Abstract Ad exchanges are kind of the most popular online advertising marketplaces for trading ad spaces over the Internet. Ad exchanges run auctions to sell diverse ad spaces on the publishers’ web-pages to advertisers, who want to display ads on ad spaces. However, the parties in an ad auction cannot verify whether the auction is carried out correctly or not. Furthermore, the advertisers are usually unwilling to reveal their sensitive bids and identities. In this paper, we jointly consider the auction verifiability and the advertisers’ privacy preservation, and thus propose ERA, which is an E fficient, p R ivacy-preserving, and verifi A ble online auction mechanism for ad exchanges. ERA exploits an order preserving encryption scheme to guarantee privacy preservation, and achieves verifiability by constructing a novel protocol of privacy preserving integer comparison, which is built on the Paillier homomorphic encryption scheme. We extensively evaluate the performance of ERA, and our evaluation results show that ERA satisfies several desirable properties with low computation, communication, and storage overheads, so ERA can be easily deployed in today's ad exchanges.
Although the sealed second-price or Vickrey auctions have some nice theoretical properties, they are fairly seldom utilized in practice. It has been suggested that they are vulnerable to bid-taker cheating and that the revelation of bids after the bidding makes the bidders reluctant to reveal their true valuations. We outline procedures based on modern mathematical cryptography that are instrumental in avoiding some of these difficulties and thereby will improve the properties of the Vickrey auctions. We present the design and implementation of a distributed service for performing sealed bid auctions. This service provides an interface by which clients, or "bidders", can issue secret bids to the service for an advertised auction. Once the bidding period has ended, the auction service opens the bids, determines the winning bid, and provides the winning bidder with a ticket for claiming the item bid upon. Using novel cryptographic techniques, the service is constructed to provide strong protection for both the auction house and correct bidders, despite the malicious behavior of any number of bidders and fewer than one third of the servers comprising the auction service. Specifically, it is guaranteed that: bids of correct bidders are not revealed until after the bidding period has ended; the auction house collects payment for the winning bid; losing bidders forfeit no money; and only the winning bidder can collect the item bid upon. We also discuss techniques to enable anonymous bidding.