Privacy preserving protocol for serving user-specific supplemental content

A method, comprising:

• performing, by a privacy preserving supplemental content server (PPSCS) implemented by one or more processors with associated memory:
• storing a first secret share of a user-to-segment map (USM), wherein the USM contains user-private information used to select supplemental content for users consuming content at a content server, wherein the first secret share does not reveal the user-private information, and wherein a second secret share of the USM is stored at the content server;
• receiving a request from the content server to serve supplemental content to a user, wherein the request indicates a request context determined by the content server;
• executing one side of a privacy preserving protocol with the content server to perform a lookup of user segment data of the user in the USM based at least in part on the request context, wherein the privacy preserving protocol guarantees that:
• (a) the content server does not learn any user-private information about the user in the USM,
• (b) the PPSCS learns at most one user segment of the user, and
• (c) the PPSCS cannot track the user over multiple requests from the content server using any user-private information about the user in the USM learned during the execution;
• selecting the supplemental content for the request based at least in part on results of the lookup;
• and
• sending the supplemental context in a response according to the request, wherein the response does not reveal the supplemental content to the content server.

One or more non-transitory computer-accessible storage media storing program instructions that when executed on one or more processors of a privacy preserving supplemental content server (PPSCS), cause the PPSCS to:

• store a first secret share of a user-to-segment map (USM), wherein the USM contains user-private information used to select supplemental content for users consuming content at a content server, wherein the first secret share does not reveal the user-private information, and wherein a second secret share of the USM is stored at the content server;
• receive a request from the content server to serve supplemental content to a user, wherein the request indicates a request context determined by the content server;
• execute one side of a privacy preserving protocol with the content server to perform a lookup of user segment data of the user in the USM based at least in part on the request context, wherein the privacy preserving protocol guarantees that:
• (a) the content server does not learn any user-private information about the user in the USM,
• (b) the PPSCS learns at most one user segment of the user, and
• (c) the PPSCS cannot track the user over multiple requests from the content server using any user-private information about the user in the USM learned during the execution;
• select the supplemental content for the request based at least in part on results of the lookup;
• and
• send the supplemental content in a response according to the request, wherein the response does not reveal the supplemental content to the content server.