Against the global eavesdropping in wireless sensor networks, tremendous amount of dummy packets for faking are likely to be continuously generated in order to keep the location privacy of the communication source and destination. In our approach only certain disk-shaped zones of encompassing sources and destination are allowed to issue dummy packets during the data transfer so that the amount of generated packets is reduced while the location privacy of the source and destination remains secret. To this end we design a routing protocol and propose a detailed formal specification of it, and verify major characteristics.