Evaluation and Improvement of Internet Printing Protocol Based on HCPN Model Detection Method
Round 1
Reviewer 1 Report
1. The second section contains well-known standard material. Figures 1 and 2 are naive and more suitable for a textbook, but not for a scientific article. We invite the authors to focus on the scientific component of the problem being solved. It is necessary to clearly formulate the main problem and purpose of the work; analyze well-known scientific publications devoted to solving the same problem; highlight their main shortcomings, to eliminate which the article was written; justify the chosen toolkit. For example, why was it decided to choose Petri nets for modeling rather than alternative methods?
2. The images are of poor quality and not suitable for journal publication. For example, in figures 3, 4, 5, 6, etc. pixelation is very noticeable. The background grid in the pictures looks sloppy. It is more suitable to redraw these diagrams in a specialized editor.
3. Images in figures 14, 15, 17 are cut out from other larger schemes. They contain garbage fragments of text, arrows and parts of rectangular blocks that are not related to the current image. It seems to us that these drawings should be redrawn.
4. There is no reference to table 5 in the text of the article.
5. The article is overloaded with a non-standard graphical representation of Petri nets, which significantly complicates the general analysis of the material. At the same time, the mathematical description, the analysis of the stability of the algorithm by the network, as well as the experiment are completely absent.
6. The attack model is not well known, and the links provide a brief report on 2 pages.
7. In the Petri nets for figures 4, 12, the conditions and sequence of transitions are not indicated.
8. The equivalence and verifiability of the proposed Petri net with respect to the standard protocol raises a question. The absence of an answer to this question casts doubt on all further arguments of the authors.
9. CPN Tools are currently not supported or developed. Spending so much time on unsupported software is excessive
10. In conclusion, it is recommended to consider the possibilities of implementing the improved scheme proposed by the authors in practical implementations of IPP, as well as the potential limitations and disadvantages of the proposed solution.
Author Response
Thank you for reading my article and giving valuable suggestions. I will revise the article based on your constructive proposals.
- The second section contains well-known standard material. Figures 1 and 2 are naive and more suitable for a textbook, but not for a scientific article. We invite the authors to focus on the scientific component of the problem being solved. It is necessary to clearly formulate the main problem and purpose of the work; analyze well-known scientific publications devoted to solving the same problem; highlight their main shortcomings, to eliminate which the article was written; justify the chosen toolkit. For example, why was it decided to choose Petri nets for modeling rather than alternative methods?
Response: Thank you for your comments, I have deleted the naive part in section 2.1, merged the content of sections 2.1 and 2.2 in the first draft, rethought and updated the text content.
- The images are of poor quality and not suitable for journal publication. For example, in figures 3, 4, 5, 6, etc. pixelation is very noticeable. The background grid in the pictures looks sloppy. It is more suitable to redraw these diagrams in a specialized editor.
Response: Sorry to bother you with the poor picture quality, I have deleted the background grid and repainted pictures 3, 4, 5, 6.
- Images in figures 14, 15, 17 are cut out from other larger schemes. They contain garbage fragments of text, arrows and parts of rectangular blocks that are not related to the current image. It seems to us that these drawings should be redrawn.
Response: Thank you. Based on your remark, I have replaced those imperfect pictures.
- There is no reference to table 5 in the text of the article.
Response: Thanks for your reminder, I have added this reference in section 5.2.
- The article is overloaded with a non-standard graphical representation of Petri nets, which significantly complicates the general analysis of the material. At the same time, the mathematical description, the analysis of the stability of the algorithm by the network, as well as the experiment are completely absent.
Response: Thank you, I have added relevant mathematical descriptions in Section 3.1, which may be helpful for readers to understand the content of the article. Both the original protocol and the improved scheme operate under the assumption that the network can communicate normally and stably.
- The attack model is not well known, and the links provide a brief report on 2 pages.
Response: Thank you. I have replaced the brief report with a more detailed literature, added a detailed description of the attack model in Section 2.2 of the new manuscript, and have updated the latest literature on the application of this model.
- In the Petri nets for figures 4, 12, the conditions and sequence of transitions are not indicated.
Response: Thank you. Figures 4 and 12 serve as the top layer, just to build the basic skeleton of information flow, and do not pay attention to trivial and specific conversion conditions. All necessary conversion conditions have been restricted in the internal implementation of the middle layer and the bottom layer.
- The equivalence and verifiability of the proposed Petri net with respect to the standard protocol raises a question. The absence of an answer to this question casts doubt on all further arguments of the authors.
Response: Thank you. The improvement scheme only changes some steps of encapsulating MSG6 and MSG7 between the client and the server. This is the internal data processing process of the communication parties, which is not visible to the outside world, and will not affect the external handshake process of the standard protocol. For each authentication, the communication parties still follow the sequence from MSG1 to MSG8 to complete all the steps. This guarantees the equivalence and verifiability of the improved scheme to the standard protocol. I have added relevant descriptions in paragraphs 2, 6 of Section 6.
- CPN Tools are currently not supported or developed. Spending so much time on unsupported software is excessive
Response: Thank you. When the experiment was implemented, the latest official download version was 4.0.1, so I chose it as the tool to complete the experiment. I just re-checked the download page and found that the official update "CPN IDE version 1.22.1117" is an alternative software for CPN Tools, which can be obtained in this web page: (https://cpnide.org/latest-downloads/). Based on your suggestion, I tried to migrate the experimental code to the latest version, but it failed with a compatibility error. I'm giving up for now due to wasting a lot of time, but I guarantee that the code will work fine in 4.0.1. Regardless, your advice is very useful, and I will keep this in mind during future research, and try to use the latest developed or supported software whenever possible.
- In conclusion, it is recommended to consider the possibilities of implementing the improved scheme proposed by the authors in practical implementations of IPP, as well as the potential limitations and disadvantages of the proposed solution.
Response: Thanks, I have added relevant content in section 6.
Thanks again for your advices, which has significantly raised the quality of my manuscript.
Reviewer 2 Report
The submitted manuscript presents the evaluation and improvement of Internet Printing Protocol based on HCPN model detection method.
The figures and the tables are understandable. The article is quite well written, but it needs some major changes as listed below.
The group of references [9-22] in line 52 in inacceptable. Please comment each work what you think is here worth presenting or just delete the references.
More information about the usage of Petri net models for the analysis of Internet protocols should be provided in section 2.3.
The limitations of the proposed approach should also be presented.
English language should be revised, including also the style. Sentences like “The reason has already been explained in Section 4.2, so I won’t repeat it here.” or “There is no essential difference between its implementation and SVerify’s, so I won’t go into details …” should not appear in a scientific paper. These are just not nice for the reader.
The list of references should be extended to include more scientific articles. Now, many positions in the list are just web resources or documents. By the way, please also check whether they are still reachable and modify then the last access date.
Author Response
Thank you for reading my article and giving valuable suggestions. I will revise the article based on your constructive proposals.
- The figures and the tables are understandable. The article is quite well written, but it needs some major changes as listed below.
Response: Thanks for your approval. It’s important for me.
- The group of references [9-22] in line 52 in inacceptable. Please comment each work what you think is here worth presenting or just delete the references.
Response: Thank you. Your advice is very nice and useful. I have rearranged the IPP-related literature in Section 2.1 and deleted non-essential content.
- More information about the usage of Petri net models for the analysis of Internet protocols should be provided in section 2.3.
Response: Thanks for your suggestion. I have added more literature on Petri net applications in Section 2.3.
- The limitations of the proposed approach should also be presented.
Response: Thanks, I have described the limitations of the new scheme in the last paragraph of Section 6.
- English language should be revised, including also the style. Sentences like “The reason has already been explained in Section 4.2, so I won’t repeat it here.” or “There is no essential difference between its implementation and SVerify’s, so I won’t go into details …” should not appear in a scientific paper. These are just not nice for the reader.
Response: Thank you. Based on your suggestion, I will apply for MDPI's English language editing service.
- The list of references should be extended to include more scientific articles. Now, many positions in the list are just web resources or documents. By the way, please also check whether they are still reachable and modify then the last access date.
Response: Thank you. According to your suggestion, I have added recent works in the References section and recheck resource availability. And when I found that when we copy and visit the URL mentioned in the reference 2, the web address in the PDF version will add some unrelated characters to the search bar string, and I have not figured out the reason. But you can visit it by entering the address manually.
Gratefully thanks again for your advices, which has significantly raised the quality of my manuscript.
Reviewer 3 Report
Th paper proposes an improvement of Internet Printing Protocol based on HCPN model detection method. Following are my observations:
1. In the abstract, The Internet Printing Protocol, IPP,---> should be corrected to The Internet Printing Protocol (IPP)..This should be corrected in the entire manuscript.
2. The abstract should mention the research issue and how do u achieve ur objective. Also some highlight about our results.
3. Literature should discuss recent works.
4. English language should be extensively improved.
5. Some short abbreviations should be written in full.
6. Proposed work is good.
7. Comparative analysis is missing in recent works.
8. Conclusion needs to mention future scope and implications.
9. How does the proposed model detects the 0-RTT authentication process?
10. Does the use of Petri net models can reduce the concurrency in the operations?
11. The authors need to identify and discuss how the handshaking rule has been ascertained with the proposed work.
12. Also, how can the proposed work be made more secure using hashing or any encryption keys?
13. Is the noise/attack resistance ability of the work been taken into consideration?
14. What is the system configuration and complexities involved must be mentioned.
15. Mention the working environment under which the proposed model can fail.
16. How does the model responds to selective replay attacks by the interceptors?
Author Response
Thank you for reading my article and giving valuable suggestions. I will revise the article based on your constructive proposals.
- In the abstract, The Internet Printing Protocol, IPP,---> should be corrected to The Internet Printing Protocol (IPP)..This should be corrected in the entire manuscript.
Response: Thanks for your advice, I have rechecked and corrected non-standard writing.
- The abstract should mention the research issue and how do u achieve your objective. Also some highlight about our results.
Response: Thank you. Based on your comment, I rewrote the Abstract section.
- Literature should discuss recent works.
Response: Thank you. According to your suggestion, I have updated recent works in the References section.
- English language should be extensively improved.
Response: Thank you. Based on your advice, I will apply for MDPI's English language editing service.
- Some short abbreviations should be written in full.
Response: Thank you for your suggestion, I have rechecked and updated relevant content.
- Proposed work is good.
Response: Thank you very much. You know, it's very important for an academic newcomer.
- Comparative analysis is missing in recent works.
Response: Thanks. Based on your advice, I have added comparative analysis of the recent works in Section 2.1.
- Conclusion needs to mention future scope and implications.
Response: Thank you. Based on your comment, I have updated my future work in the section 7.
- How does the proposed model detect the 0-RTT authentication process?
Response: Thank you. I have supplemented the relevant content in Section 5.1.2.
- Does the use of Petri net models can reduce the concurrency in the operations?
Response: Thank you. Using the Petri net model does not reduce the concurrency of operations, it is only suitable for modeling scenarios where concurrent behavior exists. This is mainly due to the fact that Petri net does not limit the number and direction of arrows, which is convenient for describing the concurrent behavior of the model.
- The authors need to identify and discuss how the handshaking rule has been ascertained with the proposed work.
Response: Thank you. The improvement scheme does not change the standard protocol handshake process, and the communication entities still send and receive external messages in the order from MSG1 to MSG8. The new scheme only adds a random number signature in the client session recovery request, and adds internal verification of the random number signature on the server side. The above changes did not bring structural changes to the handshake process. I have supplemented the relevant description in Section 5.1 and Section 6.
- Also, how can the proposed work be made more secure using hashing or any encryption keys?
Response: Thank you. The client uses its own private key to sign the random number. Server verification this signature. If the opponent tampered with or forged the random number, it would be discovered by the server. In this way, the random number can only be generated by the client. The improved Dolev-Yao model does not have the ability to break through the private keys of both parties.
- Is the noise/attack resistance ability of the work been taken into consideration?
Response: Thank you. Standard protocols are anti-tampering and anti-forgery, but not anti-replay. I have updated the relevant content in paragraphs 4, 5 of section 4.2. The improved scheme increases the ability to resist replay attacks. I have updated the relevant analysis in Section 6.
- What is the system configuration and complexities involved must be mentioned.
Response: Thank you. The system configuration is as follow, and I have added them in Appendix section A.1.
OS: Windows 10 version 21H2(OS build 19044.2486), 64-bit operating system
Processor: Intel(R) Core (TM) i7-10750H CPU @ 2.60GHz 2.59 GHz
Software: CPN Tools version 4.0.1
- Mention the working environment under which the proposed model can fail.
Response: Thank you. I have described the limitations of the new scheme in the last paragraph of Section 6.
- How does the model responds to selective replay attacks by the interceptors?
Response: Thank you. The client will generate a new random number each time to send a recovery request. If the same random number is used twice, it means that an intermediate person replayed the request. At this time, the server should terminate handshake. I have updated the relevant description in Section 5.1 and Section 6.
Gratefully thanks again for your advices, which has significantly raised the quality of my manuscript.
Reviewer 4 Report
Comments for author File: 
Comments.docx
Author Response
Thank you for reading my article and giving valuable suggestions. I will revise the article based on your constructive proposals.
- This study presented new approach which is interested. Based on Petri net theory and CPN Tools, this paper models 4 the 0-RTT authentication process of the IPP protocol, and introduces the improved Dolev-Yao attack 5 model to evaluate the security of the protocol model on the basis of that it is consistent with the 6 original protocol authentication process.
Response: Thank you.
- The introduction and related work sections need enhancements using some state of art studies in this filed. I advise number of studies, but the author can add other researches that related to this study:
- https://www.sciencedirect.com/science/article/pii/S0045790622003561
- https://www.sciencedirect.com/science/article/pii/S0951832018303399
- https://www.sciencedirect.com/science/article/pii/S0951832016306366
Response: Thanks. According to your recommendation, I have went through the articles you listed and found them very useful. After carefully consideration, I have chosen and cited the second item in the section 2.3.
- Contribution of this study clearly.
Response: Thanks for your encouragement. This is very important for a newcomer
- The author must add motivation that leads to present this work.
Response: Thank you. I have updated the relevant content in section 2.1.
- The results section well written, there is no need to extend or clarify any think.
Response: Thank you.
- Please, write future works in the conclusion section clearly
Response: Thanks. Based on your advice, I have updated my future works in section 7.
Gratefully thanks again for your advices, which has significantly raised the quality of my manuscript.
Round 2
Reviewer 1 Report
The author revised the article in accordance with the comments. It is very desirable to correct the captions to the figures. It is desirable to make them more accessible to the reader. In addition, modern approaches to the use of Petri nets are rather poorly considered, for example, 10.1007/BF01211299, 10.1109/ELEKTRO49696.2020.9130267, 10.3103/S0146411613070201
Author Response
Thank you for your advices.
- The author revised the article in accordance with the comments. It is very desirable to correct the captions to the figures. It is desirable to make them more accessible to the reader.
Response: Thank you. I have corrected the captions to the figures.
- modern approaches to the use of Petri nets are rather poorly considered, for example,10.1007/BF01211299, 10.1109/ELEKTRO49696.2020.9130267, 10.3103/S0146411613070201
Response: Thank you for your rigorous consideration.
10.1007/BF01211299 Taking the echo algorithm as an example, simplify the representation and proof of distributed algorithms by introducing appropriate invariants. There is uncertainty in the number of agents in the algorithm, so it is necessary to introduce symbolic reasoning to simplify the proof.
10.1109/ELEKTRO49696.2020.9130267 ensures parallel programming safety by finding incompatible paths of input programs. Additionally, parallel threads can be nested inside a thread. Due to the uncertainty of the input program and the complex mutual nesting relationship between concurrent threads, it is necessary to introduce symbolic reasoning to simplify the proof.
10.3103/S0146411613070201 needs to complete the model conversion process from NPnets to colored Petri nets, so it is necessary to introduce symbolic reasoning to complete semantic analysis.
The protocol authentication process studied in my paper is essentially a linear process: one party sends information, the network channel transmits information, and the other party receives and verifies the information. The number and identity of the participants are clear, the behavior of the entity is determined, and the steps are predictable. Therefore, it is possible to judge whether there is a problem in the authentication process by directly simulating and observing the termination state of the model. This intuitive way is more helpful to the reader's understanding.
Thanks again for your valuable comments.
Reviewer 2 Report
The paper has been revised according to my comments. Its quality is better now.
Author Response
Thank you.
Reviewer 3 Report
The revised paper is now improved
Author Response
Thank you.
