## 5 System Analysis
### Existence of Solutions and Optimal Solution Problems  
The ideal privacy protection scheme is to maximize the privacy protection level, minimize system overhead, and balance the privacy protection and overhead in specific scenarios. This section will prove the feasibility of the scheme by proofing the existence of the solution of the multi-objective optimization problem and solve the equilibrium problem of privacy protection level and system overhead balance. In this paper, the security goal is to achieve privacy protection level \(<L_{(k,s)},Q_{l}>\). We use the probability of organization information being identified \(p_{A}\) to measure \(L_{(k,s)}\) and use the probability of query content being identified \(p_{S}\) to measure \(Q_{l}\). The smaller \(p_{A}\) and \(p_{S}\) are, the higher the privacy protection level is. To achieve the expected security goal, we select \(k\) dummy locations from \(G_{sub}\) and make \(k\) dummy locations be located in \(s\) second-level grids (i.e., organizations). \(G_{sub}\) is related to \(|U_{j}^{sub}|\) (the number of locations in \(U_{j}^{sub}\)) and \(s\). The larger \(|U_{j}^{sub}|\) and \(s\) are, the larger the \(G_{sub}\) is, and the larger the corresponding communication overhead and storage overhead are. The equilibrium problem of privacy protection level and system overhead can be described as minimizing \(p_{A}\), \(p_{S}\), and \(G_{sub}\). The objective functions of the above problem are denoted as \(min\{p_{A}(k,s)\}\), \(min\{p_{S}(k,s)\}\), and \(min\{c(s,G_{sub})\cdot c(s,G_{sub})\}\) signifies the system overhead. Here, we consider the storage overhead andcommunication overhead related to \(G_{sub}\) for the following two reasons. On the one hand, compared with other methods, the increase in the cost of our method chiefly comes from the increase of \(G_{sub}\). The cost of other data involved in the service process is much smaller than \(G_{sub}\). On the other hand, \(G_{sub}\) mostly affects the computational cost of selecting \(s\) organizations. Once \(s\) organizations are determined, the computational cost of selecting \(k\) dummy locations is basically unchanged. Constraints are described as follows. \(\frac{k}{s}\) locations for each organization correspond to \(\frac{k}{s}\) query content, each query content corresponds to a different service category, and \(\frac{k}{s}\) is no greater than \(M\) (in this paper, we set \(M=21\) (see Section 6), \(s\geq 2\); here, let \(\frac{k}{s}\leq M\) be reasonable; otherwise, it will cause \(k\) to be too large, which will greatly increase the system overhead). There is at least one solution that can make the \(\frac{k}{s}\) query content corresponding to \(\frac{k}{s}\) locations in each organization different, and the number of times each query category selected after \(n\) times queries equal. We use \(x_{ij}^{z}\) to indicate whether the category corresponding to the \(j\)th location in the \(i\)th organization in the \(z\)th time query is \(C_{j}\). If \(x_{ij}^{z}=1\), it indicates that \(C_{j}\) is selected; otherwise, \(x_{ij}^{z}=0\) indicates that \(C_{j}\) is not selected. The constraints are expressed as follows. \[\left\{ \begin{array}{l}\sum_{j=1}^{M}x_{ij}^{(z)}=\lceil\frac{k}{s}\rceil- \eta_{i}\\ \sum_{i=1}^{s}x_{ij}^{(z)}=\lceil\frac{k}{M}\rceil-\mu_{j}\\ \sum_{i=1}^{s}(\lceil\frac{k}{s}\rceil-\eta_{i})=\sum_{j=1}^{M}(\lceil\frac{k }{M}\rceil-\mu_{j})=k\\ \sum_{z=1}^{n}\sum_{j=1}^{M}x_{ij}^{(z)}-\sum_{z=1}^{n}\sum_{j=1}^{M}x_{i^{ \prime}j}^{(z)}=0\\ \eta_{i^{\prime}}\mu_{j}\in\{0,1\}\\ i,i^{{}^{\prime}}=1,2,\cdots,s,and\ i\
eq i^{{}^{\prime}};j=1,2,\cdots,M;2\leq s \leq k;z=1,2,\cdots,n\end{array} \right.