# A Search Efficient Privacy-Preserving Location-Sharing Scheme in Mobile Online Social Networks
## 6 Discussion
### Security Analysis  
In our security model, \(B\) is a trusted entity while \(SNS\) and \(LS\) are \"honest-but-curious\". In addition, \(SNS\) and \(LS\) are assumed not to be able to collude with each other to obtain users' sensitive information. Thus, our scheme mainly focuses on the proposed security goals. Access control. There are two kinds of access control policies in our scheme. One is users' defined threshold distance access control, and the other is users' defined grid cell access control. Since \(SNS\) and \(LS\) are assumed to be \"honest-but-curious\", that is, the access control policies will be implemented honestly. Thus, users' defined access control policies can be achieved. Identity privacy. The identity privacy of users does not need to be considered on \(SNS\) since \(SNS\) has users' identity information. Therefore, we only need to analyze whether \(LS\) can obtain a user's real identity or not. In the location update process, all the users' pseudo-IDs are uploaded to \(LS\) and each user's real identity has been anonymized by a pseudo-ID set (i.e., \(PID_{list}\)). Thus, the probability of getting a user's real identity is \(\frac{1}{nk}\), where \(n\) is the total number of users and \(k\) is the number of pseudo-IDs for each user. In the location query process, suppose that the number of pseudo-IDs that are sent to \(LS\)is \(w\), the probability of identifying a user's real identity is \(\frac{1}{w}\). Since \(n\) and \(w\) are usually a very large number, it is impossible for \(LS\) to get the real identity of a user. In addition, when a user performs the location update, the pseudo-ID which represents the user's real identity randomly changes with the index \(ind\). Therefore, \(LS\) can not get users' real identities. Sensitive area privacy. Unlike the previous studies that do not consider the disclosure of privacy among friends (i.e., a curious user may infer the privacy information of his/her friends such as workplace by querying friends' locations), and different from the access control policy proposed in paper [10] which directly shuts up the location-sharing service for friends, our scheme focuses on the privacy-preserving requirements for sensitive areas. In our scheme, users are assumed to be curious and want to infer other users' privacy by requesting location-sharing services, such as home address and workplace. Suppose that there is a user \(U\) who does not want to share some specific geofences or locations with his/her friends in location-sharing systems. In the location update process, if \(U\)'s current location or geofence is a sensitive area, then \(U\) can use the grid cell access control policy proposed in our scheme to set the current grid cell as inaccessible. In this way, \(U\)'s friends can not get location information of \(U\)'s sensitive area by their location-sharing services. Therefore, \(U\)'s privacy-preserving requirements of sensitive areas can be satisfied. Location privacy. In our scheme, both \(LS\) and \(SNS\) are assumed to be curious and want to obtain users' locations. Thus, we need to analyze whether \(LS\) and \(SNS\) can get a user's real location. From the perspective of \(LS\), the probability of identifying a user's location is the same as that of getting the user's identity in the location update process, because each user's pseudo-ID is associated with a corresponding location. In the location query process, \(LS\) can not still distinguish a users' real location since \(LS\) can not get each user's real identity which randomly changes with the index \(ind\). Therefore, \(LS\) can not get users' locations. From the perspective of \(SNS\), the coordinates replied from \(LS\) are protected by symmetric encryption scheme (i.e., \(SecK_{B\&L}\)) in the location query process, so \(SNS\) has no chance to get the users' locations unless \(SNS\) can decrypt the encrypted coordinates. In the location update process, \(SNS\) can get the fake-IDs of base stations.