## 4 ROLQ-TEE Scheme
### Detailed Construction
It takes as input the encrypted location data set \(c_{i}\), the encrypted query token \(\mathcal{Q}_{\mu}\), the query key \(sk_{\mu}\), the secret key \(sk_{\mathcal{DO}}\), the map table \(MT\), and public system parameters \(mpk\). It outputs an encrypted optimal  
The TEE decrypts the \(\mathcal{CF}_{\mu}\) to the \(M_{\mathcal{F}_{\mu}}\) using Equation (3), as shown below, and obtains a list of the candidate facility locations \(\mathcal{F}_{\mu}=\{f_{1},\ldots f_{s}\}\). \[ \begin{split} M_{\mathcal{F}_{\mu}}&=\frac{ \mathcal{CF}_{\mu,1}\cdot\epsilon(sk_{\mu,1,1},\mathcal{CF}_{\mu,2})}{e(sk_{\mu, \mu,0},\mathcal{CF}_{\mu,0})}\\ &=\frac{M_{\mathcal{F}}\cdot e(H_{1}(rid_{\mu})^{r_{\pi}},h_{\mu} )\cdot e(g^{r_{\mu,2}},H_{2}(T_{t})^{r_{\pi}})}{e(H_{1}(rid_{\mu})^{a_{\mu}} \cdot H_{2}(T_{t})^{r_{\pi,2}},g^{r_{\pi}})}\\ &=\frac{M_{\mathcal{F}}\cdot e(H_{1}(rid_{\mu})^{r_{\pi}},h_{\mu} )\cdot e(g^{r_{\mu,2}},H_{2}(T_{t})^{r_{\pi}})}{e(H_{1}(rid_{\mu})^{a_{\mu}},g^ {r_{\pi}})\cdot e(H_{2}(T_{t})^{r_{\pi,2}},g^{r_{\pi}})}\\ &=M_{\mathcal{F}_{\mu}}\end{split} \] (3) 2. According to the decryption method in Step 1, TEE decrypts the encrypted customer list \(\mathcal{CL}_{\mu}\) to \(L=\{F(sk_{\mu},y_{\mu,1}),\ldots,F(sk_{\mu},y_{\mu,n_{\mu}})\}\). 3. Meanwhile, the TEE compares whether \(L.F(sk_{\mu},y_{\mu,j})\) and \(MT.F(sk_{\mu},(x_{i}))\) are equal using Equation (4), as shown below. If equal, the TEE loads \(c_{i}\), corresponding to \(MT.F(sk_{\mu},(x_{i}))\), and decrypts it to obtain the location data \(l_{i}\). Otherwise, TEE continues to match the next token. \[L.F(sk_{\mu},y_{\mu,j})\stackrel{{?}}{{=}}MT.F(sk_{\mu},(x_{i}))\] (4) 4. Subsequently, the TEE loads the encrypted location data \(c_{i}\) of \(MT.F(sk_{\mu},(x_{i}))\) and decrypts the \(c_{i}\) to the \(l_{i}\). Next, the TEE obtains \(U_{I}=\{l_{i}\}\), corresponding to the intersection of the customers of the \(\mathcal{DO}\) and the \(\mathcal{DU}_{\mu}\). 5. The TEE uses the \(U_{I}\) and the \(\mathcal{F}_{\mu}\) to compute the ranking result _res_ of the optimal location query (RNNQ/AVGQ/MAXQ) according to the Euclidean distance (Section 3.1) and Definition 1 (or Definition 2 or Definition 3). 6. The TEE encrypts the optimal location query results _res_ to \(\mathcal{C}_{\textit{res}}=\{\mathcal{C}_{\textit{res},\textit{0}},\mathcal{C} _{\textit{res},\textit{1}},\mathcal{C}_{\textit{res},\textit{2}}\}\) using \(sk_{\mu}\), and sends the \(C_{\textit{res}}\) to the \(\mathcal{DU}_{\mu}\). * Dec(\(C_{\textit{res}},sk_{\mu}\))\(\rightarrow\)_res_. The _Dec_ algorithm is run by the \(\mathcal{DU}_{\mu}\). It takes as input the query results \(C_{\textit{res}}\) and the query key \(sk_{\mu}\). It outputs the ranking results _res_, as follows: \[ \begin{split} res&=\frac{\mathcal{C}_{\textit{res}, 1}\cdot\epsilon(sk_{\mu,\textit{1},1},\mathcal{C}_{\textit{res},\textit{2}})}{e( sk_{\mu,\textit{0}},\mathcal{C}_{\textit{res},\textit{0}})}\\ &=\frac{res\cdot e(H_{1}(rid_{\mu})^{r_{\pi}},h_{\mu})\cdot e(g^{r_ {\mu,2}},H_{2}(T_{t})^{r_{\pi}})}{e(H_{1}(rid_{\mu})^{a_{\mu}}\cdot H_{2}(T_{t} )^{r_{\pi,2}},g^{r_{\pi}})}\\ &=\frac{res\cdot e(H_{1}(rid_{\mu})^{r_{\pi}},h_{\mu})\cdot e(g^{r_ {\mu,2}},H_{2}(T_{t})^{r_{\pi}})}{e(H_{1}(rid_{\mu})^{a_{\mu}},g^{r_{\pi}}) \cdot e(H_{2}(T_{t})^{r_{\pi,2}},g^{r_{\pi}})}\\ &=res\end{split} \] (5) * \(KeyFresh(\{rid_{k}\},msk,mpk)\)\(\rightarrow\)(\(sk_{\mu}^{\prime},RL^{\prime},TL^{\prime},UL^{\prime}\)). The _KeyFresh_ algorithm is run by the TEE. It takes as input a set of revoked identities \(\{rid_{k}\}\), the master secret key _msk_, and the system master public key _mpk_. It outputs the updated query keys \(sk_{\mu}^{\prime}\), an updated revocation list \(RL^{\prime}\), an updated data user list \(UL^{\prime}\), and an updated timestamp list \(TL^{\prime}\). 1.