## 3 Preliminary
### Motivation and Basic Idea  
To protect users' privacy in the scenario of this paper, an effective approach is to add dummies. Considering the scenario of this paper, we assume a user sends \(m\) queries in a continuous query. Using dummy techniques, there will be \(m\times(k-1)\) selected dummy locations (some dummy locations are the same) and \(m\) real locations. Assume there are \(c\) kinds of locations among the \(m\times k\) locations and \(n_{i}\) is the number of \(i\)th kinds of location. Then there are the following relationships. From the perspective of adversaries, the probability \(p_{i}\) that the \(i\)th kind of location is estimated as the real location is as follows:  
\[p_{i}=\frac{n_{i}}{m\times k} \tag{1}\]  
In particular, for the real location \(r\) (assume \(r\) is the \(j\)th kind of location), the probability \(p_{j}\) that it is estimated as the real location is as Equation (2). \[p_{i}=\frac{m}{m\times k} \tag{2}\]  
Considering the I2 LC, we assume each dummy location appears once in \(m\) queries since only the real location \(r\) appears in each query. That is, for each kind of dummy location, \(n_{i}\). Then we get:  
\[\left\{ \begin{array}{ll}\lim_{m\rightarrow+\infty}\frac{n_{i}}{m\times k}=0 (i\
eq j)\\ \lim_{m\rightarrow+\infty}\frac{n_{i}}{m\times k}=\frac{1}{k}(i=j)\end{array} \right. \tag{3}\]  
That is, when the user sends an unlimited number of queries, the probability that the real location is estimated as the real location is far larger than the dummy location. This means that the real location can be easily distinguished. Hence, if a user uses dummy techniques for privacy protection, the attacker can infer her real identity by launching the I2 LC. As shown in Figure 1, in the scenario of this paper, the attacker could infer that a user who appears most frequently may be the real user by intersecting users in different anonymous groups. In addition, a basic assumption commonly used in existing methods is that all locations are geographic coordinates. For example, we assume user [PERSON] locates in the location \(L_{i}=(t_{i},lo_{i},la_{i})\), where \(t_{i}\), \(lo_{i}\) and \(la_{i}\) are the time, longitude, and latitude, respectively. That is, the attacker cannot obtain [PERSON]'s location privacy if he cannot infer that [PERSON] locates in \(L_{i}\). However, existing methodsignore the HSA. In this paper, we divide the HSA into six levels based on common administrative division and use \(Le_{i}\), \(i=0,1,\cdots,5\) to denote its level, where \(Le_{4}\) corresponds to the organization name and \(Le_{5}\) represents a location, as shown in Figure 2. If we do not consider the HSA, we may select \(k-1\) dummies that locate in the same organization as the real location. In particular, in the methods that have the TTP-free method and collaboratively achieve anonymity through P2P network, the \(k\) users are close to each other and easily belong to the same organizations, which reveals the privacy of users' organizations. Assume that the attacker obtains \(k\) locations, which are distributed across \(s(k\geq s)\) different organizations and are from one of \(m\) queries in a continuous query. Then the probability \(p_{o}\) that the attacker can distinguish the user's real organization is as follows:  
\[p_{o}=\frac{1}{s} \tag{4}\]  
If the \(k\) users (\(k\) locations) are close enough that they are almost in the same organization, \(s\) will be close to 1. Then we get:  
\[\lim_{s\to 1}\frac{1}{s}=1 \tag{5}\]  
That is to say, if we select \(k-1\) dummies that locate in the same organization as the real location, the attacker can easily distinguish the user's real organization. In fact, the attacker can easily infer that different anonymous groups locate in the same organization. As shown in Figure 3. In Figure 3, the rectangle represents an area containing four organizations: \(R_{1}\), \(R_{2}\), \(R_{3}\), and \(R_{4}\). Different red circles represent different anonymous groups: \(A_{1}\), \(A_{2}\), and \(A_{3}\).