System and method for privacy-preserving advertisement selection

A system, comprising:

• a processor;
• and
• a memory in communication with said processor, said memory for storing a plurality of processing instructions for directing said processor to:
• receive information from a plurality of set top boxes (STBs) encrypted by each STB using a public component of a first public key pair, the information from each STB including
• an identifier of the STB,
• an identifier of an advertisement, and
• an indication as to whether one or more criteria for display of the advertisement are met, wherein the indication is encrypted with the public component of a second public key pair;
• decrypt the encrypted information from each STB, to recover the identifier of each STB;
• encrypt the identifier of the advertisement using the public component of the second public key pair;
• and
• forward all encrypted indications and the encrypted identifier of the advertisement together to a head end, enabling the head end to count the number M of STBs at which the criteria are met,
• wherein the private component of the first public key pair is held at the anonymizing service node and is not available to the head end, and the private component of the second public key pair is held at the head end and not available to the anonymizing service,
• wherein said memory further stores processing instructions for directing said processor to:
• receive, at the anonymizing service node, further information from each STB, encrypted using the public component of the first public key pair, the further information including
• the identifier of the STB, and
• an indication of whether the advertisement was displayed at the STB,
• encrypted with the public component of the second key pair;
• decrypt the encrypted further information from each STB, to recover the identifier of each STB, said decryption performed using the private component of the first public key
• encrypt the identifier of the advertisement with the public component of the second public key pair;
• forward all encrypted indications of whether the advertisement was displayed and the encrypted identifier of the advertisement together, enabling the head end to count the number of STBs that displayed the advertisement,
• wherein the indication of whether the advertisement was displayed is generated at each STB, wherein a decision regarding whether to display the advertisement is made at each STB in response to a command issued to each STB from the head end, wherein the command includes a parameter Pshow=N/M−Pshow<=1,
• where N is the number of households desired to see the advertisement and
• M is the number of households indicating that the criteria is met, as counted by the head end;
• and
• wherein after receiving the command, each STB creates a random number between 0 and 1 and displays the advertisement only if the random number is less than or equal to Pshow.

A computer program product comprising a non-transitory computer useable medium having computer program logic stored thereon, the computer control logic comprising:

• logic configured to cause a processor to receive information from a plurality of set top boxes (STBs) encrypted by each STB using a public component of a first public key pair, the information from each STB including
• an identifier of the STB,
• an identifier of an advertisement, and
• an indication as to whether one or more criteria for display of the advertisement are met, wherein the indication is encrypted with the public component of a second public key pair;
• logic configured to cause the processor to decrypt the encrypted information from each STB, to recover the identifier of each STB;
• logic configured to cause the processor to encrypt the identifier of the advertisement using the public component of the second public key pair;
• and
• logic configured to cause the processor to forward all encrypted indications and the encrypted identifier of the advertisement together to a head end, enabling the head end to count the number M of STBs at which the criteria are met,
• wherein the private component of the first public key pair is held at the anonymizing service node and is not available to the head end and the private component of the second public key pair is held at the head end and not available to the anonymizing service, wherein said computer control logic further comprises:
• logic configured to cause the processor to receive, at the anonymizin service node, further information from each STB, encrypted using the public component of the first public key pair, the further information including
• the identifier of the STB, and
• an indication of whether the advertisement was displayed at the STB, encrypted with the public component of the second key pair,
• wherein the indication of whether the advertisement was displayed was encrypted using the public component of the first public key pair;
• logic configured to cause the processor to decrypt the encrypted further information from each STB, to recover the identifier of each STB, the decryption performed using the private component of the first public key pair;
• and
• logic configured to cause the processor to forward all encrypted indications of whether the advertisement was displayed and the encrypted identifier of the advertisement together to the head end, enabling the head end to count the number of STBs that displayed the advertisement,
• wherein the indication of whether the advertisement was displayed is generated at each STB, wherein a decision regarding whether to display the advertisement is made at each STB in response to a command issued to each STB from the head end, wherein the command includes a parameter Pshow=N/M−Pshow<=1,
• where N is the number of households desired to see the advertisement and
• M is the number of households indicating that the criteria are met, as counted by the head end;
• and
• wherein after receiving the command, each STB creates a random number between 0 and 1 and displays the advertisement only if the random number is less than or equal to Pshow.