# US 10,313,326 B2 · Systems and methods for managing secure sharing of online advertising data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,313,326 B2
- Document ID: US10313326B2
- Status: Granted
- Kind: B2
- Application number: 15/903,490
- Filed: 2018-02-23
- Published: 2018-06-28
- Granted: 2019-06-04
- Earliest claimed: 2014-06-27
- Assignees: Oath (Americas) Inc.
- Applicants: Oath (Americas) Inc.
- Inventors: Matthew M. Patton; Seth Mitchell Demsey
- Web page: https://patentgrep.com/patent/US10313326B2

## CPC

- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06Q 30/0241: Advertisements
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)}
- H04L 63/102: {Entity profiles}
- G06F 21/1076: {Revocation}
- G06F 2221/2137: Time limited access, e.g. to a computer or data
- H04L 2209/603: Digital right managament [DRM]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Systems and methods are disclosed for managing online advertising data secure sharing. One method includes receiving, at a server, a request for proprietary data from a data consumer, the request including a data consumer identifier; retrieving, from a database of proprietary data, proprietary data based on the request; determining, by the server, whether the retrieved proprietary data is at least one of: designated to be processed and designated to have privileges set; processing, by the server, the proprietary data when the server determines the proprietary data is designated to be processed; setting one or more privileges to the proprietary data using the certificate associated with the data consumer identifier when the server determines the proprietary data is designated to have privileges set; encrypting the proprietary data using the certificate associated with the data consumer identifier; and transmitting the encrypted proprietary data to the data consumer.

## Claims

### Claim 1

A method for managing online user data secure sharing, the method including:
receiving, at a server, a request for online user data from a data consumer device, the request including a data consumer identifier of the data consumer device;
determining, based on the request and the data consumer identifier, privileges associated with the data consumer device;
retrieving, from a database, the online user data based on the data consumer identifier of the request and the determined privileges associated with the data consumer device;
determining, by the server, whether the online user data is designated to be processed and/or designated to have privileges set, the determining whether the online user data is designated to be processed being based on the determined privileges associated with the data consumer device;
upon the determining that the online user data is designated to be processed, based on the determined privileges associated with the data consumer device, removing user-identifiable information from the online user data, and applying data aggregation processing to the online user data to convert the online user data to non-user-identifiable aggregated metadata;
encrypting the non-user-identifiable aggregated metadata by using a certificate associated with the data consumer identifier;
upon the determining that the online user data is designated to have privileges set, setting one or more privileges of the online user data using the certificate associated with the data consumer identifier of the request, the one or more privileges comprising a duration of data accessibility, and/or a data access revocation condition;
encrypting the online user data for which the one or more privileges were set by using the certificate associated with the data consumer identifier; and
providing the encrypted online user data and/or the encrypted non-user-identifiable aggregated metadata to the data consumer device.

### Claim 2 (depends on 1)

The method of claim 1, wherein the data consumer device is at least one of a data owner, a data broker, an Internet advertiser, reporting service, an impression bidder, and a data management platform service.

### Claim 3 (depends on 1)

The method of claim 1, wherein the one or more privileges include restricting access time to the online user data, restricting a type and/or format of the online user data, restricting the online user data to be aggregated data, and revoking access to the online user data under predefined conditions.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
receiving, from a digital rights management system, an authentication request, the authentication request requesting allowance to access the encrypted online user data from the data consumer device.

### Claim 5 (depends on 4)

The method of claim 4, further comprising:
determining, by the server, whether to allow access to the encrypted online user data; and
transmitting, to the digital rights management system, a result of the determination of whether to allow access to the encrypted online user data.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
decrypting the request for the online user data using the certificate associated with the data consumer identifier,
wherein the retrieving, from the database, the online user data is based on the decrypted request.

### Claim 7 (depends on 1)

The method of claim 1, wherein the encrypting the online user data using the certificate associated with the data consumer identifier includes:
transmitting, to a digital rights management platform, the online user data and the certificate associated with the data consumer identifier; and
receiving, from the digital rights management platform, the encrypted online user data.

### Claim 8

A system for managing online user data secure sharing, the system including:
a data storage device storing instructions for securely managing online user data sharing; and
a processor configured to execute the instructions to perform a method managing online user data secure sharing, the method including:
receiving, at a server, a request for online user data from a data consumer device, the request including a data consumer identifier of the data consumer device;
determining, based on the request and the data consumer identifier, privileges associated with the data consumer device;
retrieving, from a database, the online user data based on the data consumer identifier of the request and the determined privileges associated with the data consumer device;
determining, by the server, whether the online user data is designated to be processed and/or designated to have privileges set, the determining whether the online user data is designated to be processed being based on the determined privileges associated with the data consumer device;
upon the determining that the online user data is designated to be processed, based on the determined privileges associated with the data consumer device, removing user-identifiable information from the online user data, and applying data aggregation processing to the online user data to convert the online user data to non-user-identifiable aggregated metadata;
encrypting the non-user-identifiable aggregated metadata by using a certificate associated with the data consumer identifier;
upon the determining that the online user data is designated to have privileges set, setting one or more privileges of the online user data using the certificate associated with the data consumer identifier of the request, the one or more privileges comprising a duration of data accessibility, and/or a data access revocation condition;
encrypting the online user data for which the one or more privileges were set by using the certificate associated with the data consumer identifier; and
providing the encrypted online user data and/or the encrypted non-user-identifiable aggregated metadata to the data consumer device.

### Claim 9 (depends on 8)

The system of claim 8, wherein the data consumer device is at least one of a data owner, a data broker, an Internet advertiser, reporting service, an impression bidder, and a data management platform service.

### Claim 10 (depends on 8)

The system of claim 8, wherein the one or more privileges include restricting access time to the online user data, restricting a type and/or format of the online user data, restricting the online user data to be aggregated data, and revoking access to the online user data under predefined conditions.

### Claim 11 (depends on 8)

The system of claim 8, wherein the processor is further configured to execute the instructions to perform the method further including:
receiving, from a digital rights management system, an authentication request, the authentication request requesting allowance to access the encrypted online user data from the data consumer device.

### Claim 12 (depends on 11)

The system of claim 11, wherein the processor is further configured to execute the instructions to perform the method further including:
determining, by the server, whether to allow access to the encrypted online user data; and
transmitting, to the digital rights management system, a result of the determination of whether to allow access to the encrypted online user data.

### Claim 13 (depends on 8)

The system of claim 8, wherein the processor is further configured to execute the instructions to perform the method further including:
decrypting the request for the online user data using the certificate associated with the data consumer identifier,
wherein the retrieving, from the database, the online user data is based on the decrypted request.

### Claim 14 (depends on 8)

The system of claim 8, wherein the encrypting the online user data using the certificate associated with the data consumer identifier includes:
transmitting, to a digital rights management platform, the online user data and the certificate associated with the data consumer identifier; and
receiving, from the digital rights management platform, the encrypted online user data.

### Claim 15

A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for managing online user data secure sharing, the method including:
receiving, at a server, a request for online user data from a data consumer device, the request including a data consumer identifier of the data consumer device;
determining, based on the request and the data consumer identifier, privileges associated with the data consumer device;
retrieving, from a database, the online user data based on the data consumer identifier of the request and the determined privileges associated with the data consumer device;
determining, by the server, whether the online user data is designated to be processed and/or designated to have privileges set, the determining whether the online user data is designated to be processed being based on the determined privileges associated with the data consumer device;
upon the determining that the online user data is designated to be processed, based on the determined privileges associated with the data consumer device, removing user-identifiable information from the online user data, and applying data aggregation processing to the online user data to convert the online user data to non-user-identifiable aggregated metadata;
encrypting the non-user-identifiable aggregated metadata by using a certificate associated with the data consumer identifier;
upon the determining that the online user data is designated to have privileges set, setting one or more privileges of the online user data using the certificate associated with the data consumer identifier of the request, the one or more privileges comprising a duration of data accessibility, and/or a data access revocation condition;
encrypting the online user data for which the one or more privileges were set by using the certificate associated with the data consumer identifier; and
providing the encrypted online user data and/or the encrypted non-user-identifiable aggregated metadata to the data consumer device.

### Claim 16 (depends on 15)

The computer-readable medium of claim 15, wherein the data consumer device is at least one of a data owner, a data broker, an Internet advertiser, reporting service, an impression bidder, and a data management platform service.

### Claim 17 (depends on 15)

The computer-readable medium of claim 15, wherein the one or more privileges include restricting access time to the online user data, restricting a type and/or format of the online user data, restricting the online user data to be aggregated data, and revoking access to the online user data under predefined conditions.

### Claim 18 (depends on 15)

The computer-readable medium of claim 15, further comprising:
receiving, from a digital rights management system, an authentication request, the authentication request requesting allowance to access the encrypted online user data from the data consumer device.

### Claim 19 (depends on 18)

The computer-readable medium of claim 18, further comprising:
determining, by the server, whether to allow access to the encrypted online user data; and
transmitting, to the digital rights management system, a result of the determination of whether to allow access to the encrypted online user data.

### Claim 20 (depends on 15)

The computer-readable medium of claim 15, further comprising:
decrypting the request for the online user data using the certificate associated with the data consumer identifier,
wherein the retrieving, from the database, the online user data is based on the decrypted request.