Cryptographically secure data protection
This disclosure relates to data security and cryptography. In one aspect, a method includes receiving a request for a subscription token for a given user by a data security system from a publisher computing system of a publisher. The request includes user identification information provided to the publisher by the given user when subscribing to electronic content of the publisher. The data security system generates the subscription token which includes a set of data that includes a first encrypted user identifier generated by encrypting a first user identifier for the given user using an encryption key of the data security system, and, for each of one or more content platforms, an attachment element that includes a second encrypted user identifier generated by encrypting a second user identifier for the given user using an encryption key of the content platform and transmitting the subscription token to the publisher computing system.
1 . A computer-implemented method comprising:
receiving, from a client device, a request for content and subscription data comprising at least an e-mail address for a user of the client device, a phone number for the user, or both;
sending, to a data security system, a request for a subscription token for the user and a given publisher in response to receiving the subscription data, wherein the subscription token comprises (i) a set of data comprising a first encrypted user identifier that encrypts a first user identifier for the user with an encryption key of the data security system, wherein the first user identifier is used by the data security system to identify the user, and (ii) for each of one or more content platforms, a respective second encrypted user identifier that encrypts a second user identifier for the user with a respective encryption key of the respective content platform, wherein the second user identifier is used by the respective content platform to identify the user;
receiving, from the data security system, the subscription token for the user and the given publisher; and
causing the subscription token to be transmitted to the one or more content platforms that provide, to the client device, one or more digital components for presentation at the client device with content of the given publisher based on the subscription token.
2 . The computer-implemented method of claim 1 , wherein the data security system comprises a computing system of an e-mail provider and the subscription data comprises the e-mail address for the user and for an e-mail account of the user with the e-mail provider.
3 . The computer-implemented method of claim 2 , wherein the first user identifier for the user comprises one of (i) the e-mail address for the user for the e-mail account of the user with the e-mail provider or (ii) another user identifier corresponding to the e-mail address of the user.
4 . The computer-implemented method of claim 1 , wherein the subscription token further comprises: for each of the one or more content platform, a digital signature of the set of data and the second encrypted user identifier generated using a private key of the data security system.
5 . The computer-implemented method of claim 2 , wherein the subscription token comprises a digital signature of the set of data and each attachment element.
6 . The computer-implemented method of claim 1 , wherein the subscription token comprises an expiration time and consent data indicating how user data of the user data can be used by a recipient the given publisher.
7 . The computer-implemented method of claim 1 , further comprising:
sending, to the data security system, recurring renewal requests that are each for a renewed subscription token for the user, each renewal request comprising a respective first encrypted user identifier of a previous request; and
receiving, for each renewal request, the renewed subscription token to the given publisher computing system.
8 . The computer-implemented method of claim 7 , wherein the data security system is configured to, for renewal request, perform operations comprising:
generating an updated first encrypted user identifier different from the first encrypted user identifier of the previous request;
generating the renewed subscription token comprising an updated set of data comprising the updated first encrypted user identifier and each attachment element; and
transmitting the renewed subscription token to the given publisher computing system.
9 . The computer-implemented method of claim 7 , wherein each renewed subscription token further comprises updated data privacy settings that have been updated by the user since the subscription token was generated.
10 . The computer-implemented method of claim 1 , wherein causing the subscription token to be transmitted to the one or more content platforms comprises sending the subscription token to the client device for inclusion in a digital component request sent to each of the one or more content platforms.
11 . The computer-implemented method of claim 10 , wherein the client device is configured to generate the request in response to processing a script of a digital component slot of a resource being presented by the client device, and wherein the script is configured to obtain the subscription token from a device of the given publisher.
12 . The computer-implemented method of claim 1 , wherein the data security system is configured to generate the subscription token for the user and the given publisher by identifying, as the one or more content platforms, each content platform designated as being an eligible content platform by the given publisher and the user, each eligible content platform being a content platform that is eligible to select digital components for presentation to the user with electronic resources of the given publisher.
13 . The computer-implemented method of claim 1 , wherein the data security system is configured to generate the subscription token for the user and the given publisher by identifying, as the one or more content platforms, each content platform designated as being an eligible content platform by the given publisher and the user, each eligible content platform being a content platform that is eligible to collect, store, and use data of the user.
14 . The computer-implemented method of claim 1 , further comprising querying a central authority for data indicating whether an e-mail provider of the e-mail address for the user is a participant in a subscription token service.
15 . A non-transitory computer-storage medium storing instructions that when executed by one or more processors cause the one or more processors to perform operations comprising:
receiving, from a client device, a request for content and subscription data comprising at least an e-mail address for a user of the client device, a phone number for the user, or both;
sending, to a data security system, a request for a subscription token for the user and a given publisher in response to receiving the subscription data, wherein the subscription token comprises (i) a set of data comprising a first encrypted user identifier that encrypts a first user identifier for the user with an encryption key of the data security system, wherein the first user identifier is used by the data security system to identify the user, and (ii) for each of one or more content platforms, a respective second encrypted user identifier that encrypts a second user identifier for the user with a respective encryption key of the respective content platform, wherein the second user identifier is used by the respective content platform to identify the user;
receiving, from the data security system, the subscription token for the user and the given publisher; and
causing the subscription token to be transmitted to the one or more content platforms that provide, to the client device, one or more digital components for presentation at the client device with content of the given publisher based on the subscription token.
16 . A system comprising:
one or more processors; and
one or more storage devices including instructions that, when executed, cause the one or more processors to perform operations comprising:
receiving, from a client device, a request for content and subscription data comprising at least an e-mail address for a user of the client device, a phone number for the user, or both;
sending, to a data security system, a request for a subscription token for the user and a given publisher in response to receiving the subscription data, wherein the subscription token comprises (i) a set of data comprising a first encrypted user identifier that encrypts a first user identifier for the user with an encryption key of the data security system, wherein the first user identifier is used by the data security system to identify the user, and (ii) for each of one or more content platforms, a respective second encrypted user identifier that encrypts a second user identifier for the user with a respective encryption key of the respective content platform, wherein the second user identifier is used by the respective content platform to identify the user;
receiving, from the data security system, the subscription token for the user and the given publisher; and
causing the subscription token to be transmitted to the one or more content platforms that provide, to the client device, one or more digital components for presentation at the client device with content of the given publisher based on the subscription token.
17 . The system of claim 16 , wherein the data security system comprises a computing system of an e-mail provider and the subscription data comprises the e-mail address for the user and for an e-mail account of the user with the e-mail provider.
18 . The system of claim 17 , wherein the first user identifier for the user comprises one of (i) the e-mail address for the user for the e-mail account of the user with the e-mail provider or (ii) another user identifier corresponding to the e-mail address of the user.