System and method for privacy-preserving advertisement selection

• US 8,429,685 B2
• Filed: 07/09/2010
• Issued: 04/23/2013
• Est. Priority Date: 07/09/2010
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Yarvis, Mark D., Garg, Sharad
• Primary Examiner(s): Zhong, Jun Fei
• Assistant Examiner(s): RABOVIANSKI, JIVKA A
• Application Number:
  US12/833,035
• Publication Number:
  US 20120011538A1
• Time in Patent Office: 1,019 Days
• Field of Search: 725/31, 725/116, 725/34, 725/109
• US Class Current: 725/31
• CPC Class Codes: H04N 21/44204 Monitoring of content usage, e.g. the number of times a movie has been viewed, copied or the amount which has been watched monitoring of user activities for profile generation for accessing a video database G06F16/739; protecting generic digital content where the protection is independent of the precise nature of the content G06F21/10; arrangements for monitoring the use made of the broadcast services in broadcast systems H04H60/31
• CPC Class Codes: H04N 21/4667 Processing of monitored end-user data, e.g. trend analysis based on the log file of viewer selections
• CPC Class Codes: H04N 21/812 involving advertisement data advertising per se G06Q30/02

Abstract

Methods and systems to provide targeted advertising in a subscription television setting, wherein the households that receive the targeted advertisement may retain anonymity. This may be achieved by marrying an anonymization protocol and infrastructure with a mechanism for STB selection and reporting. This anonymizes the set of households that are selected to play an ad, by ensuring that when an STB meets defined criteria and sends a ‘criteria met’ message (during the selection process) or ‘ad shown’ message (during a validation or counting process) to a head end, an STB or household identifier is not revealed, thus anonymizing the household information from the head end. In addition, this allows the head end to control the ad campaign process by advertising only to those households that meet specified criteria, and to count the number of actual instances in which an ad was displayed. The head end is able to count the number of times an ad was displayed, without knowing which particular household(s) viewed the ad.

Claims

1. A method, comprising:

receiving, at an anonymizing service node, information from a plurality of set top boxes (STBs) encrypted by each STB using a public component of a first public key pair, the information from each STB including

an identifier of the STB,

an identifier of an advertisement, and

an indication as to whether one or more criteria for display of the advertisement are met,

wherein the indication is encrypted with the public component of a second public key pair;

decrypting the encrypted information from each STB, to recover the identifier of each STB;

encrypting the identifier of the advertisement using the public component of the second public key pair; and

forwarding all encrypted indications and the encrypted identifier of the advertisement together to a head end, enabling the head end to count the number M of STBs at which the criteria is met,

wherein the private component of the first public key pair is held at the anonymizing service node and is not available to the head end and the private component of the second public key pair is held at the head end and not available to the anonymizing service, the method further comprising;

receiving, at the anonymizing service node, further information from each STB, encrypted using the public component of the first public key pair, the further information including

the identifier of the STB, and

an indication of whether the advertisement was displayed at the STB, encrypted with the public component of the second key pair,

decrypting the encrypted further information from each STB, to recover the identifier of each STB, said decryption performed using the private component of the first public key pair;

encrypting the identifier of the advertisement with the public component of the second public key pair; and

forwarding all encrypted indications of whether the advertisement was displayed and the encrypted identifier of the advertisement together to the head end, enabling the head end to count the number of STBs that displayed the advertisement,

wherein the indication of whether the advertisement was displayed is generated at each STB,

wherein a decision regarding whether to display the advertisement is made at each STB in response to a command issued to each STB from the head end, wherein the command includes a parameter Pshow<

=N/M,

where N is the number of households desired to see the advertisement and M is the number of households indicating that the criteria is met, as counted by the headend;

wherein after receiving the command, each STB creates a random number between 0 and 1 and displays the advertisement only if the random number is less than or equal to Pshow.

2. The method of claim 1, wherein the information from each STB further includes a first timestamp and authentication data, such that the first timestamp and authentication data are also encrypted using the public component of the first public key pair;

and

wherein the method of claim 1 further comprises;

after decrypting the encrypted information from each STB, verifying the authentication data and determining whether the first timestamp matches any previously received timestamps.

3. The method of claim 1, wherein the further information includes authentication data and a second timestamp, such that the authentication data and the second timestamp were also encrypted using the public component of the first public key pair;

and

wherein the method further comprises;

after decrypting the encrypted further information, verifying the authentication data and determining whether the first timestamp matches any previously received timestamp.

4. The method of claim 3, further comprising:

calculating a checksum on the basis of the STBs'"'"' respective indications of whether the advertisement was displayed;

encrypting the checksum and said second timestamp using the public component of the second public key pair; and

forwarding the encrypted checksum and second timestamp to the head end along with each of the STBs'"'"' respective indications of whether the advertisement was displayed.

5. The method of claim 1, wherein the STB creates the indication that the criteria is met, in response to a broadcast from the head end identifying an opportunity to display the advertisement and specifying the criteria for displaying the advertisement.

6. A system, comprising:

a processor; and

a memory in communication with said processor, said memory for storing a plurality of processing instructions for directing said processor to;

receive information from a plurality of set top boxes (STBs) encrypted by each STB using a public component of a first public key pair, the information from each STB including

an identifier of the STB,

an identifier of an advertisement, and

an indication as to whether one or more criteria for display of the advertisement are met, wherein the indication is encrypted with the public component of a second public key pair;

decrypt the encrypted information from each STB, to recover the identifier of each STB;

encrypt the identifier of the advertisement using the public component of the second public key pair; and

forward all encrypted indications and the encrypted identifier of the advertisement together to a head end, enabling the head end to count the number M of STBs at which the criteria are met,

wherein the private component of the first public key pair is held at the anonymizing service node and is not available to the head end, and the private component of the second public key pair is held at the head end and not available to the anonymizing service,

wherein said memory further stores processing instructions for directing said processor to;

receive, at the anonymizing service node, further information from each STB, encrypted using the public component of the first public key pair, the further information including

the identifier of the STB, and

an indication of whether the advertisement was displayed at the STB,

encrypted with the public component of the second key pair;

decrypt the encrypted further information from each STB, to recover the identifier of each STB, said decryption performed using the private component of the first public key

encrypt the identifier of the advertisement with the public component of the second public key pair;

forward all encrypted indications of whether the advertisement was displayed and the encrypted identifier of the advertisement together, enabling the head end to count the number of STBs that displayed the advertisement,

wherein the indication of whether the advertisement was displayed is generated at each STB, wherein a decision regarding whether to display the advertisement is made at each STB in response to a command issued to each STB from the head end, wherein the command includes a parameter Pshow=N/M−

Pshow<

=1,

where N is the number of households desired to see the advertisement and

M is the number of households indicating that the criteria is met, as counted by the head end; and

wherein after receiving the command, each STB creates a random number between 0 and 1 and displays the advertisement only if the random number is less than or equal to Pshow.

7. The system of claim 6, wherein the information from each STB further includes a first timestamp and authentication data, such that the first timestamp and authentication data are also encrypted using the public component of the first public key pair;

and wherein said memory further stores processing instructions for directing said processor to;

after decrypting the encrypted information from each STB, verify the authentication data and determine whether the first timestamp matches any previously received timestamps.

8. The system of claim 6, wherein the indication further information includes authentication data and a second timestamp, such that the authentication data and the second timestamp have also been encrypted using the public component of the first public key pair;

and

wherein said memory further stores processing instructions for directing said processor to;

after decrypting the encrypted further information, verify the authentication data and determining whether the second timestamp matches any previously received timestamp.

9. The system of claim 8, wherein said memory further stores processing instructions for directing said processor to:

calculate a checksum on the basis of the STBs'"'"' respective indications of whether the advertisement was displayed;

encrypt the checksum and the second timestamp using the public component of the second public key pair; and

forward the encrypted checksum and second timestamp to the head end along with each of the STBs'"'"' respective indications of whether the advertisement was displayed.

10. The system of claim 6, wherein the STB creates the indication that the criteria is met, in response to a broadcast from the head end identifying an opportunity to display the advertisement and specifying the criteria for displaying the advertisement.

11. A computer program product comprising a non-transitory computer useable medium having computer program logic stored thereon, the computer control logic comprising:

logic configured to cause a processor to receive information from a plurality of set top boxes (STBs) encrypted by each STB using a public component of a first public key pair, the information from each STB including

an identifier of the STB,

an identifier of an advertisement, and

an indication as to whether one or more criteria for display of the advertisement are met, wherein the indication is encrypted with the public component of a second public key pair;

logic configured to cause the processor to decrypt the encrypted information from each STB, to recover the identifier of each STB;

logic configured to cause the processor to encrypt the identifier of the advertisement using the public component of the second public key pair; and

logic configured to cause the processor to forward all encrypted indications and the encrypted identifier of the advertisement together to a head end, enabling the head end to count the number M of STBs at which the criteria are met,

wherein the private component of the first public key pair is held at the anonymizing service node and is not available to the head end and the private component of the second public key pair is held at the head end and not available to the anonymizing service, wherein said computer control logic further comprises;

logic configured to cause the processor to receive, at the anonymizin service node, further information from each STB, encrypted using the public component of the first public key pair, the further information including

the identifier of the STB, and

an indication of whether the advertisement was displayed at the STB, encrypted with the public component of the second key pair,

wherein the indication of whether the advertisement was displayed was encrypted using the public component of the first public key pair;

logic configured to cause the processor to decrypt the encrypted further information from each STB, to recover the identifier of each STB, the decryption performed using the private component of the first public key pair; and

logic configured to cause the processor to forward all encrypted indications of whether the advertisement was displayed and the encrypted identifier of the advertisement together to the head end, enabling the head end to count the number of STBs that displayed the advertisement,

wherein the indication of whether the advertisement was displayed is generated at each STB, wherein a decision regarding whether to display the advertisement is made at each STB in response to a command issued to each STB from the head end, wherein the command includes a parameter Pshow=N/M−

Pshow<

=1,

where N is the number of households desired to see the advertisement and

M is the number of households indicating that the criteria are met, as counted by the head end; and

wherein after receiving the command, each STB creates a random number between 0 and 1 and displays the advertisement only if the random number is less than or equal to Pshow.

12. The computer program product of claim 11, wherein the information from each STB further includes a first timestamp and authentication data, such that the first timestamp and authentication data are also encrypted using the public component of the first public key pair;

and

wherein said computer control logic further comprises;

logic configured to cause the processor to, after decrypting the encrypted information from each STB, verify the authentication data and determine whether the first timestamp matches any previously received timestamps.

13. The computer program product of claim 11, wherein the further information includes authentication data and a second timestamp, such that the authentication data and the second timestamp have also been encrypted using the public component of the first public key pair;

and

wherein said computer control logic further comprises;

logic configured to cause the processor to, after decrypting the encrypted further information, verify the authentication data and determining whether the second timestamp matches any previously received timestamp.

14. The computer program product of claim 13, wherein said computer control logic further comprises:

logic configured to cause the processor to calculate a checksum on the basis of the STBs'"'"' respective indications of whether the advertisement was displayed;

logic configured to cause the processor to encrypt the checksum and the second timestamp using the public component of the second public key pair; and

logic configured to cause the processor to forward the encrypted checksum and second timestamp to the head end along with each of the STBs'"'"' respective indications of whether the advertisement was displayed.