## 3 Preliminary
### Motivation and Basic Idea
In the example, although users are different in \(A_{1}\) and \(A_{3}\), the attacker can easily infer that the users in \(A_{1}\) and \(A_{3}\) are in the same organization. It is more serious in densely populated and larger organizations. According to actual need, this paper only considers location privacy protection of \(Le_{4}\) and \(Le_{5}\) levels. The above formulas reveal the mechanism by which the attacker obtains users' privacy by using the I2 LC and the HSA. (1) When the frequency with which each location appears in a continuous query is different, location privacy leakage occurs; (2) users (locations) in an anonymous group are concentrated in the same organization. Hence, the basic idea of our scheme is that each location evenly appears in a continuous query and locations in an anonymous group are distributed across two or more different organizations. In addition, we use the \(l\)-diversity to protect the query content. That is,  
Figure 2: Hierarchical structure of the address. for all queries in a continuous query, the probability of occurrence of each query category is the same in multiple queries. This means that the probability that the user's query content is recognized is also the same. To implement our basic idea, we consider two main \(k\)-anonymity methods: Cloaking and adding dummy. The cloaking method submits a cloaking area containing \(k\) users to the LBS server. (The user's real location is also in the cloaking area.) However, it is difficult to guarantee the basic idea. The reason is that users do not store the information of users who had participated in anonymity. Therefore, it is difficult to determine whether a user appears too frequently in a continuous query. For example, in the cloaking method, a user is randomly selected to participate in anonymity, resulting in the inability to control the user's participation. Another reason is that users cannot know the area of all organizations. For example, in cloaking, randomly selecting users to participate in anonymity causes users' locations to be randomly distributed across different organizations. In this paper, adding dummy is an ideal solution because it is not constrained by the real user's locations, and the dummy locations can be generated flexibly according to some conditions. While some methods, such as randomly generating dummies, selecting dummies from historical queries or historical data, to a certain extent, can guarantee that users in an anonymous group are distributed across specified organizations, there is no guarantee that all users are not in the same organization. In this paper, we use the adding dummy to realize the protection of the user's location, organization information, and query privacy in the scenario of this paper. All dummy locations and query content are selected from historical locations and the basic service set. We first divide a city area where users locate into different grids with the two-level structure and different grids represent different organizations, as shown in Figure 4. Each historical location is located in a grid. Then, we can select \(k\) dummy locations from \(s\) different grids evenly. That is, we can ensure that the \(k\) locations are different from each other in each query and distributed in \(s\) different organizations. This protects users' privacy at the organization level. In particular, the LBS provider can identify the real user by comparing historical locations (the real user's location is different from the historical locations), since he has all historical locations. Therefore, we consider replacing the real user's location with the historical locations that are in the same organization as the real user's location. This ensures that the locations in each query are different. In addition, for the query content, our idea is to ensure that the probability of occurrence of each query category is the same in all queries. This means that the probability that the user's query content is recognized is also the same. Figure 3: An example of users’ organization information leakage.