## 1 Introduction
As shown in Figure 1, by intersecting users in different anonymous groups and combining background knowledge [26], the attacker could find that only \(u_{1}\) was in the three queries and then inferred \(u_{1}\) was the real user who sends queries in \(L\) (only the same user has the ability to send queries continuously in a short period of time, see [13]). Moreover, attackers can deduce the user's sensitive location, e.g., home address, workplace, by collecting and analyzing the user's long-term historical query data [13]. For the query content, although the attacker cannot distinguish which one is the query content of \(u_{1}\) in the first query, he was able to identify it in the second and third queries. We call this kind of attack, one meant to obtain sensitive location and query content privacy by intersection inference attacks (see [27]), intersection inference attack for location and query content (I2 LC). Furthermore, existing methods do not consider the hierarchical structure of the address (HSA), which may reveal a user's organization information. Actually, a region is comprised of different levels of region, and these different levels of region are called the HSA. For example, the HSA of Beijing is comprised of four levels of region: City (Beijing), district (Haidian District), street (Xi Tucheng Road), organization (Beijing University of Posts and Telecommunications (BUPT)). If we do not consider the HSA, we may select \(k-1\) locations that locate in the same organization as the real location in the anonymous group. For example, the \(k\) locations in the anonymous group are all located in BUPT. Despite this not directly exposing the user's exact location, it reveals that the user is located in BUPT. For some particular users, the organization information also needs to be kept secret, such as confidential personnel, anti-drug police, etc. ; once leaked, it will be used by criminals to infer their occupation and pose a life threat to the users. In this paper, we present a dummy generation scheme considering the HSA, called DGS-HSA, to generate dummy locations and query content. In this scheme, for each query in a continuous query, we select \(k\) locations (in our scheme, the user does not send her real locations to the LBS server, see Section 4.4), from historical locations as dummy locations. In each dummy location, a user sends a dummy query selected from the basic service set. In the DGS-HSA, we first divide a city area where users locate into different grids with the two-level structure. Each grid represents an organization and all historical locations are clustered into these grids according to their organizations. Based on these grids, we then propose the degree of privacy protection \(<L_{(k,s)},Q_{l}>\). Using \(<L_{(k,s)},Q_{l}>\), we select dummy locations and query content to protect users' location privacy, organization information, and query privacy in the scenario of this paper. For each query in a continuous query, we select \(k\) locations distributed across \(s\) different organizations from historical locations and query content in all queries in a continuous query that has at least \(l\) query categories. It can protect a user's organization information and query privacy since it ensures that \(k\) locations do not locate in the same organization and query content in all queries in a continuous query that has at least \(l\) query categories. For all queries in a continuous query, we ensure all locations selected from historical locations are evenly distributed across all different organizations. So, our scheme can resist I2 LC and protect users' location privacy. Using theoretical analysis we also prove that our scheme can meet the \(<L_{(k,s)},Q_{l}>\) and resist I2 LC. However, considering the privacy protection level and system overhead, the two must reach equilibrium if our scheme is feasible. So, we evaluate the feasibility and effectiveness of our scheme.