## 3 Preliminary
### Privacy Protection Model  
To implement the above basic idea, the adding dummy method in our paper needs to meet two conditions. (1) The LBS server also needs to store a historical location dataset. It can guarantee that each location evenly appears in a continuous query and \(k\) dummy locations cannot locate in the same organization by controlling the user's participation; (2) the LBS server also needs to provide a service category set. This can guarantee that the probability of occurrence of each query category is the same in all queries.  
Considering the above conditions, for the LBS system, it needs to provide \(M\) different service categories, e.g., restaurant and hospital. Let these service categories be \(C=\{C_{1},C_{2},\cdots,C_{M}\}\); this is called a basic service set. In addition, the LBS server also needs to store a historical location dataset \(G\), used by users to generate dummy locations. The area that historical locations in \(G\) are located in is divided into \(N\) different first-level grids. So, we denote \(G\) as \(G=\bigcup_{i=1}^{N}R_{i}\), where \(R_{i}\) denotes the \(i\)th first-level grid. For \(R_{i}\), it is further divided into \(U_{i}\) different second-level grids (organizations). Therefore, we denote \(R_{i}\) as \(R_{i}=\bigcup_{j=1}^{U_{i}}U_{ij}=\{L|L\in U_{l1},L\in U_{l2},\cdots,or\ L\in U _{i|U_{i}}\}\), where \(U_{ij}\) denotes the \(j\)th second-level grid in \(R_{i}\) and \(L\) is a location in \(U_{ij}\). To protect users' privacy, when a user sends the \(i\)th query in location \(L_{0}\) to the LBS server, the user needs to submit a query request \(\mathit{Req}^{(i)}=((L_{1}^{(i)},C_{1}^{(i)}),(L_{2}^{(i)},C_{2}^{(i)}), \cdots,(L_{k}^{(i)},C_{k}^{(i)}))\), \(L_{j}^{(i)}\in G,C_{j}^{(i)}\in C,i=1,2,\cdots,n,j=1,2,\cdots,k\). After receiving the query request, the LBS server calculates and generates a response message \(\mathit{Res}^{(i)}=((L_{1}^{(i)},S_{1}^{(i)}),(L_{2}^{(i)},S_{2}^{(i)}),\cdots, (L_{k}^{(i)},S_{k}^{(i)}))\). Then, to implement the basic idea, the \(\mathit{Req}^{(i)}\) and \(\mathit{Res}^{(i)}\) in a continuous query should be bounded. To address this issue, we define the privacy protection model as \(<L_{(k,s)},Q_{l}>\), called the 'degree of privacy protection', as follows:  
**Definition 1**.: _In a continuous query, if the \(<L_{(k,s)},Q_{l}>\) can protect a user's location privacy, organization information, and query privacy, the \(\mathit{Req}^{(i)}\) and \(\mathit{Res}^{(i)}\) must satisfy the following conditions:_  
1. \(\forall p,q,p\
eq q,L_{p}^{(i)}\
eq L_{q}^{(i)},p,q\in[1,k],i=1,2,\cdots,n\)_;_
2. _The locations_ \(L_{1}^{(i)},L_{2}^{(i)},\cdots,L_{1}^{(k)}\) _are located in_ \(s\) _different second-level grids;_
3. _The locations in_ \(\mathit{Req}^{(i)}\) _contain at least_ \(l(l\leq M)\) _different service categories. If a user sends_ \(n\) _times queries in location_ \(L_{0}\)_, the number of times each service category selected in_ \(C\) _is approximately equal. That is, the probability of each service category selected in_ \(C\) _is equal._  
The privacy protection model means that, if a user needs to protect her location, organization information, and query content, she must send \(k\) different locations to the LBS server in each query request, which these locations locate in \(s\) different second-level grids and the \(k\) query content contained in these locations contains at least \(l(l\leq M)\) different service categories. The first two conditions ensure  
Figure 4: Two levels of hierarchical structure grid.  
that the \(k\) locations \(\mathit{Req}^{(i)}\) are different from each other and located in \(s\) different second-level grids. It is necessary to select \(k\) dummies from \(s\) different grids in a query request. Condition (3) guarantees that the \(k\) query contents in \(\mathit{Req}^{(i)}\) are not exactly the same. It is necessary to protect the query content. So, \(<L_{(k,s)},Q_{l}>\) can protect a user's location privacy, organization information, and query privacy.