An improved efficient anonymous authentication with conditional privacy-preserving scheme for VANETs

Eko Fajar Cahyadi; Min-Shiang Hwang

doi:10.1371/journal.pone.0257044

Peer Review History

Original SubmissionJune 11, 2021
8 Jul 2021 Decision Letter - Muhammad Khurram Khan, Editor PONE-D-21-19203 An improved efficient anonymous authentication with conditional privacy-preserving scheme for VANETs PLOS ONE Dear Dr. Hwang, Thank you for submitting your manuscript to PLOS ONE. After careful consideration, we feel that it has merit but does not fully meet PLOS ONE’s publication criteria as it currently stands. Therefore, we invite you to submit a revised version of the manuscript that addresses the points raised during the review process. Please submit your revised manuscript by Aug 22 2021 11:59PM. If you will need more time than this to complete your revisions, please reply to this message or contact the journal office at plosone@plos.org. When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file. Please include the following items when submitting your revised manuscript: A rebuttal letter that responds to each point raised by the academic editor and reviewer(s). You should upload this letter as a separate file labeled 'Response to Reviewers'. A marked-up copy of your manuscript that highlights changes made to the original version. You should upload this as a separate file labeled 'Revised Manuscript with Track Changes'. An unmarked version of your revised paper without tracked changes. You should upload this as a separate file labeled 'Manuscript'. If you would like to make changes to your financial disclosure, please include your updated statement in your cover letter. Guidelines for resubmitting your figure files are available below the reviewer comments at the end of this letter. If applicable, we recommend that you deposit your laboratory protocols in protocols.io to enhance the reproducibility of your results. Protocols.io assigns your protocol its own identifier (DOI) so that it can be cited independently in the future. For instructions see: http://journals.plos.org/plosone/s/submission-guidelines#loc-laboratory-protocols. Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at https://plos.org/protocols?utm_medium=editorial-email&utm_source=authorletters&utm_campaign=protocols. We look forward to receiving your revised manuscript. Kind regards, Muhammad Khurram Khan, Ph.D. Academic Editor PLOS ONE Journal requirements: When submitting your revision, we need you to address these additional requirements. 1. Please ensure that your manuscript meets PLOS ONE's style requirements, including those for file naming. The PLOS ONE style templates can be found at https://journals.plos.org/plosone/s/file?id=wjVg/PLOSOne_formatting_sample_main_body.pdf and https://journals.plos.org/plosone/s/file?id=ba62/PLOSOne_formatting_sample_title_authors_affiliations.pdf 2. PLOS requires an ORCID iD for the corresponding author in Editorial Manager on papers submitted after December 6th, 2016. Please ensure that you have an ORCID iD and that it is validated in Editorial Manager. To do this, go to ‘Update my Information’ (in the upper left-hand corner of the main menu), and click on the Fetch/Validate link next to the ORCID field. This will take you to the ORCID site and allow you to create a new iD or authenticate a pre-existing iD in Editorial Manager. Please see the following video for instructions on linking an ORCID iD to your Editorial Manager account: https://www.youtube.com/watch?v=_xcclfuvtxQ 3. Thank you for stating in your Funding Statement: [The Ministry of Science and Technology partially supported this research, Taiwan (ROC), under contract no.: MOST 109-2221-E-468-011-MY3 and MOST 110-2622-8-468-001 -TM1. NO - Include this sentence at the end of your statement: The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.]. Please provide an amended statement that declares all the funding or sources of support (whether external or internal to your organization) received during this study, as detailed online in our guide for authors at http://journals.plos.org/plosone/s/submit-now. Please also include the statement “There was no additional external funding received for this study.” in your updated Funding Statement. Please include your amended Funding Statement within your cover letter. We will change the online submission form on your behalf. 4. We note you have included a table to which you do not refer in the text of your manuscript. Please ensure that you refer to Table 2 in your text; if accepted, production will need this reference to link the reader to the Table. Reviewers' comments: Reviewer's Responses to Questions Comments to the Author 1. Is the manuscript technically sound, and do the data support the conclusions? The manuscript must describe a technically sound piece of scientific research with data that supports the conclusions. Experiments must have been conducted rigorously, with appropriate controls, replication, and sample sizes. The conclusions must be drawn appropriately based on the data presented. Reviewer #1: Yes Reviewer #2: Yes ******** 2. Has the statistical analysis been performed appropriately and rigorously? Reviewer #1: Yes Reviewer #2: N/A ****** 3. Have the authors made all data underlying the findings in their manuscript fully available? The PLOS Data policy requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified. Reviewer #1: Yes Reviewer #2: Yes ****** 4. Is the manuscript presented in an intelligible fashion and written in standard English? PLOS ONE does not copyedit accepted manuscripts, so the language in submitted articles must be clear, correct, and unambiguous. Any typographical or grammatical errors should be corrected at revision, so please note any specific errors here. Reviewer #1: Yes Reviewer #2: Yes ****** 5. Review Comments to the Author Please use the space provided to explain your answers to the questions above. You may also include additional comments for the author, including concerns about dual publication, research ethics, or publication ethics. (Please upload your review as an attachment if it exceeds 20,000 characters) Reviewer #1: The authors proposed an improved efficient anonymous authentication with conditional privacy-preserving scheme for VANETs. First, the authors pointed out that the Kazemi et al.’s scheme is vulnerable to some attacks. Second, they proposed an improvement to remedy these attacks. Check its correctness and analysis, it is correct and complete. The evaluation results shows that their scheme is better in terms of computation time consumption. The paper is well-written and well-organization. However, some suggestions should be addressed if the paper is accepted. 1. Several grammar mistakes of English exist in this paper, which need to be carefully checked and revised. 2. The format of your paper is wrong. Please check your format for this journal using their templet. 3. Please cite the following related important papers in this area. a) DOI: 10.1109/IVS.2015.7225898 b) https://doi.org/10.1007/s11276-013-0543-7 Reviewer #2: In this paper authors performed cryptanalysis of a previously published paper. Authors figured Kazemi et al.’s scheme suffered from the un-linkability issue that leads to a forgery attack. An adversary can link two or more messages sent by the same user by applying Euclid’s algorithm and derives the user’s authentication key. To address this problem, authors encrypt the message using a shared secret key between sender and receiver and apply a Nonce in the final message to guarantee the un-linkability between disseminated messages. The work is interesting, but there are some concerns which should be addressed for the next round of review: 1. I think, there is a room to improve the English of this paper. I suggest authors to completely proof-read this paper to improve its readability. 2. I found there are two relevant schemes in VANETs authentication which have been overlooked by authors and should be discussed in the introduction and if possible should be compared with: https://ieeexplore.ieee.org/abstract/document/6576161 https://ieeexplore.ieee.org/abstract/document/7047920 These two papers are seminal in ID-based verification of VANETs and could be discussed in the introduction section also to give a clear background of the research work. 3. The digital authentication field has revolutionized during the last 2 decades and there are so many new innovations by using cloud and biometrics authentication. I suggest authors to discuss how privacy, cloud and biometrics have impacted the authentication field and what benefits it has brought to the automotive industry for VANETs. There are some following papers which could give a good background of it and can be discussed in the revision: https://www.sciencedirect.com/science/article/abs/pii/S1084804512001890 https://www.sciencedirect.com/science/article/abs/pii/S1084804518301309 https://www.tandfonline.com/doi/abs/10.4103/0256-4602.50703 4. Its better to improve and revise the conclusion section of this paper. ****** 6. PLOS authors have the option to publish the peer review history of their article (what does this mean?). If published, this will include your full peer review and any attached files. If you choose “no”, your identity will remain anonymous but your review may still be made public. Do you want your identity to be public for this peer review?** For information about this choice, including consent withdrawal, please see our Privacy Policy. Reviewer #1: No Reviewer #2: No [NOTE: If reviewer comments were submitted as an attachment file, they will be attached to this email and accessible via the submission site. Please log into your account, locate the manuscript record, and check for the action link "View Attachments". If this link does not appear, there are no attachment files.] While revising your submission, please upload your figure files to the Preflight Analysis and Conversion Engine (PACE) digital diagnostic tool, https://pacev2.apexcovantage.com/. PACE helps ensure that figures meet PLOS requirements. To use PACE, you must first register as a user. Registration is free. Then, login and navigate to the UPLOAD tab, where you will find detailed instructions on how to use the tool. If you encounter any issues or have any questions when using PACE, please email PLOS at figures@plos.org. Please note that Supporting Information files do not need this step. https://doi.org/10.1371/journal.pone.0257044.r001
Revision 1
9 Aug 2021 Author Response Reviewer 1: Comments to the Author Several grammar mistakes of English exist in this paper, which need to be carefully checked and revised. Authors’ reply: Thanks for the referee’s comment. We have checked and revised some grammatical errors in our manuscript. In addition, we have tried our best to proofread it. The format of your paper is wrong. Please check your format for this journal using their template. Authors’ reply: Thanks for the referee’s comment. We use the template from the PLOS ONE journal’s website for our manuscript. https://journals.plos.org/plosone/s/latex. Please cite the following related important papers in this area. a) DOI: 10.1109/IVS.2015.7225898 b) https://doi.org/10.1007/s11276-013-0543-7 Authors’ reply: Thanks for the referee’s comment. Yes, we have included both “https://doi.org/10.1109/IVS.2015.7225898” and “https://doi.org/10.1007/s11276-013-0543-7” on the Introduction section and References [23] and [25]. We categorized the first article as a symmetric cryptography-based authentication scheme. Meanwhile, the other one is included as the ID-based signature scheme. Reviewer 2: Comments to the Author I think, there is a room to improve the English of this paper. I suggest authors to completely proof-read this paper to improve its readability. Authors’ reply: Thanks for the referee’s comment. We have checked and revised some grammatical errors in our manuscript. In addition, we have tried our best to proofread it. I found there are two relevant schemes in VANETs authentication which have been overlooked by authors and should be discussed in the introduction and if possible should be compared with: https://ieeexplore.ieee.org/abstract/document/6576161 https://ieeexplore.ieee.org/abstract/document/7047920 These two papers are seminal in ID-based verification of VANETs and could be discussed in the introduction section also to give a clear background of the research work. Authors’ reply: Thanks for the referee’s comment. Both papers you suggested above are important, and we also added them in References [26] and [28]. We have included both suggested articles in the Introduction section and compare them in the Security Analysis and Performance Analysis sections. In the Introduction section, both articles included an ID-based signature scheme. The digital authentication field has revolutionized during the last 2 decades and there are so many new innovations by using cloud and biometrics authentication. I suggest authors to discuss how privacy, cloud and biometrics have impacted the authentication field and what benefits it has brought to the automotive industry for VANETs. There are some following papers which could give a good background of it and can be discussed in the revision: https://www.sciencedirect.com/science/article/abs/pii/S1084804512001890 https://www.sciencedirect.com/science/article/abs/pii/S1084804518301309 https://www.tandfonline.com/doi/abs/10.4103/0256-4602.50703 Authors’ reply: Thanks for the referee's comment. Yes, we have discussed the above-suggested papers in the second and third paragraphs (Page 2) of the Introduction section. We have added references in [11], [13], and [15]. Its better to improve and revise the conclusion section of this paper. Authors’ reply: Thanks for the referee’s comment. We have rewritten the Conclusion section. Previous version: “This article has shown that Kazemi et al.’s scheme does not provide unlinkability and suffers from a forgery attack that leads to an impersonation attack. The adversary can obtain the secret parameter 〖AK〗_(u_i ) through Euclid’s algorithm by linking two or more messages msg sent by the same user u_i. To overcome these drawbacks, we have proposed our improvements to security vulnerabilities by giving the scheme an immunity to unlinkability impendency, leading to forgery and impersonation attacks.” Revised version: “In this paper, we proposed an improvement towards Kazemi et al.’s authentication scheme. Our investigation exhibited that an adversary A can derive the user’s secret parameter 〖AK〗_(u_i ) through Euclid’s algorithm property. Thus, it does not provide traceability and unlinkability, which leads to impersonation attacks. Since introducing two types of improvements, whether encrypts the message M with a shared secret key sk between sender and receiver or put a Nonce in the final message msg, we have proposed improving this scheme and making it secure.” Acknowledgement The authors would like to thank the anonymous referee for their valuable discussions and comments. Attachments Attachment Submitted filename: LIST_OF_REVISIONS_PONE-D-21-19203-Hwang.pdf https://doi.org/10.1371/journal.pone.0257044.r002
23 Aug 2021 Decision Letter - Muhammad Khurram Khan, Editor An improved efficient anonymous authentication with conditional privacy-preserving scheme for VANETs PONE-D-21-19203R1 Dear Dr. Hwang, We’re pleased to inform you that your manuscript has been judged scientifically suitable for publication and will be formally accepted for publication once it meets all outstanding technical requirements. Within one week, you’ll receive an e-mail detailing the required amendments. When these have been addressed, you’ll receive a formal acceptance letter and your manuscript will be scheduled for publication. An invoice for payment will follow shortly after the formal acceptance. To ensure an efficient process, please log into Editorial Manager at http://www.editorialmanager.com/pone/, click the 'Update My Information' link at the top of the page, and double check that your user information is up-to-date. If you have any billing related questions, please contact our Author Billing department directly at authorbilling@plos.org. If your institution or institutions have a press office, please notify them about your upcoming paper to help maximize its impact. If they’ll be preparing press materials, please inform our press team as soon as possible -- no later than 48 hours after receiving the formal acceptance. Your manuscript will remain under strict press embargo until 2 pm Eastern Time on the date of publication. For more information, please contact onepress@plos.org. Kind regards, Muhammad Khurram Khan, Ph.D. Academic Editor PLOS ONE Reviewers' comments: Reviewer's Responses to Questions Comments to the Author 1. If the authors have adequately addressed your comments raised in a previous round of review and you feel that this manuscript is now acceptable for publication, you may indicate that here to bypass the “Comments to the Author” section, enter your conflict of interest statement in the “Confidential to Editor” section, and submit your "Accept" recommendation. Reviewer #1: (No Response) ******** 2. Is the manuscript technically sound, and do the data support the conclusions? The manuscript must describe a technically sound piece of scientific research with data that supports the conclusions. Experiments must have been conducted rigorously, with appropriate controls, replication, and sample sizes. The conclusions must be drawn appropriately based on the data presented. Reviewer #1: (No Response) ****** 3. Has the statistical analysis been performed appropriately and rigorously? Reviewer #1: (No Response) ****** 4. Have the authors made all data underlying the findings in their manuscript fully available? The PLOS Data policy requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified. Reviewer #1: (No Response) ****** 5. Is the manuscript presented in an intelligible fashion and written in standard English? PLOS ONE does not copyedit accepted manuscripts, so the language in submitted articles must be clear, correct, and unambiguous. Any typographical or grammatical errors should be corrected at revision, so please note any specific errors here. Reviewer #1: (No Response) ****** 6. Review Comments to the Author Please use the space provided to explain your answers to the questions above. You may also include additional comments for the author, including concerns about dual publication, research ethics, or publication ethics. (Please upload your review as an attachment if it exceeds 20,000 characters) Reviewer #1: (No Response) ****** 7. PLOS authors have the option to publish the peer review history of their article (what does this mean?). If published, this will include your full peer review and any attached files. If you choose “no”, your identity will remain anonymous but your review may still be made public. Do you want your identity to be public for this peer review?** For information about this choice, including consent withdrawal, please see our Privacy Policy. Reviewer #1: No https://doi.org/10.1371/journal.pone.0257044.r003
Formally Accepted
1 Sep 2021 Acceptance Letter - Muhammad Khurram Khan, Editor PONE-D-21-19203R1 An improved efficient anonymous authentication with conditional privacy-preserving scheme for VANETs Dear Dr. Hwang: I'm pleased to inform you that your manuscript has been deemed suitable for publication in PLOS ONE. Congratulations! Your manuscript is now with our production department. If your institution or institutions have a press office, please let them know about your upcoming paper now to help maximize its impact. If they'll be preparing press materials, please inform our press team within the next 48 hours. Your manuscript will remain under strict press embargo until 2 pm Eastern Time on the date of publication. For more information please contact onepress@plos.org. If we can help with anything else, please email us at plosone@plos.org. Thank you for submitting your work to PLOS ONE and supporting open access. Kind regards, PLOS ONE Editorial Office Staff on behalf of Prof. Muhammad Khurram Khan Academic Editor PLOS ONE https://doi.org/10.1371/journal.pone.0257044.r004

Open letter on the publication of peer review reports

PLOS recognizes the benefits of transparency in the peer review process. Therefore, we enable the publication of all of the content of peer review and author responses alongside final, published articles. Reviewers remain anonymous, unless they choose to reveal their names.

We encourage other journals to join us in this initiative. We hope that our action inspires the community, including researchers, research funders, and research institutions, to recognize the benefits of published peer review reports for all parts of the research system.

Learn more at ASAPbio .