## 1 Introduction  
The integration of cloud computing and smart mobile devices has led to the widespread generation of location data, thereby driving the widespread use of location-based services (LBSs) [1]. Location-based services enable governments and businesses to make informed decisions, such as when optimizing urban planning, determining new facility placements, allocating resources, and achieving various other strategic objectives. Optimal location query (OLQ) [1] is a branch of location-based service applications that aims to identify the best location for a new facility that maximizes its influence, taking into account a set of existing facilities and customers. However, these businesses (or governments) are unable to perform an optimal location query as the location of customers is invariably unknown to them. This requires businesses to obtain these location data from telecommunication operators. Since location data usually involves behavioral information, any leakage of location data may pose threats to personal security and result in losses of economic property. Therefore, telecommunication operators are unwilling to share these location data with other businesses directly. Additionally, to reduce the computational burden, telecommunication operators typically opt to outsource encrypted location data and location-based services to cloud service providers. The primary reason for this is that cloud service providers enable the cost-efficient storage and processing of large datasets, providing the computational capacity for complex location-based services. Therefore, when cloud service providers offer an optimal location query service to businesses, telecommunication operators must ensure the privacy of individual customers and their location information, as well as the confidentiality of query results. Simultaneously, the customer information of businesses should remain confidential and protected from the cloud service provider. For consistency, this paper regards the telecommunication operator as the data owner, the businesses as the data users, and the identity and location of the customer as private data. Moreover, in practical applications, optimal location query services are typically time-limited rather than permanent. When a subscription expires, the data owner must revoke the query permissions of data users by refreshing their query keys. For clarity, we visualize this architecture below in Figure 1. The scenario involves a data owner maintaining a customer location database, a TEE-enabled cloud service provider, and multiple data users (i.e., businesses, abstracted as [PERSON], Bob, and Adam), who have their own customer lists. These authorized data users perform optimal location queries for a new branch in a specified candidate set during the subscription. To address privacy issues, various privacy-preserving schemes for optimal location queries have been proposed. According to the usage method, they can be generally divided into the following two categories: non-cryptographic privacy-preserving location selection schemes [2; 3; 4; 5; 6; 7] and cryptographic privacy-preserving location selection schemes [8; 9; 10; 11; 12; 13; 14; 15]. Nevertheless, both of the above privacy-preserving schemes have obvious shortcomings, such as insufficient data privacy protection, inaccurate query results, and irrevocable user query permissions for non-cryptographic schemes, and high computational overhead, low query efficiency, and irrevocable user query permissions for cryptographic schemes. Our contributions: To overcome these shortcomings simultaneously, we propose ROLQ-TEE: a revocable and privacy-preserving optimal location query scheme based on TEE. The ROLQ-TEE scheme can securely and efficiently identify the optimal location within the candidate facility set based on the customer's location data and also support the revocation of the query permission.