Patent ID: 8429685

Claim:
A method, comprising: receiving, at an anonymizing service node, information from a plurality of set top boxes (STBs) encrypted by each STB using a public component of a first public key pair, the information from each STB including an identifier of the STB, an identifier of an advertisement, and an indication as to whether one or more criteria for display of the advertisement are met, wherein the indication is encrypted with the public component of a second public key pair; decrypting the encrypted information from each STB, to recover the identifier of each STB; encrypting the identifier of the advertisement using the public component of the second public key pair; and forwarding all encrypted indications and the encrypted identifier of the advertisement together to a head end, enabling the head end to count the number M of STBs at which the criteria is met, wherein the private component of the first public key pair is held at the anonymizing service node and is not available to the head end and the private component of the second public key pair is held at the head end and not available to the anonymizing service, the method further comprising: receiving, at the anonymizing service node, further information from each STB, encrypted using the public component of the first public key pair, the further information including the identifier of the STB, and an indication of whether the advertisement was displayed at the STB, encrypted with the public component of the second key pair, decrypting the encrypted further information from each STB, to recover the identifier of each STB, said decryption performed using the private component of the first public key pair; encrypting the identifier of the advertisement with the public component of the second public key pair; and forwarding all encrypted indications of whether the advertisement was displayed and the encrypted identifier of the advertisement together to the head end, enabling the head end to count the number of STBs that displayed the advertisement, wherein the indication of whether the advertisement was displayed is generated at each STB, wherein a decision regarding whether to display the advertisement is made at each STB in response to a command issued to each STB from the head end, wherein the command includes a parameter Pshow<=N/M, where N is the number of households desired to see the advertisement and M is the number of households indicating that the criteria is met, as counted by the headend; wherein after receiving the command, each STB creates a random number between 0 and 1 and displays the advertisement only if the random number is less than or equal to Pshow.