Patent Description:
There are many cryptographic techniques for preventing unauthorized access to data. Zero-knowledge proofs are cryptographic protocols for heuristically proving that one party knows or has some information without revealing anything about the information itself. For example, a zero-knowledge proof can enable one party to prove to another party that a statement is true without exposing any other information. Ring learning with errors (RLWE) is one use of zero-knowledge proofs. Document <CIT> discloses a client device equipped with a trusted execution environment (TEE), wherein data is encrypted using zero knowledge proof engine. Document <CIT> discloses selected advertising is inserted into content that is securely implemented within a hardware-based root of trust and based on zero-knowledge proofs. Document <CIT> discloses cryptographically assured content delivery and zero-knowledge assurance for both content protection and end user privacy. Document XP011714494 discloses designing secure cloud storage protocols based on ring learning with errors (RLWE) problem.

In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include receiving a data element identifying a set of candidate digital components and, for each candidate digital component, a set of distribution parameters for the candidate digital component; for each candidate digital component, providing encrypted selection data for the candidate digital component as input to a cryptographic analysis application running in a trusted hardware module of a client device, where the encrypted selection data represents the set of distribution parameters for the candidate digital component and is encrypted using a zero-knowledge proof protocol, and where the cryptographic analysis application is configured to determine a measure of match between the selection data and user attributes of a user of the client device, and receiving, as an output of the cryptographic analysis application, an encrypted result that indicates the measure of match between the selection data and the user attributes of a user, wherein the encrypted result is encrypted using the zero-knowledge proof protocol; decrypting the encrypted result for each candidate digital component; selecting, from the candidate digital components, a given digital component based on the measure of match for each candidate digital component; and displaying the given digital component. Other embodiments of this aspect include corresponding systems, apparatus, and computer programs, configured to perform the actions of the methods, encoded on computer storage devices.

These and other implementations can each optionally include one or more of the following features. In some aspects, the cryptographic analysis module determines the measure of match between the selection data and user attributes by comparing each data item of the selection data to a corresponding user attribute of the user. In some aspects, the selection data for each candidate digital component includes contextual data for an environment in which a selected digital component will be displayed.

In some aspects, the user attribute data is stored in the trusted hardware module and the user attribute data is encrypted using the zero-knowledge protocol. In some aspects, the set of distribution parameters for each candidate digital component is encrypted using the zero-knowledge proof protocol.

In some aspects, the zero-knowledge proof protocol includes a ring learning with errors protocol. In some aspects, selecting, from the candidate digital components, the given digital component based on the measure of match for each candidate digital component includes selecting the given digital component based on, for each candidate digital component, a combination of the measure of match and a publisher amount.

The subject matter described in this specification can be implemented in particular embodiments so as to realize one or more of the following advantages. The security and privacy of user data is protected by storing the user data in a trusted hardware module of the user's device, or using the trusted hardware module to control access to the user data, rather than sending the user data across a public network, e.g., the Internet, while still allowing such data to be used to customize content displayed to the user, thereby also improving the user experience when viewing digital content. Cryptographic techniques, e.g., zero-knowledge proofs and ring learning with errors, enable the use of such user data while preventing parties other than the user from accessing and gaining knowledge of any of the user's data. Cryptographic techniques including zero-knowledge proofs and ring learning with errors may also prevent users from accessing and gaining knowledge of any of the content selection criteria used to perform the selection. By preventing the user from learning details of the selection criteria the user data may be kept private on the user device but also prevent third parties from determining information about the selection criteria. Performing content selection using these cryptographic techniques on the user's device, e.g., in combination with storing candidate content on the user's device, can reduce latency and bandwidth consumption in displaying an attestable digital component relative to techniques that require such data to be transmitted to remote servers for content selection.

Reducing the latency in content presentation reduces the number of errors that occur at user devices while waiting for such content to be selected and/or arrive from a remote server. As the content often needs to be at the user device and ready for display in hundreds of milliseconds and to mobile devices connected by wireless networks, reducing the latency in selecting and/or providing the content is critical in preventing errors and reducing user frustration. Additionally, reducing the need to transmit data reduces the amount of bandwidth consumed to transmit the information, reduces the latency in transmitting the information, and reduces the amount of processing power and associated battery power for devices running on batteries (e.g., mobile devices) required to transmit the information. The cryptographic techniques described in the document in combination with storing user data and/or candidate content at user devices provide a synergistic effect of improving data security, protecting user privacy, and reducing latency in presenting content at user devices.

Various features and advantages of the foregoing subject matter are described below with respect to the figures. Additional features and advantages are apparent from the subject matter described herein and the claims.

In general, this document describes systems and techniques for using cryptography in ways that preserve user privacy in processes for selecting content to display to users. The techniques described in this document allow for such privacy preservation and data security while still providing digital components in short time periods, e.g., within milliseconds, after a request is received. The techniques can include using zero-knowledge proofs to query whether distribution parameters of digital components match attributes of a user (or a measure of match between the distribution parameters and user attributes), without enabling any party other than the user from learning the user attributes. A content selection module can select a digital component to display based on the results of the process being performed for multiple candidate digital components and optionally additional information.

<FIG> is a block diagram of an example environment <NUM> in which client devices display digital content. The example environment <NUM> includes a data communication network <NUM>, such as a local area network (LAN), a wide area network (WAN), the Internet, a mobile network, or a combination thereof. The network <NUM> connects the client devices <NUM>, publishers <NUM>, websites <NUM>, and a content management system <NUM>. The example environment <NUM> can include many different client devices <NUM>, publishers <NUM>, websites <NUM>, and content management systems <NUM>.

A website <NUM> includes one or more electronic resources <NUM>. The resources <NUM> can be associated with a domain name and hosted by one or more servers. An example website is a collection of web pages formatted in hypertext markup language (HTML) that can contain text, images, multimedia content, and programming elements, such as scripts. Each website <NUM> is maintained by a content publisher <NUM>, which is an entity that controls, manages and/or owns the website <NUM>.

A resource <NUM> is any data that can be provided by the publisher <NUM> over the network <NUM> and can be associated with a resource address. Resources include HTML pages, word processing documents, and portable document format (PDF) documents, images, video, and feed sources, to name just a few. The resources <NUM> can include content, such as words, phrases, pictures, and so on, and may include embedded information (e.g., meta information and hyperlinks) and/or embedded instructions, e.g., scripts.

A client device <NUM> is an electronic device that is capable of communicating over the network <NUM>. Example client devices <NUM> include personal computers, mobile communication devices, e.g., smart phones, and other devices that can send and receive data over the network <NUM>. A client device <NUM> can also include a digital assistant device that accepts audio input through a microphone and outputs audio output through speakers. The digital assistant can be placed into listen mode (e.g., ready to accept audio input) when the digital assistant detects a "hotword" or "hotphrase" that activates the microphone to accept audio input. The digital assistant device can also include a camera and/or display to capture images and visually present information. The digital assistant can be implemented in different forms of hardware devices including, a wearable device (e.g., watch or glasses), a smart phone, a speaker device, a tablet device, or another hardware device. A client device <NUM> can also include a digital media device, e.g., a streaming device that plugs into a television or other display to stream videos to the television, a gaming system, or a virtual reality system.

A client device <NUM> typically includes applications <NUM>, such as web browsers and/or native applications, to facilitate the sending and receiving of data over the network <NUM>. A native application is an application developed for a particular platform or a particular device, e.g., for mobile devices having a particular operating system. Publishers <NUM> can develop and provide, e.g., make available for download, native applications to the client devices <NUM>. A web browser can request a resource <NUM> from a web server that hosts a website <NUM> of a publisher <NUM>, e.g., in response to the user of the client device <NUM> entering the resource address for the resource <NUM> in an address bar of the web browser or selecting a link that references the resource address. Similarly, a native application can request application content from a remote server of a publisher.

Some resources, application pages, or other application content can include digital component slots for displaying digital components with the resources <NUM> or application pages. As used throughout this document, the phrase "digital component" refers to a discrete unit of digital content or digital information (e.g., a video clip, audio clip, multimedia clip, image, text, or another unit of content). A digital component can electronically be stored in a physical memory device as a single file or in a collection of files, and digital components can take the form of video files, audio files, multimedia files, image files, or text files and include advertising information, such that an advertisement is a type of digital component. For example, the digital component may be content that is intended to supplement content of a web page, application content (e.g., an application page), or other resource displayed by the application <NUM>. More specifically, the digital component may include digital content that is relevant to the resource content, e.g., the digital component may relate to the same topic as the web page content, or to a related topic. The provision of digital components can thus supplement, and generally enhance, the web page or application content.

When the application <NUM> loads a resource (or application content) that includes one or more digital component slots, the application <NUM> can request a digital component for each slot. In some implementations, the digital component slot can include a tag or code, e.g., one or more scripts, that, when processed by the application <NUM>, cause the application <NUM> to request a digital component for display to a user of the client device <NUM>. As described below, the application <NUM> can request digital components from the content management system <NUM> and/or a content selection module <NUM> of the client device <NUM>.

The client device <NUM> includes the content selection module <NUM> and a trusted hardware module <NUM>. The content selection module <NUM> is configured to select content, e.g., digital components, for display by the client device <NUM>, e.g., for display by an application <NUM> running on the client device <NUM>. To select digital components, the content selection module <NUM> can interact with a cryptographic analysis application <NUM> that is executed in the trusted hardware module <NUM>. In some implementations, the content selection module <NUM> is part of the application <NUM>, e.g., an application module of a web browser or native application.

The trusted hardware module <NUM> is a secure hardware computing device, such as a microcontroller or processor, that performs cryptographic functions and/or executes applications and other functions in an environment secured using cryptography. The trusted hardware module <NUM> can be in the form of an integrated circuit (IC), plug-in card, or another hardware component that can be installed on or otherwise part of a client device <NUM>. Example trusted hardware modules include Trusted Platform Modules (TPMs) and Hardware Security Modules (HSMs). Trusted hardware modules <NUM> are typically tamper proof and include protocols that limit access to the applications that run in the trusted hardware module <NUM>.

The trusted hardware module <NUM> includes the cryptographic analysis application <NUM>, a user attribute data store <NUM>, and a content data store <NUM>. The user attribute data store <NUM> is stored in the trusted hardware module <NUM>, e.g., in encrypted form, to prevent unauthorized access to user attributes stored in the user attribute data store. The content data store <NUM> can also be stored in the trusted hardware module <NUM> or in general data storage of the client device <NUM>, depending on the desired level of data security for the digital components and distribution parameters for the digital components.

In some implementations, the operating system of the client device <NUM> controls access to the trusted hardware module <NUM>. For example, the operating system can block access to the cryptographic analysis application <NUM> from any system or component other than the content selection module <NUM>.

The user attribute data store <NUM>, which can be in the form of a database, table, or other appropriate data structure, includes data identifying attributes of the user of the client device <NUM>. The user attributes can include, for the user of the client device <NUM>, personal identifiable information, demographic information (e.g., age, gender, income range, etc.) and location information that indicates a location of the client device <NUM>. In some implementations, the user attributes can include information related to activities of the user, e.g., information identifying websites visited by the user, topics of the websites, keywords obtained from the websites, and/or particular user interactions of the user at the websites. The user attributes that are stored in the user attribute data store <NUM> can include attributes that enable the identification of traits that align with a specific defined purpose, such as the use case of a particular product/service that is the subject of a digital component.

Further to the descriptions throughout this document, a user may be provided with controls (e.g., user interface elements with which a user can interact) allowing the user to make an election as to both if and when systems, programs, or features described herein may enable collection of user information (e.g., information about a user's social network, social actions, or activities, profession, a user's preferences, or a user's current location), and if the user is sent content or communications from a server. In addition, certain data may be treated in one or more ways before it is stored or used, so that personally identifiable information is removed. For example, a user's identity may be treated so that no personally identifiable information can be determined for the user, or a user's geographic location may be generalized where location information is obtained (such as to a city, ZIP code, or state level), so that a particular location of a user cannot be determined. Thus, the user may have control over what information is collected about the user, how that information is used, and what information is provided to the user.

The content data store <NUM>, which can be in the form of a database, table, or other appropriate data structure, includes data related to digital components, The data for a digital component can include, for example, the digital component itself (e.g., a data file that includes the digital component), a resource locator, e.g., a Universal Resource Locator (URL) or a Uniform Resource Identifier (URI) that indicates a network location where the digital component can be obtained, data identifying the digital component, and/or distribution parameters for the digital component. The distribution parameters for a digital component can include keywords and/or other values, e.g., targeting keywords) that are relevant to the digital component, e.g., to indicate the contexts and environments in which the digital component are to be presented and/or attributes of users to which the digital component should be presented. That is, the distribution parameters for a digital component can define a target profile of a user and context for which the digital component should be displayed. For example, the distribution parameters for a digital component related to football can include gender: men, age: <NUM>-<NUM>, location: U. , interests: sports, football, topic (or URL) of electronic resource: football or sports. In this example, the digital component would be eligible, or more likely, to be displayed to users having attributes that match these distribution parameters.

The data for a digital component can also include an amount that a digital component publisher that published the digital component is willing to provide to an electronic resource publisher if the electronic resource publisher displays the digital component on one of its electronic resources. This amount can be referred to as a publisher amount. In some implementations, the distribution parameters can include a range of values that each correspond to a measure of match between the distribution parameters of the digital component and the user attributes of the user.

The content selection module <NUM> can request data for digital components from the content management system <NUM> in response to requests initiated by digital component slots of electronic resources. In some implementations, the content selection module <NUM> can request data for digital components from the content management system <NUM> periodically and store the data in the content data store <NUM>. For example, the content selection module <NUM> can replace digital components that do not match or have a low level of match with (e.g., lower than a specified threshold) the user attributes of the user. In this example, the content selection module <NUM> can periodically select a specified number of digital components having the lowest measure of match (or that do not match) or each digital component that has less than a threshold measure of match (or that does not match) and remove the data for the selected digital components from the content data store <NUM>. The content selection module <NUM> can request data for additional digital components to replace those that have been removed. In some implementations, the content selection module <NUM> may not provide to the content management system <NUM> data identifying the removed digital components. In this way, the content management system <NUM> would not be able to infer the user's attributes based on digital components that do not match the user's attributes.

In some implementations, the quantity of distribution parameters must meet or exceed a threshold quantity parameters, to reduce the chance that a party could identify the user's attributes based on the measure of match between distribution parameters and the user's attributes. For example, the threshold quantity can be <NUM>, <NUM>, <NUM>, in the <NUM>, or another appropriate quantity. The quantity of user attributes can be on the same or a similar scale.

Stages A - F illustrate an example data flow for selecting and displaying a digital component. In stage A, the application <NUM> (or content selection module <NUM>) sends a request <NUM> for one or more digital components to the content management system <NUM>. For example, the request <NUM> can indicate a quantity of digital components requested. If the request <NUM> is being sent to request digital components for an electronic resource that is or will be displayed by the client device <NUM>, the quantity can be based on a quantity of digital component slots of the electronic resource. If the request <NUM> is to replace digital components for which data was previously stored in the content data store <NUM>, the quantity can equal or be based on the quantity removed from the content data store <NUM>. To send the request, the client device <NUM> can generate a packetized data request including a header and payload data.

In stage B, the content management system <NUM> selects one or more digital components from a digital content data storage unit <NUM> and provides a data element <NUM> that includes data for each digital component. In this example, the data element <NUM> includes a number "N" digital components and distribution parameters for each digital component. The data element <NUM> can also include, for each digital component, a publisher amount that a provider of the digital component is willing to provide a publisher of the electronic resource for display of the digital component.

In some implementations, the content management system <NUM> encrypts the data for each digital component prior to providing the data element <NUM> to the client device <NUM>. In some implementations, the content management system <NUM> can encrypt the data for each digital component using the zero-knowledge proof protocol employed by the cryptographic analysis application <NUM>.

In stage C, the application <NUM> receives the data element <NUM> and provides a corresponding data element <NUM> to the content selection module <NUM>. In other implementations, the content selection module <NUM> can receive the data element <NUM> rather than the application <NUM>, e.g., when the content selection module <NUM> sends the request <NUM>.

In stage D, the content selection module <NUM> interacts with the cryptographic analysis application <NUM> to select a digital component to display with an electronic resource that is or will be displayed by a web browser application or with content of a native application. The content selection module <NUM> can identify a set of candidate digital components from which to select a digital component. When the request <NUM> is sent to the content management system <NUM> for current digital component presentation opportunity, the candidate digital components can include each digital component referenced by the data element <NUM>. When data for digital components are stored on the client device <NUM>, the candidate digital components can include the digital components for which data is stored in the content selection module <NUM>.

For each candidate digital component, the content selection module <NUM> provides selection data for the candidate digital component to the cryptographic analysis application <NUM>. This selection data can include the distribution parameters for the candidate digital component. This selection data can also include contextual data related to the context of the environment in which a selected digital component will be displayed. For example, the contextual data can include data related to electronic resource (e.g., web page) or content of a native application with which the digital component will be displayed, the number of digital component slots of the electronic resource or native application, the type of digital component slot (e.g., image or video), the presentation location of the digital component slot within the electronic resource of native application (e.g., top, left, right, bottom, above the fold, below the fold, etc.), the time of day, the day of the week, the date, the geographic location of the client device <NUM>, etc. The data related to the electronic resource of content of the native application can include a topic for the resource/content, a title, keywords extracted from the resource/content, a resource locator (e.g., URL) for the resource, etc..

The content selection module <NUM> can use a zero-knowledge proof protocol to submit a query to the cryptographic analysis application <NUM> for each candidate digital component. The query can include the selection data for the candidate digital component. Various zero-knowledge proof protocols can be used. For a zero-knowledge proof to be valid, it must satisfy the three properties of completeness (if the claim is true, the verifier will be convinced of this fact by a prover), soundness (if the claim is false, a cheating prover cannot convince a verifier that it is true, with the exception of a small probability), and zero-knowledge (if the statement is true, the verifier does not learn anything other than the fact that the statement is true).

In some implementations, the content selection module <NUM> and the cryptographic analysis application <NUM> uses, as the zero-knowledge proof protocol, ring learning with errors (RLWE). RLWE is a quantum robust cryptographic technique that is based on arithmetic of polynomials with coefficients from a finite field.

In the example of <FIG>, the content selection module <NUM> is the verifier and the cryptographic analysis application <NUM> is the prover. Using zero-knowledge proofs, the content selection module <NUM> cannot learn anything except whether the distribution parameters of the digital component match the user attributes of the user or the measure of match.

If not already encrypted, the content selection module <NUM> can encrypt the selection data for the candidate digital component and provide a query <NUM> that includes the encrypted selection data to the cryptographic analysis application <NUM>. The cryptographic analysis application <NUM> can compare the encrypted selection data for the candidate digital component to encrypted user attributes stored in the user attributes data store <NUM>. The user attributes can also be encrypted using the same zero-knowledge proof protocol as the selection data for the candidate digital component.

Based on the comparison, the cryptographic analysis application <NUM> can determine whether the selection data for the digital component match the user attributes of the user. In some implementations, the cryptographic analysis application <NUM> can output an encrypted value that indicates whether the selection data for the digital component match the user attributes of the user. For example, the output value can be "True" if all data items of the selection data matches a corresponding user attribute or at least a specified threshold or specified percentage of the distribution parameters match its corresponding user attribute, and "False" if not. In a particular example, the output value can be "True" for a candidate digital component when at least <NUM>% of the data items of the selection data match their corresponding user attributes.

In some implementations, the cryptographic analysis application <NUM> can determine a measure of match between the selection data for a candidate digital component and the user attributes. For example, the measure of match can be based on, e.g., equal to or directly proportional to, a percentage of the data items of the selection data that match their corresponding user attributes. In a particular example, if the gender and geographic location specified for the candidate digital component match the user's gender and geographic location, but the topic of the electronic resource does not match any topics of interest, the measure of match can be <NUM>/<NUM> or <NUM>%.

In some implementations, user attributes can be weighted, e.g., based on their importance in digital component selection. In this example, the cryptographic analysis application <NUM> can determine which data items of the selection data match its corresponding user attribute and determine an aggregate score based on an aggregation (e.g., weighted um or weighted average) of the weighted values for the matching user attributes. The measure of match can be the aggregate score.

In stage E, the cryptographic analysis application <NUM> outputs, for each candidate digital component, encrypted result data <NUM> that indicates whether the selection data for the candidate digital component matches the user attributes of the user and/or the measure of match between the selection data and the user attributes. The cryptographic analysis application <NUM> provides the encrypted result data <NUM> to the content selection module <NUM>.

In stage F, the content selection module <NUM> decrypts the encrypted result data <NUM> to obtain the result data in plaintext and selects, from the candidate digital components, a digital component based at least on the result data for each candidate digital component. For example, if the result data for a candidate digital component indicates whether the selection data for the digital component matches the user attributes of the user, the content selection module <NUM> can select a digital component from the candidate digital components for which the selection data matches the user attributes of the user. In some implementations, the content selection module <NUM> can select the matching digital component having the highest corresponding publisher amount that the provider of the digital component is willing to provide to the publisher of the electronic resource or native application with which the selected digital component will be displayed.

If the result data for each candidate digital component indicates a measure of match between the selection data for the candidate digital component and the user attributes of the user, the content selection module <NUM> can select a digital component based on the measure of match and optionally the publisher amounts for the digital components. As described above, the publisher amount for a digital component can vary based on the measure of match as a digital component provider may be willing to provide a greater publisher amount for the display of digital components to users that match the target profile for the digital component.

In one example, the content selection module <NUM> can select a digital component having the highest measure of match or the highest publisher amount. In another example, the content selection module <NUM> can combine the measure of match with the publisher amount for each digital component (e.g., by multiplying the two values) and select the digital component having the product with the greatest value. In another example, the content selection module <NUM> can filter from the set of candidate digital components each digital component that has a measure of match that is below a specified threshold. The content selection module <NUM> can then select, from the remaining digital components, the digital component based on their corresponding publisher amounts, e.g., by selecting the digital component having the greatest publisher amount. The threshold can be a predetermined value or the value corresponding to a particular digital component. For example, the content selection module <NUM> can rank the digital components based on measure of match and set the threshold to the value of the <NUM>th (or another appropriate rank) highest ranking digital component such that the content selection module <NUM> selects from the top <NUM> matching digital components.

In some implementations, the content selection module <NUM> can use additional data when selecting a digital component. For example, the content selection module <NUM> can use expected performance measures for the digital components, e.g., an expected user interaction rate.

The content selection module <NUM> provides digital component data <NUM> for the selected digital component to the application <NUM>. The digital component data can include the digital component itself or a URL for the digital component so that the application <NUM> can download the digital component. In stage G, the application <NUM> then displays the selected digital component.

<FIG> shows a swim lane diagram of an example process <NUM> for selecting and displaying a digital component. Operations of the process <NUM> can be implemented, for example, by the application <NUM>, the content selection module <NUM>, the cryptographic analysis application <NUM>, and the content management system <NUM> of <FIG>. Operations of the process <NUM> can also be implemented as instructions stored on one or more computer readable media which may be non-transitory, and execution of the instructions by one or more data processing apparatus can cause the one or more data processing apparatus to perform the operations of the process <NUM>.

The application <NUM> sends a request for one or more digital components to the content management system (<NUM>). The application <NUM> can send the request based on an electronic resource that is being displayed by the application. In some implementations, the content selection module <NUM> sends the request to obtain data for digital components to store at the client device <NUM>, e.g., in a local cache of the client device <NUM>.

The content management system <NUM> selects one or more digital components (<NUM>). The content management system <NUM> sends a data element that includes data for the digital components to the application <NUM> or to the content selection module <NUM> (<NUM>). As described above, the data for a digital component can include distribution parameters and a publisher amount that the provider of the digital component is willing to provide to a publisher for display of the digital component with an electronic resource or native application of the publisher. In some implementations, the data for a digital component includes a range of publisher amounts or a set of publisher amounts that can be selected from based on a measure of match between selection data for the digital component and user attributes of a user. The data for each digital component can be encrypted according to a zero-knowledge proof protocol employed by the cryptographic analysis application <NUM>.

The application <NUM> sends, to the content selection module <NUM>, a request to select a digital component for display by the application <NUM> (<NUM>). The request can include the data element received from the content management system <NUM>.

The content selection module <NUM> sends, to the cryptographic analysis application <NUM>, a request for a match analysis to be performed for each of multiple candidate digital components (<NUM>). As described above, the request, which can be in the form of a query, includes encrypted selection data for the candidate digital component. The selection data, which can include distribution parameters for the digital component and contextual data, can be encrypted using the zero-knowledge proof protocol used by the cryptographic analysis application <NUM>.

The cryptographic analysis application <NUM> determines whether the selection data matches user attributes of a user and /or determines a measure of match between the selection data and the user attributes (<NUM>). The cryptographic analysis application <NUM> uses the zero-knowledge proof protocol to compare the encrypted selection data for the candidate digital component to encrypted user attributes of a user of the client device <NUM>, e.g., a user of the application <NUM>. As described above the cryptographic analysis application <NUM> can run in a trusted hardware module <NUM> and perform cryptographic functions in the trusted hardware module <NUM>.

The cryptographic analysis application <NUM> sends, to the content selection module <NUM>, a match indicator for each candidate digital component (<NUM>). The match indicator can be an encrypted result output by the cryptographic analysis application <NUM>. The match indicator can indicate whether the selection data for the candidate digital component matches the user attributes of the user and/or the measure of match between the selection data for the candidate digital component.

The content selection module <NUM> selects, from the candidate digital components, a digital component for display by the application <NUM> (<NUM>). The content selection module <NUM> can decrypt the match indicator for each candidate digital component and select the digital component based at least in part based on the match indicator. As described above, the content selection module <NUM> can select the digital component based on whether each candidate digital component matches the user attributes of the user (e.g., whether the selection data matches the user attributes), the measure of match for each candidate digital component, the publisher amounts for each candidate digital component, and/or other data.

The content selection module <NUM> sends, to the application <NUM>, data about the selected digital component (<NUM>). This data can include the digital component itself of a resource locator to obtain the selected digital component.

The application <NUM> displays the selected digital component (<NUM>). The application <NUM> can display the digital component in a digital component slot of the electronic resource or native application.

The application <NUM> monitors for user interaction with the displayed digital component (<NUM>). If a user interaction is detected, the application <NUM> can report the user interaction to the content management system <NUM> (<NUM>). In some implementations, the application <NUM> can interact with the cryptographic analysis application <NUM>, e.g., via the content selection module <NUM>, to encrypt a notification that includes data indicating the user interaction. The application <NUM> can then send the encrypted notification to the content management system <NUM>. Similarly, the application <NUM> can monitor for a conversion event and send an encrypted notification for any detected conversion event.

In some implementations, the cryptographic analysis application <NUM> encrypts the notifications using the zero-knowledge proof protocol. In some implementations, the cryptographic analysis application <NUM> encrypts the notifications using an encryption key or signature based on the client device. However, the use of device-specific keys or signatures may enable other entities to identify the user, e.g., similar to a device identifier. Using the zero-knowledge proof ensures that the user's identity is hidden from observation.

In addition, using the cryptographic analysis application <NUM> to encrypt the notifications related to user interactions proves that a user is involved in the sequence of events, which is super important because it helps prevent attacks like click fraud by providing attestation of real user interaction. Essentially, a challenge is given that has been validated by user interaction (a protected OS function that cannot be interacted with via a thread or other automated process, but only from a privileged input such as touching the screen, etc.).

<FIG> is a diagram of an example process <NUM> for selecting and displaying a digital component. Operations of the process <NUM> can be implemented, for example, by a client device, e.g., the client device <NUM> of <FIG>. Operations of the process <NUM> can also be implemented as instructions stored on one or more computer readable media which may be non-transitory, and execution of the instructions by one or more data processing apparatus can cause the one or more data processing apparatus to perform the operations of the process <NUM>.

The client device receives a data element that identifies one or more candidate digital components (<NUM>). The data element can include data for each candidate digital component. The data for each candidate digital component can include the digital component itself, a resource locator for obtaining the candidate digital component, distribution parameters for each digital component, and a publisher amount that a provider of the candidate digital component is willing to provide a publisher of the electronic resource for display of the candidate digital component. The data for each digital component can be encrypted using a zero-knowledge proof protocol that is used by a cryptographic analysis application.

For each digital component, the client device provides encrypted selection data as an input to the cryptographic analysis application (<NUM>). As described above, the cryptographic analysis application can run in a trusted hardware module of the client device. The encrypted selection data can represent the set of distribution parameters for the candidate digital component and can be encrypted using the zero-knowledge proof protocol used by the cryptographic analysis application. As described above, the selection data for a candidate digital component can also include contextual data for an environment in which a selected digital component will be displayed.

In some implementations, the client device receives a collection of distribution parameters for multiple digital components. The collection can be encrypted together or the distribution parameters for each digital component can be encrypted separate from each other digital component. A content management system can select multiple digital components to include in the collection, e.g., based on a resource, such as a web page, that has been requested by the client device of the user. The client device provides the distribution parameters for the collection to the cryptographic analysis application for use in selecting a digital component to display to the user at the client device.

The cryptographic analysis application is configured to determine a measure of match between the selection data and user attributes of a user of the client device. The user attributes can be stored in the trusted hardware module, as described above. The cryptographic analysis application can determine the measure of match between the selection data and user attributes by comparing each data item of the selection data to a corresponding user attribute of the user.

For each candidate digital component, the client device (e.g., a content selection module of the client device) receives, as an output of the cryptographic analysis application, an encrypted result that indicates the measure of match between the selection data and the user attributes of a user (<NUM>). The encrypted result can be encrypted using the zero-knowledge proof protocol of the cryptographic analysis application.

The client device decrypts the encrypted result for each candidate digital component (<NUM>). A content selection module of the client device can decrypt the encrypted result using the zero-knowledge protocol of the cryptographic analysis application.

The client device selects, from the candidate digital components, a given digital component based on the measure of match for each candidate digital component (<NUM>). As described above a content selection module of the client device can select a digital component based on the measure of match for each candidate digital component and a publisher amount for each candidate digital component.

The client device displays the given digital component (<NUM>). For example, an application running on the client device can display the given digital component in a digital component slot of an electronic resource, e.g., web page, being displayed by a display of the client device.

<FIG> is a block diagram of an example computer system <NUM> that can be used to perform operations described above. The system <NUM> includes a processor <NUM>, a memory <NUM>, a storage device <NUM>, and an input/output device <NUM>. Each of the components <NUM>, <NUM>, <NUM>, and <NUM> can be interconnected, for example, using a system bus <NUM>. The processor <NUM> is capable of processing instructions for execution within the system <NUM>. In some implementations, the processor <NUM> is a single-threaded processor. In another implementation, the processor <NUM> is a multi-threaded processor. The processor <NUM> is capable of processing instructions stored in the memory <NUM> or on the storage device <NUM>.

Claim 1:
A computer-implemented method comprising:
receiving a data element identifying a set of candidate digital components and, for each candidate digital component, a set of distribution parameters for the candidate digital component;
for each candidate digital component,
providing encrypted selection data for the candidate digital component as input to a cryptographic analysis application running in a trusted hardware module of a client device, wherein the encrypted selection data represents the set of distribution parameters for the candidate digital component and is encrypted using a zero-knowledge proof protocol, and wherein the cryptographic analysis application is configured to determine a measure of match between the selection data and user attributes of a user of the client device, and
receiving, as an output of the cryptographic analysis application, an encrypted result that indicates the measure of match between the selection data and the user attributes of a user, wherein the encrypted result is encrypted using the zero-knowledge proof protocol;
decrypting the encrypted result for each candidate digital component;
selecting, from the candidate digital components, a given digital component based on the measure of match for each candidate digital component; and
displaying the given digital component.