Preventing data manipulation using multiple aggregation servers

1. A computer-implement method comprising:

receiving, by a first aggregation server and from each of multiple client devices, impression data that includes, for each impression of a digital component recorded by the client device, a first key value pair that includes (i) a first join key that is based on a unique identifier for the impression and (ii) a first value comprising encrypted impression data that has been encrypted using a first public key of the first aggregation server and using a second public key of a second aggregation server different from the first aggregation server, wherein the first join key for each impression comprises (i) a first blindly signed combination of the unique identifier for the impression, a destination domain for the digital component for the impression, and a reporting domain for the respective reporting system, and (ii) a blind signature of the first blindly signed combination;

receiving, by the second aggregation server and from each of at least a portion of the multiple client devices, conversion data that includes, for each conversion recorded by the client device, a second key value pair that includes a second join key that is based on a unique identifier for the conversion and (ii) a second value comprising encrypted conversion data that has been encrypted using the first public key and the second public key, wherein the second join key for each conversion comprises (i) a second blindly signed combination of the unique identifier for the conversion and a conversion domain for the digital component and (ii) a blind signature of the second blindly signed combination;

performing, by the first aggregation server and the second aggregation server, a multi-party computation process to decrypt the encrypted impression data and the encrypted conversion data, including:

identifying, based on the first join keys and the second join keys, pairs of encrypted conversion data and corresponding encrypted impression data; and

decrypting the impression data and the conversion data for each pair of encrypted impression data and conversion data in multiple stages using a first private key that corresponds to the first public key and a second private key that corresponds to the second public key, wherein each stage comprises:

one of the first aggregation server or the second aggregation server decrypting one of the encrypted impression data or the encrypted conversion data of each pair of encrypted conversion data and corresponding encrypted impression data and sending resulting data to the other of the first aggregation server or the second aggregation server; and

sending the decrypted impression data and the decrypted conversion data to one or more reporting systems.

2. The method of claim 1 , wherein:

the unique identifier for the impression comprises at least one of (i) an identifier of the client device at which the impression occurred, (ii) an identifier of an application at which the impression occurs, or (iii) an identifier of a user of the client device; and

the unique identifier for the conversion comprises at least one of (i) an identifier of the client device at which the conversion occurred, (ii) an identifier of an application at which the conversion occurred, or (iii) an identifier of a user of the client device.

3. The method of claim 1 , wherein the encrypted impression data for each impression comprises thrice-encrypted impression data generated by:

generating a first encrypted impression result by encrypting at least the impression data using a public key of the respective reporting system to which the decrypted impression data is sent;

generating a second encrypted impression result by encrypting the first encrypted impression result using the first public key; and

generating the thrice-encrypted impression data by encrypting the second encrypted impression result using the second public key.

4. The method of claim 3 , wherein the encrypted conversion data for each conversion comprises thrice-encrypted conversion data generated by:

generating a first encrypted conversion result by encrypting at least the conversion data using a public key of the respective reporting system to which the decrypted conversion data is sent;

generating a second encrypted conversion result by encrypting the first encrypted conversion result using the second public key; and

generating the thrice-encrypted conversion data by encrypting the second encrypted conversion result using the first public key.

5. The method of claim 4 , wherein performing, by the first aggregation server and the second aggregation server, the multi-party computation process to decrypt the encrypted impression data and the encrypted conversion data comprises:

generating, by the first aggregation server and for each first key value pair, a first encrypted join key by encrypting the join key of the first key value pair using a first encryption key of the first aggregation server and commutative encryption;

sending, from the first aggregation server to the second aggregation server and for each first key value pair, a third key value pair that comprises the encrypted join key for the first key value pair and the thrice-encrypted impression data for the first key value pair;

generating, by the second aggregation server and for each second key value pair, a second encrypted join key by encrypting the join key of the second key value pair using a second encryption key of the second aggregation server and communicative encryption; and

sending, from the second aggregation server to the first aggregation server and for each second key value pair, a fourth key value pair that comprises the encrypted join key for the second key value pair and the thrice-encrypted conversion data for the first key value pair.

6. The method of claim 5 , wherein identifying, based on the first join keys and the second join keys, pairs of encrypted conversion data and corresponding encrypted impression data comprises identifying, by the first aggregation server and the second aggregation server as a pair of encrypted conversion data and corresponding encrypted impression data, each first encrypted join key that matches a second encrypted join key.

7. The method of claim 6 , wherein performing, by the first aggregation server and the second aggregation server, the multi-party computation process to decrypt the encrypted impression data and the encrypted conversion data comprises:

each of the first aggregation server and the second aggregation server:

determining, for each occurrence of thrice-encrypted impression data, whether the occurrence of the of thrice-encrypted impression data has at least a threshold number of distinct encrypted join keys; and

in response to determining that a given occurrence of thrice-encrypted impression data does not have at least the threshold number of distinct encrypted join keys, filtering the occurrence of the thrice-encrypted impression data from the key value pairs.

8. The method of claim 6 , wherein performing, by the first aggregation server and the second aggregation server, the multi-party computation process to decrypt the encrypted impression data and the encrypted conversion data comprises:

each of the first aggregation server and the second aggregation server:

determining, for each occurrence of thrice-encrypted conversion data, whether the occurrence of the of thrice-encrypted conversion data has at least a threshold number of distinct encrypted join keys; and

in response to determining that a given occurrence of thrice-encrypted conversion data does not have at least the threshold number of distinct encrypted join keys, filtering the occurrence of the thrice-encrypted conversion data from the key value pairs.

9. The method of claim 6 , wherein performing, by the first aggregation server and the second aggregation server, the multi-party computation process to decrypt the encrypted impression data and the encrypted conversion data comprises:

each of the first aggregation server and the second aggregation server:

determining, for each pair of encrypted conversion data and corresponding encrypted impression data, whether the pair of encrypted conversion data and corresponding encrypted impression data has at least a threshold number of distinct encrypted join keys; and

in response to determining that a given pair of encrypted conversion data and corresponding encrypted impression data does not have at least the threshold number of distinct encrypted join keys, filtering the occurrence of the thrice-encrypted conversion data from the key value pairs.

10. A system, comprising:

a first aggregation server;

a second aggregation server; and

one or more computer-readable storage media storing instructions that, when executed by one or more processors of the first aggregation server and one or more processors of the second aggregation server, cause the first aggregation server and the second aggregation server to perform operations comprising:

receiving, by a first aggregation server and from each of multiple client devices, impression data that includes, for each impression of a digital component recorded by the client device, a first key value pair that includes (i) a first join key that is based on a unique identifier for the impression and (ii) a first value comprising encrypted impression data that has been encrypted using a first public key of the first aggregation server and using a second public key of a second aggregation server different from the first aggregation server, wherein the first join key for each impression comprises (i) a first blindly signed combination of the unique identifier for the impression, a destination domain for the digital component for the impression, and a reporting domain for the respective reporting system, and (ii) a blind signature of the first blindly signed combination;

receiving, by the second aggregation server and from each of at least a portion of the multiple client devices, conversion data that includes, for each conversion recorded by the client device, a second key value pair that includes a second join key that is based on a unique identifier for the conversion and (ii) a second value comprising encrypted conversion data that has been encrypted using the first public key and the second public key, wherein the second join key for each conversion comprises (i) a second blindly signed combination of the unique identifier for the conversion and a conversion domain for the digital component and (ii) a blind signature of the second blindly signed combination;

performing, by the first aggregation server and the second aggregation server, a multi-party computation process to decrypt the encrypted impression data and the encrypted conversion data, including:

identifying, based on the first join keys and the second join keys, pairs of encrypted conversion data and corresponding encrypted impression data; and

decrypting the impression data and the conversion data for each pair of encrypted impression data and conversion data in multiple stages using a first private key that corresponds to the first public key and a second private key that corresponds to the second public key, wherein each stage comprises:

one of the first aggregation server or the second aggregation server decrypting one of the encrypted impression data or the encrypted conversion data of each pair of encrypted conversion data and corresponding encrypted impression data and sending resulting data to the other of the first aggregation server or the second aggregation server; and

sending the decrypted impression data and the decrypted conversion data to one or more reporting systems.

11. The system of claim 10 , wherein:

the unique identifier for the impression comprises at least one of (i) an identifier of the client device at which the impression occurred, (ii) an identifier of an application at which the impression occurs, or (iii) an identifier of a user of the client device; and

the unique identifier for the conversion comprises at least one of (i) an identifier of the client device at which the conversion occurred, (ii) an identifier of an application at which the conversion occurred, or (iii) an identifier of a user of the client device.

12. The system of claim 10 , wherein the encrypted impression data for each impression comprises thrice-encrypted impression data generated by:

generating a first encrypted impression result by encrypting at least the impression data using a public key of the respective reporting system to which the decrypted impression data is sent;

generating a second encrypted impression result by encrypting the first encrypted impression result using the first public key; and

generating the thrice-encrypted impression data by encrypting the second encrypted impression result using the second public key.

13. The system of claim 12 , wherein the encrypted conversion data for each conversion comprises thrice-encrypted conversion data generated by:

generating a first encrypted conversion result by encrypting at least the conversion data using a public key of the respective reporting system to which the decrypted conversion data is sent;

generating a second encrypted conversion result by encrypting the first encrypted conversion result using the second public key; and

generating the thrice-encrypted conversion data by encrypting the second encrypted conversion result using the first public key.

14. The system of claim 13 , wherein performing, by the first aggregation server and the second aggregation server, the multi-party computation process to decrypt the encrypted impression data and the encrypted conversion data comprises:

generating, by the first aggregation server and for each first key value pair, a first encrypted join key by encrypting the join key of the first key value pair using a first encryption key of the first aggregation server and commutative encryption;

sending, from the first aggregation server to the second aggregation server and for each first key value pair, a third key value pair that comprises the encrypted join key for the first key value pair and the thrice-encrypted impression data for the first key value pair;

generating, by the second aggregation server and for each second key value pair, a second encrypted join key by encrypting the join key of the second key value pair using a second encryption key of the second aggregation server and communicative encryption; and

sending, from the second aggregation server to the first aggregation server and for each second key value pair, a fourth key value pair that comprises the encrypted join key for the second key value pair and the thrice-encrypted conversion data for the first key value pair.

15. The system of claim 14 , wherein identifying, based on the first join keys and the second join keys, pairs of encrypted conversion data and corresponding encrypted impression data comprises identifying, by the first aggregation server and the second aggregation server as a pair of encrypted conversion data and corresponding encrypted impression data, each first encrypted join key that matches a second encrypted join key.

16. One or more non-transitory computer-readable media storing instructions that, when executed by one or more computers including a first aggregation server and a second aggregation server, cause the one or more computers to perform operations comprising:

receiving, by a first aggregation server and from each of multiple client devices, impression data that includes, for each impression of a digital component recorded by the client device, a first key value pair that includes (i) a first join key that is based on a unique identifier for the impression and (ii) a first value comprising encrypted impression data that has been encrypted using a first public key of the first aggregation server and using a second public key of a second aggregation server different from the first aggregation server, wherein the first join key for each impression comprises (i) a first blindly signed combination of the unique identifier for the impression, a destination domain for the digital component for the impression, and a reporting domain for the respective reporting system, and (ii) a blind signature of the first blindly signed combination;

receiving, by the second aggregation server and from each of at least a portion of the multiple client devices, conversion data that includes, for each conversion recorded by the client device, a second key value pair that includes a second join key that is based on a unique identifier for the conversion and (ii) a second value comprising encrypted conversion data that has been encrypted using the first public key and the second public key, wherein the second join key for each conversion comprises (i) a second blindly signed combination of the unique identifier for the conversion and a conversion domain for the digital component and (ii) a blind signature of the second blindly signed combination;

performing, by the first aggregation server and the second aggregation server, a multi-party computation process to decrypt the encrypted impression data and the encrypted conversion data, including:

identifying, based on the first join keys and the second join keys, pairs of encrypted conversion data and corresponding encrypted impression data; and

decrypting the impression data and the conversion data for each pair of encrypted impression data and conversion data in multiple stages using a first private key that corresponds to the first public key and a second private key that corresponds to the second public key, wherein each stage comprises:

one of the first aggregation server or the second aggregation server decrypting one of the encrypted impression data or the encrypted conversion data of each pair of encrypted conversion data and corresponding encrypted impression data and sending resulting data to the other of the first aggregation server or the second aggregation server; and

sending the decrypted impression data and the decrypted conversion data to one or more reporting systems.