# An Efficient Dummy-Based Location Privacy-Preserving Scheme for Internet of Things Services
## 3 Enhanced-DLP Scheme
### Security Analysis  
\(\bullet\) Resistance to the Colluding Attack  
Proof.: A passive attacker who would like to obtain the user's location information may collude with other users or LBS servers. A colluding attack happens with a number of users that want to recognize the user's location information from the submitted \(k\) locations by colluding each other.  
In our scheme, a user wants to protect his/her location privacy by way of choosing other locations with the same query probability as the user's location. Once an attacker compromises a user \(U_{1}\), the rest of the \(k-1\) location information which has the same historical query probability as \(U_{1}\) will be intercepted.The attacker can not recognize which one is the user's location from k locations because they have similar historical query probability. The only way is for the attacker to randomly select a location from the \(k\) locations set to be the user's location. Therefore, the probability of identifying the user's location information from \(k\) locations is \(1/k\). Then, the user \(U_{2}^{t}\)s LBS query is intercepted by the attacker who receives the user's location information. However, the probability to identify the user's location information from \(k\) locations is still \(1/k\). The reason is that the selected dummy locations of user \(U_{1}\) and \(U_{2}\) have no correlations. The attacker identifies the user's real location from intercepted \(k\) locations by way of random selection. Moreover, with a colluding group with more users, the attacker can only identify the user's real location randomly from intercepted \(k\) locations. We can see that the probability to recognize the user's real location from the generated dummy location set is kept steady.  
* Resistance to a Side Information Inference Attack  
**Proof.** An active attacker wants to obtain the user's location privacy information according to the historical query probabilities of all locations and the current queries of users. In this paper, we assume that the LBS server mentioned in system model is an active attacker.  
In the Enhanced-DLP scheme, from Step (3) to Step (5), the LBS server can not distinguish the user's real location from \(k\) locations, even if the attacker knows the historical query probability of all locations, since the selected \(k\) locations all have the same historical query probability as the user's location. From Step (6) to Step (20), due to the selected \(k\) locations having similar historical query probability, it is hard for the attacker to distinguish the user's real location from an anonymous set. The reason is that the Enhanced-DLP scheme can guarantee that the chosen dummy locations comprise an anonymous set with the largest entropy and enough dummy locations whose query probability are the same as the user's real location, thus the LBS server still cannot identify the user's real location from \(k\) locations. From Step (21) to Step (29), as the chosen \(k\) dummy locations have a similar historical query probability and the Enhanced-DLP ensures the uncertainty of the selection, the LBS server cannot identify the user's real location from \(k\) locations.