## 4 ROLQ-TEE Scheme
### Detailed Construction
When setting \(s=10\) and \(n_{I}=100\), we conducted a systematic test on each algorithm in the scheme, as in Figure 4. Figure 4 shows the running time comparison of each algorithm under different numbers of data users \(\mathcal{U}\mu_{\mu}\). Figure 4 clearly shows that the number of \(\mathcal{U}\mu_{\mu}\) is proportional to the KeyGen algorithm and the KeyFresh algorithm, while the other algorithms are independent of the number of \(\mathcal{U}\mu_{\mu}\). Figure 5 shows the computation costs of three analysis methods. As shown in Figure 5a, when the number \(s\) of facilities in \(\mathcal{F}\mu\) and the number \(n_{I}\) of intersection users in \(U_{I}\) increase at the same time, the time taken for an RNNQ analysis will also increase. Note that the RNNQ analysis time we tested refers to the total test time for decrypting data and calculating the Euclidean distance between all facilities in \(\mathcal{F}\mu\) and all intersection users in \(U_{I}\). Therefore, the RNNQ analysis time increases proportionally with both the number \(s\) of facilities in \(\mathcal{F}\mu\) and the number \(n_{I}\) of intersection users in \(U_{I}\). In Figure 5b, when the number \(s\) of facilities in \(\mathcal{F}\mu\) and the number \(n_{I}\) of intersection users in \(U_{I}\) increase at the same time, the time taken for an AVGQ query will also increase. Note that the AVGQ query time we tested is the sum of the average analysis time of computing the Euclidean distance between all facilities in \(\mathcal{F}\mu\) and all intersection users in \(U_{I}\). In Figure 5c, when the number \(s\) of facilities \(\mathcal{F}\mu\) and the number \(N_{I}\) of intersection users in \(U_{I}\) increase at the same time, the time taken for a MAXQ query will also increase. Note that the MAXQ query time we tested is the analysis time required to compute the minimum Euclidean distance among the Euclidean distances between all facilities in \(\mathcal{F}\mu\) and all intersection users in \(U_{I}\). In particular, during the RNNQ query process, the TEE needs to decrypt and analyze a large amount of data in sequence, while AVGQ analysis and MAXQ query are performed based on the decrypted data of the RNNQ query, so the query time taken for AVGQ and MAXQ is less than the query time taken for RNNQ. Figure 6a shows that, when the number of facilities \(s=100\), as the number \(n_{I}\) of intersection user data increases, the query time taken for the three analysis methods RNNQ, AVGQ, and MAXQ also gradually increases. Similarly, Figure 6b shows that, when the number of intersection user data \(n_{I}=10,000\), as the number \(s\) of facilities increases, the query time taken for the three analysis methods RNNQ, AVGQ, and MAXQ also gradually increases. Figure 6a,b clearly show that the number \(n_{I}\) of intersection data and the number \(s\) of facilities have a huge impact on the query time taken for RNNQ. Compared with the

Figure 4: Comparison of costs under different numbers of \(\mathcal{R}\mathcal{U}\mu\). number \(s\) of facilities, the number \(n_{I}\) of intersection data has a more significant impact on the query time taken for AVGQ and MAXQ. ## 7 Conclusions

We propose the ROLQ-TEE scheme, a privacy-preserving scheme for querying location data of telecommunication operators and data users in a cloud service provider (\(\mathcal{CSP}\)) utilizing a Trusted Execution Environment (TEE). This scheme incorporates the following

Figure 5: Comparison of the time costs of three analysis methods under different numbers of \(s\) and \(n_{I}\). Figure 6: Comparison of analysis time among RNNQ, AVGQ, and MAXQ. three key functionalities: (a) The TEE-based query architecture ensures data and code confidentiality and integrity within the TEE, preventing customer lists from being exposed to the \(\mathcal{CSP}\); (b) the privacy-preserving optimal location query enables the secure computation of optimal locations without revealing query results to the \(\mathcal{CSP}\).