Users registered at one malicious access point cooperate with a trusted Privacy Enhancer; the access point can observe all group traffic, while upper-layer payloads and control messages rely on public-key, signature, group-key, and IPsec protection.

1. assumption

   Anonymity-set condition

   necessary condition

   Privacy requires more than one participating user; the anonymity level grows with group cardinality, while shorter rotation slots reduce tracking time at the cost of more switching overhead.

   Group, adversary, keys, and trusted Privacy Enhancer · Security analysis and anonymity conditions

The protocol maintains group membership, distributes an address table and hash-chain seed, synchronizes rotations, and maps each user to a collision-free address pair for each variable-length time slot.

1. component

   Membership and synchronization

   specified

   Signed and encrypted join/leave messages let the Privacy Enhancer update group size, address table, seed, and time base; timers handle departures that are not explicitly announced.

   Join, leave, update, address permutation, and proxy operation
2. component

   Address permutation

   specified

   All members derive the same time-slot hash value and use offset indices to permute the table of active IP/MAC pairs without collisions; a hash-derived variable slot length counters fixed-period timing correlation.

   Join, leave, update, address permutation, and proxy operation
3. component

   Privacy Enhancer proxy

   specified

   The proxy exposes a stable permanent address to correspondent nodes, tracks both legs of each connection, and adjusts IP addresses, sequence numbers, acknowledgments, and windows as users exchange address pairs.

   Join, leave, update, address permutation, and proxy operation

The paper gives an informal privacy analysis and simulation evidence about throughput disruption; it does not provide a formal security proof.

1. claim

   Upper-layer tracking resistance

   informally argued

   Against an observer limited to layer 2 and above, synchronized address permutation prevents straightforward identifier linkage, conditional on encrypted communications, uncompromised group secrets, and the stated registration assumptions.

   Security analysis and anonymity conditions
2. claim

   Lower disruption than reassociation

   simulation supported

   The NC-TUns comparison reports that PEUC-WiN retains TCP connections across address changes and therefore avoids the repeated handshakes, slow starts, and longer outages of reassociation-based rotation.

   Performance model, implementation barrier, and simulation setup · NC-TUns throughput comparison

The design depends on a trusted, available proxy and group secrets, excludes physical-layer tracking, and was simulated because commodity Wi-Fi drivers did not expose sequence-number control needed for implementation.

1. limitation

   Member compromise and former-member leakage

   explicitly vulnerable

   A malicious member that joins or is compromised learns the address schedule and can track members; forward-secure group-key refresh is suggested but left out of scope.

   Security analysis and anonymity conditions
2. limitation

   Traffic analysis and proxy bottleneck

   unresolved

   The proxy address can reveal group affiliation, triangular routing can degrade throughput, and the proxy is a bottleneck and single point of failure unless replicated.

   Security analysis and anonymity conditions · Performance model, implementation barrier, and simulation setup