of two parties without exposing one or both parties' user ID to PII data map to the other party. In some implementations, the described systems and methods involve both parties learning a bridge ID, such as a bridge ID that is deterministically exponentiated.

More specifically, two parties are discussed herein, a first party system and a third party system. In some implementations, each of the parties may store a private database of data for users that is mapped by a particular user IDs. Furthermore, the databases may include PII data elements for each of the users, linked to the user IDs. The user IDs of the first party system and the third party system may have different formats and can be difficult to compare for equality. The systems and methods herein detail steps for learning common bridge identifiers BIDs for users in their respective databases, allowing for equality checking without either of the parties learning extra data about each other's users.

In some implementations, neither party should learn any additional PII data element for any user in either its own database, or in the other party's database. In some implementations, neither party should learn additional “linkages” between users in its own database, for example, that two distinct users in its own database are believed to be the same user by the other party. Further, some of the methods described herein restrict at least one of the parties from learning which users were in an intersection.

As used herein, uimay denote the ithuser ID for a first party system (may be ephemeral IDs). Each uican have up to t (MKi,k,MKTi,k) pairs for the first party system. A match key (MK) may be, include, or be associated with a PII data element. Examples of a MK are an email address, a phone number, and an IP address. A match key type (MKT) may indicate a type or characteristic of the information. For example, for a MK abc@123.com, the MKT may be a string “Email Address” or any other piece of data indicating that the MK is an email address.

As used herein, vjcan be a corresponding pseudonym for the jthuser ID associated with a third party system. Each vjcan also have up to t (MKj,k,MKTj,k) pairs associated with it. In some implementations, uiand vjare pseudo-random numbers, strings, or other pieces of data selected by the first party system and the third party system respectively. The values for uiand vjcan be constant for the duration of performing one or more of the methods described herein.

In some implementations, uiand vjare determined by the first party system and the third party system respectively via a hash function before or at the start of performing the methods described herein. For example, uivalues may be selected via the equations ui=hash(KF,UIDi) and vj=hash(K3P,PIDj) where keys KF, K3P may be keys (e.g., numeric values) known only to the first party system and third the third party system, respectively. In some implementations, UIDiand PIDjcould be the name of a user, a PII of a user, or any other user defining information. Since the values UIDiand PIDjare hashed with a secret key, KF and K3P, they may be encrypted and personal information of the user may be safe. The hash( ) function could be any kind of hash function including Secure Hash Algorithm (SHA)-256, MD5, BLAKE-256, and/or any other type of cryptographic hash function.

As described further herein, the systems and methods can enable the first party system to learn a ui:BIDi,kmap, where each uican map to up to t BIDi,kvalues. Some of the BIDi,kvalues may be dummy values. The third party system can be configured to learn a vj:BIDj,k, where each vjmaps to only a single BID.

Furthermore, in some implementations of the systems and methods described herein, at the end of the encryption methods, the first party will learn which of the uivalues are in an intersection (two sets A and B have an intersection C where C is all elements of A that belong to set B, i.e., A∩B). In contrast, the third party system may learn nothing more than the vj:BIDj,kmap and the size of the data set of the first party system. In particular, the third party system may learn neither the intersection elements nor the intersection size.

As used herein, the notation, F[ ] and T[ ] can denote single-deterministic Elliptic Curve Cryptography (ECC) exponentiation with the exponents F and T respectively. The notation, FT[ ] denotes double-deterministic encryption, with both exponents F and T. F can represent a deterministic encryption key for the first party system. In some implementations, F may be a secret key that the first party system does not share with the third party system. Similarly, in some implementations, T may be another deterministic encryption key for performing deterministic encryption by the third party system. The third party system may keep T as a secret and not directly share it with the first party system.

Furthermore, the notation EF[ ] can denote El-Gamal encryption with a key F. F represent a first El-Gamal party key for an El-Gamal encryption that can be performed by the first party system. The first party system can store the first party El-Gamal key, perform encryption with the first party El-Gamal key, and/or transmit the first El-Gamal key to the third party system. ETcan represent an El-Gamal encryption key of the third party system. The third party system can store the third party El-Gamal key, perform encryption with the third party El-Gamal key, or transmit the third party El-Gamal key to the first party system. The El-Gamal keys, EFand ETmay be public keys of the first party system and the second party system respectively.

The cryptographic methods described herein may rely on two specific properties of two different types of encryption, the commutative property and the homomorphism property. The homomorphic property indicates that for a function, ƒ[ ], ƒ[x]*ƒ[y]=ƒ[x*y]. El-Gamal encryption is homomorphic. Specifically, for an El-Gamal encryption function E[ ], E[x]*E[y]=E[x*y].

Deterministic encryption (deterministic ECC) with F[ ] and T[ ], where F[ ] is encryption of the first party system and T[ ] is encryption of the second party system may be commutative. Furthermore, El-Gamal encryption may be commutative. Specifically, the commutative property is T[F[x]]=F[T[x]]. As an example, the first party system and the third party system can each have MK values, x1and x2respectively. The first party system or the third party system can determine whether x1and x2are equal based on the commutative property without disclosing the actual values of x1and x2to each other. Without disclosing the encryption methods F[ ] and T[ ] to each other and without disclosing the values x1and x2, the first and third party system can compute double encrypted versions of x1and x2, i.e., T[F[x1]] and F[T[x2]]. If x1=x2then T[F[x1]]=F[T [x2]]. Similarly, if x1≠x2, then T[F[x1]]≠F[T [x2]]. This allows the first and third party systems to check whether x1is equal to x2without disclosing the actual values for x1and x2or the deterministic encryption of each system. This is described in further detail with reference to the methods described herein.

Referring now toFIG. 1, a block diagram of a first party system120, a third party system140, and an associated environment100is shown according to an illustrative implementation. One or more user devices104may be used by a user to perform various actions and/or access various types of content, some of which may be provided over a network102(e.g., the Internet, LAN, WAN, etc.). A “user” or “entity” used herein may refer to an individual operating user devices104, interacting with resources or content items via the user devices104, etc. The user devices104may be used to access websites (e.g., using an internet browser), media files, and/or any other types of content. A content management system108may be configured to select content for display to users within resources (e.g., webpages, applications, etc.) and to provide content items112from a content database to the user devices104over the network102for display within the resources. The content from which the content management system108selects items may be provided by one or more content providers via the network102using one or more content provider devices106.

In some implementations, the content management system108may select content items from content providers to be displayed on the user devices104. In such implementations, the content management system108may determine content to be published in one or more content interfaces of resources (e.g., webpages, applications, etc.). The content management system108can be configured to conduct a content auction among third-party content providers to determine which third-party content is to be provided to the user device104. The auction winner can be determined based on bid amounts and a quality score (i.e., a measure of how likely the user of the user device104is to click on the content). In some implementations, the content management system108allows content providers to create content campaigns. A campaign can include any number of parameters, such as a minimum and maximum bid amount, a target bid amount, or one or more budget amounts (e.g., a daily budget, a weekly budget, a total budget, etc.).

The first party system120and the third party system140can include one or more processors (e.g., any general purpose or special purpose processor), and can include and/or be operably coupled to one or more transitory and/or non-transitory storage mediums and/or memories (e.g., any computer-readable storage media, such as a magnetic storage, optical storage, flash storage, RAM, etc.). In various implementations, the first party system120and/or the third party system140and the content management system108can be implemented as separate systems or integrated within a single. For example, the first party system120may be associated with and/or be a part of a first content management system (e.g., the content management system108) while the third party system140may be part of a second content management system (e.g., a content management system similar to the content management system108).

The first party system120and/or the third party system140can be communicably and operatively coupled and/or include data storage devices e.g., databases. The first party system120and/or the third party system140can be configured to query the databases for information and store information in the databases. In various implementations, the databases include various transitory and/or non-transitory storage mediums. The storage mediums may include but are not limited to magnetic storage, optical storage, flash storage, RAM, etc. The database and/or the first party system120and/or the third party system140can use various APIs to perform database functions (i.e., managing data stored in the database). The APIs can be but are not limited to SQL, ODBC, JDBC, etc.

The first party system120and/or the third party system140can be configured to receive information from the network102. The information may include browsing histories, cookie logs, television advertising data, printed publication advertising data, radio advertising data, online activity data and/or any other indication or interactions with an online resources that a user (i.e., user devices104) may have on the network102. The first party system120and/or the third party system140can be configured to receive and/or collect the interactions that the user devices104have on the network102. This information may be stored by the first party system120and/or the third party system140.

The first party system120and/or the third party system140may include one or more modules (i.e., computer-readable instructions executable by a processor) and/or circuits (i.e., ASICs, Processor Memory combinations, logic circuits, etc.) configured to perform various functions. In some implementations, the modules may be or include the encryption manager122and the encryption manager142. Furthermore, the first party system120and/or the third party system140may store a bridge identifier map124and/or a bridge identifier map144and user data, i.e., the input data126and the input data146.

The encryption manager122and the encryption manager142can be configured to perform the various encryption methods described herein. Furthermore, the encryption manager122and the encryption manager142can perform specific encryption steps, e.g., deterministic EC encryption, El-Gamal encryption, and decryption methods. The encryption manager122of the first party system120can be configured to encrypt data to be sent to the third party system140and decrypt data received from the third party system140. Likewise, the encryption manager142of the third party system140can be configured to encrypt data to be sent to the first party system120and decrypt data received from the first party system. In some implementations, the encryption managers122and142can be configured to perform the methods described herein.

In some implementations, the inputs for the encryption manager122of the first party system120are one or more first sets126, triples of the form (ui,MKi,MKTi). There can be several triples with the same ui. It may be assumed that no two triples share the same MKi, i.e., no two uiare linked to the same MKi. However, multiple MKican be linked to a single ui.

The input of the encryption manager142of the third party system140input may be the one or more second data sets146, triples of the form (vj,MKj,MKTj). As with the one or more first sets126of the first party system120, there can be several triples with the same vj, but no two triples sharing the same MKj. In some of the methods described herein, the MKTiand MKTjvalues are passed “in the clear,” i.e., they may be communicated between the first party system120and the third party system140without being encrypted. For this reason, some of the methods herein do not show the MKTiand MKTjbeing communicated between the first party system120and the third party system140. Any time an MK value is communicated between the first party system120and the third party system140, a corresponding MKT value may also be communicated.

The bridge identifier map124may be a map linking a user ID, ui, to a bridge ID, BID. The bridge identifier map124may be the product of performing the methods described herein. The bridge identifier map of the first party system120, i.e., the bridge identifier map124, may be a map where each uimaps to one or multiple BID values.

The bridge identifier map144may be similar to the bridge identifier map124. The bridge identifier map144may map vjto BID. The bridge identifier map144may be the product of performing the methods described herein. However, unlike the bridge identifier map124, all of the vjof the third party system140may only map to a single BID.

Referring now toFIGS. 2A and 2B, a process200is shown for establishing a link between user IDs of the first party system120and the third party system140, according to an illustrative implementation. The first party system120and the third party system140can be configured to perform the steps of process200. Furthermore, any one or combination of computing devices described herein can be configured to perform the process200.

Referring toFIG. 2C, a transmission diagram if shown illustrating the process200in greater detail. The transmission diagram ofFIG. 2Cillustrates the data transmitted between the first party system120and the third party system140, in addition to illustrating the matching relationship generating steps, the matching relationship pruning steps, and the BID assignment steps.

Referring more particularly toFIGS. 2A and 2B, in step202, the first party system120can encrypt the first data sets126and send the encrypted data sets126to the third party system140. As previously described, the first data sets126may be one or more sets of a user ID, ui, a match key MKi, and a match key type for the MKi, MKTi.

In step202, the first party system120can be configured to select a value for a first party encryption, F (e.g., an ECC exponentiation key), and an El-Gamal Key, F′. Based on the selected keys F and F′, the first party system120can encrypt MK data that it stores. Specifically, the first party system120can encrypt uivalues that it stores with the El-Gamal Key F′, encrypt the MK values it stores with the ECC exponentiation key F, and leave the MKT values that it stores unencrypted. The result may be EF′(ui),F[MKi,k],MKTi,k. The first party system120can send the result to the third party system140. In some implementations, there may be multiple tuples, i.e., MK and MKT combinations that are associated with the same underlying ui.

In step204, third party system140can receive the encrypted first set126, double encrypt the encrypted first data sets126, and send the double encrypted first data sets126to the first party system120. The third party system140can select a value T. The value T can be an ECC exponentiation key. Furthermore, the third party system140can select a value R, a deterministic key. The third party system140can encrypt the encrypted data it receives in step202from the first party system120. This may be referred to as a double encryption.

The third party system140can double encrypt the data it receives in step202, EF′(ui),F[MKi,k],MKTi,k, with the selected value T and the selected value R. Specifically, the third party system140can exponentiate the received ui, and double encrypt F[MKi,k] with the value T. The third party system140may leave MKTi,kunencrypted. The result may be EF′(uiR),FT[MKi,k],MKTi,k. The third party system140can send the result back to the first party system120. In some implementations, the third party system140can sort or shuffle the order of the result.

In step206, the third party system140encrypts the second sets146stored by the third party system140with the selected value T from step204. The third party system140can encrypt MK values associated with specific v values and MKT values. Specifically, the third party system can encrypt the MK values that it stores with the selected value T. The result may be (vj,T[MKj,k],MKTj,k). The third party system140can send the result to the first party system120. In some implementations, the third party system140sorts and/or shuffles the encrypted second data sets146before sending the encrypted second data sets146to the first party system120.

In step208, the first party system120can double encrypt the encrypted sets146that the third party system140sends the first party system120in step206, i.e., the first party system120can double encrypt the received sets (vj,T[MKj,k],MKTj,k). Specifically, the third party system140can encrypt the T[MKj,k] values with F. The result may be (vj,FT[MKj,k],MKTj,k).

In step210, the first party system120can generate a matching relationship including multiple links between the match keys of the first set126and the match keys of the second set146where the match keys of the first set126and the second set146are both double encrypted. The matching relationship can be visually represented as a graph (e.g., as shown inFIG. 2C) but may be any a data element indicating relationships between various values.

From the first data sets, the first party system120may have TF[MKi,k] values while from the second data sets FT[MKj,k]. The encryption with T and F may be commutative, i.e., where MKi,kis equal to MKj,k,TF[MKi,k] is equal to FT[MKj,k]. Therefore, intersections between the TF[MKi,k] and FT[MKj,k] can be determined based on which TF[MKi,k] and FT[MKj,k] values are equal. The matching relationship is described visually inFIG. 3C. The vertices of the matching relationship may represent blinded user IDs, i.e., uiRdecrypted values and vjvalues. An edge (a link) between two vertices may represent matching TF[MKi,k] and FT[MKj,k] values.

In step212, the first party system120can prune the matching relationship by removing links from the matching relationship so that each MK of the second data sets146has only one link to the MKs of the first data set126. Specifically, the first party system120can prune the matching relationship so that each vjvertex has only one associated edge. This can prevent the first party system120from learning whether two of the user IDs associated with the first party system120correspond to a single user ID of the third party system140. The first party system120can use the number of repeated matches and the MKT of the matches to help choose the best edge to preserve. For example, certain MKT values may indicate which links should be preserved. Links associated with email addresses may be preserved while links associated with home residence addresses may be discarded.

Each uiRmay still have multiple edges associated with it. In step214, the first party system120can pseudo-randomly assign pseudo-random bridge identifiers, B, to the associated vertices. The value B may be selected by the first party system120from a BID space. The BID space may be a set of values that are possible values for B. One or more parameters may define the BID space. For example, one or more parameters may define an elliptic curve from which the values are selected. The value B can be associated with vertices of uiRand vj. For all vertices vjnot associated with a value B, the first party system120can assign a new pseudo-random value Bjto it.

For all vertices uiRnot associated with any B, the first party system120can replace the vertex with a dummy uiRvalue chosen pseudo-randomly from the EC group and different from all other uiRvalues. The first party system120may not know R, but can choose any random and distinct element in the EC group, and it will be of the form uiRfor some unknown ui. The first party system120may not know what uithe value will de-exponentiate to, but this is not a problem as long as the fresh uiRis distinct from all previous ones.

In step216, for all vertices uiRincluding the fresh replacements from the preceding step214, the first party system120can assign a predefined number of pseudo-random bridge identifiers. The first party system120can associate each vertices additional new, pseudo-random Bi,kvalues until each uiRhas t associated values.

In step218, the first party system120can send the third party system140one or more second tuples. Each tuple may include an association of a user ID associated with the third party system140, vjand a bridge identifier, Bj. Specifically, the tuples may be sets of (vj,Bj). The value Bjmay be the bridge identifier associated with the user ID of the third party system140, vj.

In step220, the first party system can select a first exponent and exponentiate one or more first tuples and send the exponentiated one or more first tuples to the third party system140. The first party system120can select the first exponent to be an ECC exponent. The selected ECC exponent may be an exponent S. The first party system120can determine the first tuples for the user identifier associated with the first party system120, uiRand associated bridge identifiers, Bj,k. The first party system120can exponentiate the bridge identifiers of the second tuples with the exponent S. The result may be tuples (uiR,Bi,kS). For each i and k, each uiRmay be associated with a Bi,k. The replaced uiRvalues may also be included.

In step222, the third party system140can select a second exponent and generate the bridge identifier map144via exponentiation of the received one or more second tuples of step218. The bridge identifier map144may include an association of the user IDs associated with the third party system140and the bridge identifiers received in step220. The exponent selected by the third party system140may be an exponent T for the BID space. The third party system140can determine pairs (vj,BjT) based on the tuples received in step218, (vj,Bj). The third party system140can verify that none of the pairs have repeated BjTvalues in the second position. The third party system140can use these pairs in its bridge identifier map144, vj:BIDj. The map may be BIDj=BjT.

Before proceeding, the third party system140can verifies that no two of the (uiR,Bi,kS) pairs have the same Bi,kSvalue. If there are two pairs with the same Bi,kSvalue, the third party system140may abort the process200. Otherwise, the third party system140may continue to step224.

In step224, the third party system140can encrypt the one or more exponentiated first tuples (received in step220) including the user identifiers associated with the first party system120and an associated bridge identifier exponentiated by the first exponent (S) and the second exponent (T). Specifically, the third party system140can exponentiate the first tuples (uiR,Bi,kS) with the second exponent, T and remove R. In this regard, in step226, the third party system140can send all such tuples (ui,Bi,kST) to the first party system120after being sorted and/or shuffled.

In step228, the first party system120can remove the first exponent S from the received exponentiated one or more first tuples of steps224. By removing the first exponent, the first party system120can generate the bridge identifier map for the first party system120. Of the tuples received, the first party system120can discard all those tuples do not correspond to a ui. In doing so, the first party system120will discard all the dummy uivalues introduced in step216, and preserves only those uithat matched with at least one vj. The freshly chosen uiRin216were distinct from all others, and so will always de-exponentiate to different uifrom those first party system120originally supplied in step202.

For all remaining ui, the first party system120can remove the power S in the second positions of the received pairs to recover pairs of the form (ui,Bi,kT) from the tuples received in step226, (ui,Bi,kST), and constructs the ui:BIDi,kmap, where BIDi,k=Bi,kT. Note that each uimay be associated with several BIDi,k, some real, and some fake as inserted in step216. The first party system120may not know which ones are fake.

At the conclusion of the process200, the first party system120has learned which of its user IDs, ui, matched with user IDs, vj, of the third party system140. In subsequent methods, the first party system120can also learn which of its associated BIDs are real and fake; fake BIDs will never appear in an intersection. In subsequent transaction uploads, if multiple BIDs supplied by the third party system140match with those associated with a single ui, then the first party learns that multiple third party IDs matched to a single user ID.

In some implementations, this leakage can be prevented by additionally pruning the PII graph in212, so that both uiRand vjvertices have at most 1 associated edge. This is described with further reference to process300ofFIG. 3. In some implementations, if the third party system140receives no unblinded information at all, it learns nothing beyond its BID map and the size of the data of the first party system120. The first party system120can learn the blinded structure of the PII matching graph. However, a positive side to this leakage is that the first party system120can leverage the graph structure to improve link-pruning.

In some implementations, the process200can be modified so that the first party system120cannot learn which of its user IDs matched. Some modifications to the process200make use of the BIDs as user IDs that never matched and will never appear in an intersection. In some implementations, the third party system140can receive no unblinded information learning very little beyond the size of the first party's data. The first party can leverage the graph structure to optimize link-pruning.

In some implementations in which the first party system120can no longer learn which of its user IDs matched, the third party system140can no longer learn links between the user IDs of the third party system140, because after the first party system120intersects on MK values, the third party only sees blinded BIDs and encrypted user IDs. The third party may, instead of seeing more information in step228, may not see the information, so that the third party performs the pruning blindly. It is possible to modify the process200to provide either of the two quality-vs-leakage tradeoffs.

Referring now toFIG. 3A, a process300is shown for establishing a link between user IDs of the first party system120and the third party system140where bridge IDs are user IDs of the third party system140, according to an illustrative implementation. Selecting bridge IDs as user IDs may simplify data flow, improving the process. The first party system120and the third party system140can be configured to perform the steps of process300. Furthermore, any one or combination of computing devices described herein can be configured to perform the process300. The process300may be similar to the process200as described with reference to FIGS.2A-2C. The process300may include many of the same steps as the process200. However, process300may differ from process200in at least one way by using user IDs of the third party system140as bridge IDs.

Referring toFIG. 3B, a transmission diagram if shown illustrating the process300in greater detail. The transmission diagram ofFIG. 3Billustrates the data transmitted between the first party system120and the third party system140in addition to illustrating the matching relationship generating steps, the matching relationship pruning steps, and the BID assignment steps.

Referring more particularly toFIG. 3A, in step302, the third party system140can choose pseudo-random values for the user IDs associated with the third party system140. These values, vj, can be pseudo-random values chosen by pseudo-randomly selecting points on an elliptic curve. The process300can include steps202and204of process200after step302is performed. These steps can be performed by the first party system and the third party system respectively.

In step304, the third party system140can encrypt the second data sets146and send the encrypted second data sets146to the first party system120. The second data sets146can include, as previously described, a user ID associated with the third party system140, vj, a MK value linked with the user ID, and a MKT value for the MK value. The one or more second data sets may be vj,MKj,k,MKTj,k.

The third party system140can encrypt the one or more second data sets with a deterministic exponent, T′ and a deterministic exponent T. Specifically, the third party system140can encrypt the user IDs associated with the third party system140with the exponent T′ and the MKs associated with the third party system140with the exponent T. The result may be one or more sets of vjT′,T[MKj,k],MKTj,k. The third party system140can send this result to the first party system120. After step304, the process300the third party system140can perform the steps208-210as described with further reference toFIGS. 2A-2Cand process200with vjT′instead of vj. The first party system120can perform the steps208-210.

In step308, the first party system120can prune the matching relationship generated in step210. The first party system120can prune the matching relationship by removing links from the matching relationship such that each MK of the second data sets146has one link to the MKs of the first data set126and furthermore so that each MK of the first data sets126has one link to the MKs of the second data set146.

In step310, the first party system120can select bridge IDs for the links between the MKs of the one or more first data sets and the MKs of the second data sets146, the bridge IDs to be the exponentiated user identifiers associated with the third party system140. More specifically, the selected bridge IDs may be by the encrypted user IDs associated with the third party system140. The bridge IDS, Bi, can be the viT′values. This is visually illustrated inFIG. 3Bwhere a B1value for a link between TF[MK1,k] for a u1Rand FT[MK1,k] for a v1T′is assigned the value v1T′. If a identifier of the first party system120does not match to an identifier of the third party system140, the first party system120may assign it a random bridge ID. For example, inFIG. 3B, B3. This random assignment can be performed the same as in step214of the process200as described with reference toFIGS. 2A-2C.

Process300may skip steps218of process200since this step may not be required. In step218, the tuple (vj,Bj) may be sent from the first party system120to the third party system140. However, this is the same as sending tuples of the form (vjT′,vjT′) which is redundant. However, process300may include performing step220. In step220, the first party system120can send tuples including the user IDs associated with the first party system120and an associated bridge ID. The tuples may be uiR,Bi,kS. However, since the bridge IDs chosen in step308may be the user IDs associated with the third party system140, the tuples may be uiR,vj,kT′S. This is illustrated in the transmission diagram ofFIG. 3B.

In step312, the third party system140can de-exponentiate the user IDs associated with the third party system140. Specifically, the third party system140may remove the exponent T′ but leave the exponent S. The result may be vjSand can be determined by removing the exponent T′ from the tuples uiR,vj,kT′Sreceived in step220. The process300can proceed with performing the steps224-228by the first party system120as described with reference to process200. Note though that the first party system120can recover vjfor exactly the IDs that matched and will recover a random point for all IDs that did not match.

Referring now toFIGS. 4A-4B, a process400is shown for establishing a link between user IDs of the first party system120and the third party system140where bridge IDs are encrypted, according to an illustrative implementation. In some implementations, instead of learning BIDs, both the first party system120and the third party system140learn encrypted BIDs. The encrypted BIDs can be decrypted in an online fashion using a separate protocol, before they can be checked for quality. The first party system120and the third party system140can be configured to perform the steps of process400. Furthermore, any one or combination of computing devices described herein can be configured to perform the process400.

Referring toFIG. 4C, a transmission diagram if shown illustrating the process400in greater detail. The transmission diagram ofFIG. 4Cillustrates the data transmitted between the first party system120and the third party system140in addition to illustrating the matching relationship generating step414and the BID assignment steps416-420.

Pruning links in order to prevent leaking additional linkages between user IDs, such as performed in step212of the process200, can lead to inaccuracy. Referring generally to the process400, the process400can avoid this pruning step and may thus give better quality matching. In some implementations, instead of learning bridge IDs in the clear at the end of the process400, the first party system120and the third party system140will instead learn randomized encryptions of the bridge IDs under the El-Gamal encryption key of the other system. Because the bridge IDs are encrypted, both parties will not learn additional links between the user IDs of their respective users.

In some implementations, beyond learning the bridge IDs associated with their own user IDs, each of the first party system120and the third party system140may learn nothing about the data set of the other system. In particular, no participants may learn new linkages between their user IDs. For example, the first party may not learn that the third party believes that user ID A and user ID B associated with the third party system140are the same user, and similarly, the first party system120may not learn that the first party thinks user ID C and user ID D associated with the third associated with the third party system140are the same user. In some implementations, such a process may allow the first party system120and the third party system140to learn some aggregate statistics about the two datasets.

Referring more particularly toFIGS. 4A-4B, in step402, the first and third party systems120and140can exchange public El-Gamal keys. The public El-Gamal keys may be El-Gamal keys that each of the first party system120and the third party system140are configured to store, generate, and/or receive. Specifically, the first party system120can send the third party system140a first party El-Gamal key, EF, and the third party system140can send the first party system120a third party El-Gamal key, ET.

In step404, the first party system120can encrypt the one or more first data sets126with the first party El Gamal key and a first party deterministic key and send the encrypted the first data sets126to the third party system140. Specifically, the first party system120can encrypt the uiwith the first party key EFto generate EF(ui) and MKiwith the first party deterministic key, F, to generate F(MKi). The encrypted one or more first data sets126may be in the form of tuples EF(ui),F(MKi). The first party system120can send the encrypted first data sets126, EF(ui),F(MKi), to the third party system140. Since uiis encrypted using El-Gamal, even if multiple tuples share the same ui, they will have different encryptions.

In step406, the third party system140can double-encrypt the encrypted first data sets126with a third party deterministic key, T. The third party system140can then randomize the double encrypted first data sets126. The result of the double encryption may be (EF(uiR),TF[MKi]) where the third party system140may encrypt all the uiusing the same R. The result can be sent to the first party system120in a shuffled order.

In step408, the third party system140can encrypt the one or more second data sets146with a deterministic third party key and send the one or more encrypted second data sets146to the first party system120. Specifically, the one or more second data sets146, (vj,MKj) by encrypting the MKjvalues with the third party key, T. The result may be (vj,T(MKj)) which can be sent by the third party system140to the first party system120.

In step410, the first party system120can decrypt the double encrypted the first data sets126. The first party system120can decrypt the double encrypted one or more first data sets126, i.e., (EF(uiR),TF[MKi]) by removing the first party El-Gamal encryption EF. The result may be tuples in the form of (uiR,TF[MKi]).

In step412, the first party system120can double encrypt the one or more encrypted second data sets146received from the third party system140in step408with a first party deterministic key. Specifically, the one or more encrypted second data sets146received in step408may be (vj,T(MKj). For each tuple, first party system120can double encrypt T(MKj) with the first party key F. The result may be tuples in the form (vj,FT(MKj)).

In step414, the first party system120can generate a matching relationship including multiple links between the MK values of the double encrypted first data sets126and the MK values of the doubled encrypted second data sets146. The vertices of the matching relationship may represent user IDs uiR(blinded via encryption) and vj(in the clear, not encrypted), and an edge between two vertices represents a matching FT(MK). The first party system120can find the connected components in the joined/blinded matching relationship.

In step416, the first party system120can assign encrypted bridge IDs with the first party El-Gamal key and the third party El Gamal key. For each connected component (e.g., each matched or unmatched user ID vertice), the first party system120can select a random bridge ID Bjto use for that component and encrypt the bridge ID values under both the first party El-Gamal key and the third party El-Gamal key.

This encryption of bridge IDs may be a separate randomized encryption for each vertex in the matching relationship, with the same plaintext being encrypted. In step418, the first party system120can encrypt the assigned bridge identifiers with the first party El-Gamal key and the third party El-Gamal key. After the encryption of step418, each uiRwill be associated with a single EFET(Bi), and each vjwith a single EFET(Bj). This is where the deduplication occurs; because each vjis only associated with a single encrypted bridge ID corresponding to its component, the third party system140will not see duplicates at all.

In step420, the first party system120can shuffle and send the third party system140one or more first tuples including the encrypted bridge identifiers generated in step420and user IDs associated with the first party system and one or more second tuples including the encrypted bridge identifiers and user IDS associated with the third party system. The tuples may associate user IDs of the first and third party systems120and140with the double encrypted bridge IDs. The tuples may be (EFET(Bj),vj) (the first tuples) and (EFET(Bi),uiR) (the second tuples) i.e., the vertices of the connected components together with their double-encrypted bridge IDs.

In step422, the third party system140can generate the bridge identifier map144for the third party system140by decrypting the one or more second tuples with the third party El-Gamal key. For the one or more second tuples, (EFET(Bj),vj), the third party system140can decrypt the bridge IDs with the third party El-Gamal encryption key, ET, to generate an encrypted bridge ID map, (EF(Bj),vj).

In step424, the third party system140can de-exponentiate the one or more first tuples and send the de-exponentiated one or more first tuples to the first party system120. The one or more first tuple of the form (EFET(Bi),uiR) can be de-exponentiated by the third party system140by removing the exponent R. The third party system140can re-randomize the encryption in the first position, removes the power of R in the exponent of uiin the second position which results in (ETEF(Bj),ui). The third party system140can shuffle the result and/or send the result to the first party system120.

In step426, the first party system120can generate the bridge identifier map126for the first party system120by decrypting the one or more first tuple with the first party El-Gamal key. For each tuple (ETEF(Bi),ui), the first party system120decrypts the first component with the El-Gamal key of the first party system, ET, to get the encrypted BID map for the first party system120, (EF(Bi),ui).

Referring now toFIG. 5A, transmission diagram of a process500A, a secure intersection process for determining the intersection of encrypted bridge identifiers by the third party system140is shown, according to an illustrative implementation. Process500A can be used to determine the intersection of the encrypted bridge identifier generated in process400by the third party system140. The first party system120and the third party system140can be configured to perform the steps of the process500A. Furthermore, any one or combination of computing devices described herein can be configured to perform the process500A.

In broad overview of the process500A, the third party system140can first exponentiate its encrypted bridge identifiers homomorphically and send them to the first party system120. The first party system120can then decrypt, double-exponentiate, shuffle, and send them back to the third party system140. The first party system120can then exponentiate its own encrypted bridge IDs and send these ciphertexts to the third party system140. The third party system140can then decrypt the bridge IDs of the first party system120and double exponentiate them. The third party system140then has double-encrypted BIDs for each party, and can perform intersections as before (roles can be swapped to change from forward to reverse, in some implementations).

In step502, the first party system120can generate a first party deterministic encryption key, F, while the third party system140can generate a third party deterministic encryption key, T.

In step504, for each user vjin the segment, the third party system140can homomorphically exponentiate the associated El-Gamal encrypted Bridge ID generating the result EF(BjT), which can be sent to the first party system120. In step506, the first party system120can decrypt and double exponentiate EF(BjT) to generate BjTFand send BjTFto the third party system. More specifically, the first party system120can decrypt each EF(BiT), removing EFand double exponentiate with F to generate the result BjTF. The order of the values can be shuffled before being sent. In step508, the first party system120, for each uiin the segment, first party homomorphically exponentiates the associated El-Gamal encrypted bridge ID sending ET(BiF) to the third party system.

In step510, the third party system140can decrypt each ET(BiF) and double exponentiate the result to generate BiFT. In step512, the third party system140can determine the intersection size by intersecting the double exponentiated bridge identifiers. More specifically, the third party system140can intersect the BiFTvalues with the received BjTFvalues, and learn the intersection size. The protocol above can be naturally extended to learn intersection sum, and can also be reversed so that the other party performs the intersection. A secure intersection-sum process is described in greater detail inFIG. 5B.

Referring now toFIG. 5B, a transmission diagram of a process500B, a secure intersection-sum process for determining the intersection of encrypted bridge identifiers by the first party system120is shown, according to an illustrative implementation. Process500B can be used to determine the intersection of the encrypted bridge identifier generated in process400by the first party system120. The first party system120and the third party system140can be configured to perform the steps of process500B. Furthermore, any one or combination of computing devices described herein can be configured to perform the process500B.

In some implementations, the party performing the intersection gets to see the BiFTand BjFTvalues, and in particular, can see how many such values were repeated. This leaks exactly how many users (belonging to either party) in the segment were in the same connected component, but not which specific users.

The third party (not performing the intersection) gets to see the BiTvalues for the first party, and in particular, can see how many such values were repeated. This leaks exactly how many of the first party's users in the segment were in the same connected component, but not which specific users.

In step522, the third party system140sends {(EF(BjT),P(Sj)}. In step524, the first party system120sends {(BjFT,P(Sj+Rj))} and {ET(BiF)} to the third party system140. In step526, the third party system140sends ΣjB(Sj+Rj) and {BjFT}. In step528, the third party system140sends ΣjBSj.

Referring now toFIG. 5C, transmission diagram of a process500C for determining a number of matched bridge IDs with indicator bits, according to an implementation. The first party system120and the third party system140can be configured to perform the steps of process500C. Furthermore, any one or combination of computing devices described herein can be configured to perform the process500C.

In step530, the first party system120sends the third party system140{(EF(ui),MKjF)}. In step532, the third party system replies by sending the first party system with {(EF(ui),MKiFT)} and {(vj,MKjT)}.

In step534, the first party system120determines connected components and assigns bridge IDs to each component. For each first party vertex that is in a “singleton” component i.e., which has no edge with any other vertex, first party assigns EFET(e) to that vertex, and for vertices with non-zero degree assigns EFET(g) to the vertex, where e is the identity element of the EC group and g is a generator. The first party system120can then send {(uiT,EFET(Bi),EFET(Ki) and (vj,EFET(Bj)} to the third party system140.

In step536, the third party system140replies to the third party system with {ui, EFET(Bi),EFET(Ki)}. During the method, the first party system120should include EFET(Ki) with its segment bridge IDs. To determine how many elements in the segment had corresponding bridge IDs on the third party system140side. The third party system140can determine ΠiS EF(Ki)=EG(ΠiSKi) i.e., it can use the El-Gamal homomorphism. Each Kiis either e or g, so Ki=gΣ, i.e., the exponent is the count of matched bridge IDs. It is hard to compute the exponent generally, but the segment sizes are not significantly large (millions at the most) meaning that the lower bound on the exponent is small. The first party can keep a lookup table of the possible exponents to decode this number. Note that this can also be done just for the intersection if necessary.

Referring now toFIG. 6,FIG. 6illustrates a depiction of a computer system600that can be used, for example, to implement an illustrative user device104, an illustrative content management system108, an illustrative content provider device106, an illustrative first party system120, an illustrative third party system140, and/or various other illustrative systems described in the present disclosure. The computing system600includes a bus605or other communication component for communicating information and a processor610coupled to the bus605for processing information. The computing system600also includes main memory615, such as a random access memory (RAM) or other dynamic storage device, coupled to the bus605for storing information, and instructions to be executed by the processor610. Main memory615can also be used for storing position information, temporary variables, or other intermediate information during execution of instructions by the processor610. The computing system600may further include a read only memory (ROM)620or other static storage device coupled to the bus605for storing static information and instructions for the processor610. A storage device625, such as a solid state device, magnetic disk or optical disk, is coupled to the bus605for persistently storing information and instructions.

The computing system600may be coupled via the bus605to a display635, such as a liquid crystal display, or active matrix display, for displaying information to a user. An input device630, such as a keyboard including alphanumeric and other keys, may be coupled to the bus605for communicating information, and command selections to the processor610. In another implementation, the input device630has a touch screen display635. The input device630can include a cursor control, such as a mouse, a trackball, or cursor direction keys, for communicating direction information and command selections to the processor610and for controlling cursor movement on the display635.

In some implementations, the computing system600may include a communications adapter640, such as a networking adapter. Communications adapter640may be coupled to bus605and may be configured to enable communications with a computing or communications network645and/or other computing systems. In various illustrative implementations, any type of networking configuration may be achieved using communications adapter640, such as wired (e.g., via Ethernet), wireless (e.g., via WiFi, Bluetooth, etc.), pre-configured, ad-hoc, LAN, WAN, etc.

According to various implementations, the processes that effectuate illustrative implementations that are described herein can be achieved by the computing system600in response to the processor610executing an arrangement of instructions contained in main memory615. Such instructions can be read into main memory615from another computer-readable medium, such as the storage device625. Execution of the arrangement of instructions contained in main memory615causes the computing system600to perform the illustrative processes described herein. One or more processors in a multi-processing arrangement may also be employed to execute the instructions contained in main memory615. In alternative implementations, hard-wired circuitry may be used in place of or in combination with software instructions to implement illustrative implementations. Thus, implementations are not limited to any specific combination of hardware circuitry and software.

In some illustrative implementations, the features disclosed herein may be implemented on a smart television module (or connected television module, hybrid television module, etc.), which may include a processing circuit configured to integrate Internet connectivity with more traditional television programming sources (e.g., received via cable, satellite, over-the-air, or other signals). The smart television module may be physically incorporated into a television set or may include a separate device such as a set-top box, Blu-ray or other digital media player, game console, hotel television system, and other companion device. A smart television module may be configured to allow viewers to search and find videos, movies, photos and other content on the web, on a local cable TV channel, on a satellite TV channel, or stored on a local hard drive. A set-top box (STB) or set-top unit (STU) may include an information appliance device that may contain a tuner and connect to a television set and an external source of signal, turning the signal into content which is then displayed on the television screen or other display device. A smart television module may be configured to provide a home screen or top level screen including icons for a plurality of different applications, such as a web browser and a plurality of streaming media services, a connected cable or satellite media source, other web “channels,” etc. The smart television module may further be configured to provide an electronic programming guide to the user. A companion application to the smart television module may be operable on a mobile computing device to provide additional information about available programs to a user, to allow the user to control the smart television module, etc. In alternate implementations, the features may be implemented on a laptop computer or other personal computer, a smartphone, other mobile phone, handheld computer, a tablet PC, or other computing device.

Additionally, features described with respect to particular headings may be utilized with respect to and/or in combination with illustrative implementations described under other headings; headings, where provided, are included solely for the purpose of readability and should not be construed as limiting any features provided with respect to such headings.