## 1 Introduction
Results show that our scheme can reach an equilibrium between privacy protection level and system overhead and can better protect users' location privacy, organization information, and query privacy than the scheme in [13; 27]. The DGS-HSA can protect users' organization information and query privacy. Compared with [13; 27], the DGS-HSA considers the HSA and divides a city area where users locate into different grids with the two-level structure. Based on it, for each query in a continuous query, the DGS-HSA selects \(k\) dummy locations distributing across \(s\) different organizations and \(k\) query content in  
Figure 1: The same user’s continuous query request privacy in the same location. a continuous query that has at least \(l\) query categories. That is, attackers cannot distinguish the user's real organization and real query content. Compared with [13; 27], the DGS-HSA can resist I2 LC and protect users' location privacy. For a continuous query, our scheme evenly selects dummy locations from different organizations. It ensures that all dummy locations are evenly distributed across these organizations. It means the probability that each location distributes across every organization is the same. That is, attackers cannot distinguish the user's real location by launching I2 LC. Specifically, the major contributions of this paper are as follows:  
* To protect a user's location privacy, organization information and query privacy in the scenario of this paper, we present the DGS-HSA to generate dummy locations and query content. The DGS-HSA considers the HSA and can resist I2 LC. * Considering the HSA, we introduce a novel meshing method to divide a city area where users locate into different grids with the two-level structure. Using this, our scheme ensures that, for each query in a continuous query, \(k\) dummy locations do not select from the same organization. In addition, for the query content, the probability of occurrence of each query category is the same in all queries in a continuous query. Thus, our scheme can better protect users' organization information and query privacy than the scheme in [13; 27]. * To protect a user's location privacy, we propose a method to resist I2 LC. Using this method, for a continuous query, our scheme ensures that each selected dummy location evenly distributes across different organizations in a continuous query. In addition, we also replace the real user's location with historical locations that are in the same organization as the real user's location. It prevents the user's exact location from being sent to the server. Thus, our scheme can resist I2 LC and better protects users' location privacy than the scheme in [13; 27]. * We evaluate the feasibility and effectiveness of our scheme. Results show that our scheme can reach an equilibrium between privacy protection level and system overhead and we give the recommended configuration of system parameters. They also show that our scheme can better protect users' location privacy, organization information and query privacy than the scheme in [13; 27]. The rest of the paper is organized as follows. We first overview the related research in Section 2. Then, in Section 3, we introduce the adversary model, the motivation and basic idea, the privacy protection model, and the system architecture of this paper. We also describe our algorithms in detail in Section 4. Respectively, Sections 5 and 6 evaluate the effectiveness of the presented scheme from both theoretical and experimental aspects, including scheme feasibility analysis. Finally, in Section 7, we summarize the research work and the innovative results and point out the problems and future work.