Verifiable Auctions for Online Ad Exchanges Sebastian Angel and - PowerPoint PPT Presentation

Verifiable Auctions for Online Ad Exchanges Sebastian Angel and Michael Walfish The University of Texas at Austin Tuesday, August 13, 13

Ad Exchanges allow real time selling and buying of ad space How did this ad get here? Tuesday, August 13, 13

Ad Exchanges allow real time selling and buying of ad space How did this ad get here? Tuesday, August 13, 13

Ad unit 5 300x250 Tuesday, August 13, 13

Ad unit 5 Publisher 300x250 Tuesday, August 13, 13

Ad Exchange Publisher 20-30 year old, male, Texas resident Tuesday, August 13, 13

20-30 year old, male, Texas resident telegraph.co.uk, ad unit 5, 300x250 Advertisers Ad Exchange Tuesday, August 13, 13

20-30 year old, male, Texas resident telegraph.co.uk, ad unit 5, 300x250 hange Tuesday, August 13, 13

$10 $5 Ad Exchange resident $20 Tuesday, August 13, 13

Second-price auction Winner = highest bidder Price = second-highest bid $10 $5 Ad Exchange resident $20 Winner Tuesday, August 13, 13

$10 Ad Exchange Publisher Tuesday, August 13, 13

Ad Spot 5 300x250 Publisher Tuesday, August 13, 13

Today’s ecosystem is unnecessarily predicated on trusting ad exchanges, disenfranchising advertisers and publishers. Our goal is to remove that trust ... ... by making auctions verifiable. Tuesday, August 13, 13

Respecting today’s ecosystem is technically challenging • Need to support millions of auctions per second • Need to add little latency to Web page loads • Cannot disclose submitted bids • Cannot require participants to know each other • Cannot introduce trusted third parties (DNS is okay) Tuesday, August 13, 13

More motivation Verifiability in ad exchanges would: • Deter potential misbehavior • Strengthen the service provided by ad exchanges • Democratize the auctioneer function Tuesday, August 13, 13

1. What are some issues with ad exchanges? 2. How do we provide verifiability? 3. What is the cost of verifiability? Tuesday, August 13, 13

The status quo has several weaknesses $10 $10 $5 Ad Exchange Publisher $20 Tuesday, August 13, 13

The status quo has several weaknesses $10 $19 $5 Ad Exchange Publisher $20 Tuesday, August 13, 13

The status quo has several weaknesses $10 $7 $5 Paul Salvatore A. Testoni Smith PS Ferragamo Washed Paul Ad Exchange Scozia... Calf ... Smith... Publisher $20 Tuesday, August 13, 13

The status quo has several weaknesses $10 $6 $5 Ad Exchange Publisher $20 Receives $10 from Advertiser but reports only $6 Tuesday, August 13, 13

Issues not addressed in this talk • Publisher may not deliver ads to end users • An ad exchange may refuse to run auctions Tuesday, August 13, 13

1. What are some issues with ad exchanges? 2. How do we provide verifiability? 3. What is the cost of verifiability? Tuesday, August 13, 13

Notable aspects of VEX’s design } Auction • It contains two phases Audit (offline) Tuesday, August 13, 13

Status Quo ADX Bid Auction Outcome Tuesday, August 13, 13

Status Quo VEX ADX ADX Bid Encoded Bid List of Encoded Bids Auction Bid Outcome Auction Outcome Tuesday, August 13, 13

Status Quo VEX ADX ADX Bid Encoded Bid List of Encoded Bids Auction Bid Outcome Auction Outcome V ADX Verify auction Tuesday, August 13, 13

Status Quo VEX ADX ADX Bid Encoded Bid List of Encoded Bids Auction Bid Outcome Auction Outcome 3rd Party V ADX Verify auction Tuesday, August 13, 13

Notable aspects of VEX’s design } Auction • It contains two phases Audit Audit (offline) • It introduces a technique for order comparisons against hidden integers Tuesday, August 13, 13

Notable aspects of VEX’s design } Auction • It contains two phases Audit Audit (offline) • It introduces a technique for order comparisons against hidden integers • It requires some engineering Tuesday, August 13, 13

Notable aspects of VEX’s design } Auction • It contains two phases Audit Audit (offline) • It introduces a technique for order comparisons against hidden integers • It requires some engineering Tuesday, August 13, 13

ADX Request Request } Encoded Bid generation 〈 b i 〉 } 〈 b 1 〉 , ..., 〈 b N 〉 〈 b 1 〉 , ..., 〈 b N 〉 Sharing of encodings } b i Disclosure of encoding information } Auction computation Outcome Outcome Proofs Is the outcome correct? Tuesday, August 13, 13

ADX Request Request } Encoded Bid generation 〈 b i 〉 Details in paper } 〈 b 1 〉 , ..., 〈 b N 〉 〈 b 1 〉 , ..., 〈 b N 〉 Sharing of Encoded Bids } b i Disclosure of encoding information } (1) Ensure that the same set of encoded bids is received by all Auction computation participants Outcome Outcome (2) Ensure that the set of encoded bids includes all advertisers’ submissions Proofs Is the outcome correct? Tuesday, August 13, 13

ADX Request Request } Encoded Bid generation 〈 b i 〉 } 〈 b 1 〉 , ..., 〈 b N 〉 〈 b 1 〉 , ..., 〈 b N 〉 Sharing of Encoded Bids } b i Disclosure } Auction computation Outcome Outcome Proofs Is the outcome correct? Tuesday, August 13, 13

ADX Request Request } Encoded Bid generation 〈 b i 〉 } 〈 b 1 〉 , ..., 〈 b N 〉 〈 b 1 〉 , ..., 〈 b N 〉 Sharing of Encoded Bids } b i Disclosure } Auction computation Outcome Outcome ADX V } Proofs please Proof generation } Auction verification Proofs Tuesday, August 13, 13

Outcome Outcome ADX V } Proofs please Proof generation } Auction verification Proofs Tuesday, August 13, 13

V ADX Structure of a correct Verify auction second-price auction Inputs: Bids = {b 1 , ..., b N } b w = highest bid p = second-highest bid Output: winner w, price p Correctness 1. There exists a bid b i == p 2. There are N-2 bids ≤ p 3. There exists a bid b w ≥ p Tuesday, August 13, 13

V ADX Structure of a correct Verify auction second-price auction Inputs: Bids = {b 1 , ..., b N } b w = highest bid p = second-highest bid Output: winner w, price p Correctness How can the verifier check 1. There exists a bid b i == p that the correctness 2. There are N-2 bids ≤ p conditions are satisfied? 3. There exists a bid b w ≥ p Tuesday, August 13, 13

ADX Request Request } Encoded Bid generation 〈 b i 〉 } 〈 b 1 〉 , ..., 〈 b N 〉 〈 b 1 〉 , ..., 〈 b N 〉 Sharing of Encoded Bids } b i Disclosure } Auction computation Outcome Outcome ADX V } Proofs please Proof generation } Auction verification Proofs Tuesday, August 13, 13

A bid encoding is the last node of a hash chain, } Request where the length of the Encoded Bid generation 〈 b i 〉 chain is related to the bid Notation: H is a cryptographic hash function inputs: bid = 4, seed = {0,1} n Encoded bid 〈 bid 〉 = H bid+1 (seed) = H 5 (seed) = H(H(H(H(H(seed))))) Tuesday, August 13, 13

A bid encoding is the last node of a hash chain, } Request where the length of the Encoded Bid generation 〈 b i 〉 chain is related to the bid Notation: H is a cryptographic hash function inputs: bid = 4, seed = {0,1} n Encoded bid 〈 bid 〉 = H bid+1 (seed) = H 5 (seed) = H(H(H(H(H(seed))))) Nodes origin H H H H H seed 〈 4 〉 Given 〈 bid 〉 , it is hard to determine # nodes (i.e., the bid + 1) Tuesday, August 13, 13

A bid encoding is the last node of a hash chain, } Request where the length of the Encoded Bid generation 〈 b i 〉 chain is related to the bid Notation: H is a cryptographic hash function inputs: bid = 4, seed = {0,1} n How can the party generating this encoded bid prove that the secret bid is ≥ some integer? Encoded bid 〈 bid 〉 = H bid (seed) = H 5 (seed) = H(H(H(H(H(seed))))) Nodes origin H H H H H seed 〈 4 〉 Given 〈 bid 〉 , it is hard to determine # nodes (i.e., the bid + 1) Tuesday, August 13, 13

A bid encoding is the last node of a hash chain, } Request where the length of the Encoded Bid generation 〈 b i 〉 chain is related to the bid Notation: H is a cryptographic hash function inputs: bid = 4, seed = {0,1} n How can the party generating this encoded bid prove that the secret bid is ≥ some integer? Encoded bid 〈 bid 〉 = H bid (seed) = H 5 (seed) = H(H(H(H(H(seed))))) By providing an earlier node in the chain as proof Nodes origin H H H H H seed 〈 4 〉 Given 〈 bid 〉 , it is hard to determine # nodes (i.e., the bid + 1) Tuesday, August 13, 13

A bid encoding is the last node of a hash chain, } Request where the length of the Encoded Bid generation 〈 b i 〉 chain is related to the bid Notation: H is a cryptographic hash function inputs: bid = 4, seed = {0,1} n Encoded bid 〈 bid 〉 = H bid+1 (seed) = H 5 (seed) = H(H(H(H(H(seed))))) Nodes origin H H H H H seed 〈 4 〉 Given 〈 bid 〉 , it is hard to determine # nodes (i.e., the bid + 1) Tuesday, August 13, 13

How to prove equality (==)? How to prove less-than-or-equal-to ( ≤ )? Tuesday, August 13, 13

How to prove equality (==)? • Can be proven if the seed is distinguishable from a node in the chain How to prove less-than-or-equal-to ( ≤ )? Tuesday, August 13, 13