Research Article
Cloud-Based RFID Mutual Authentication Protocol without
Leaking Location Privacy to the Cloud
Qingkuan Dong, Jiaqing Tong, and Yuan Chen
State Key Laboratory of Integrated Services Networks, Xidian University, Xi’an, Shaanxi 710071, China
Correspondence should be addressed to Jiaqing Tong; tjq@sina.cn
Received April ; Revised July ; Accepted July
Academic Editor: Zongming Fei
Copyright © Qingkuan Dong et al. is is an open access article distributed under the Creative Commons Attribution License,
which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
With the rapid developments of the IoT (Internet of ings) and the cloud computing, cloud-based RFID systems attract more
attention. Users can reduce their cost of deploying and maintaining the RFID system by purchasing cloud services. However, the
security threats of cloud-based RFID systems are more serious than those of traditional RFID systems. In cloud-based RFID systems,
the connection between the reader and the cloud database is not secure and cloud service provider is not trusted. erefore, the
users have to encrypt their data stored in the cloud database to prevent the leakage of privacy. In addition, the reader’s location
privacy should be protected to avoid its leak to the cloud provider. In this paper, a cloud-based RFID mutual authentication protocol
without leaking location privacy to the cloud is proposed. It provides real-time mutual authentication between the reader and the tag
and protects the reader’s location privacy by introducing the location privacy cloud. Compared with traditional backend-server-
based schemes and serverless schemes, the proposed scheme has obvious advantages in deployment cost, scalability, real-time
authentication, and the tag’s computational complexity.
1. Introduction
RFID (radio frequency identication) is a key technology of
the IoT for identifying the objects in a noncontact way. It
is widely used in the elds of manufacture, retail, medical
treatment, transportation, tracking, and location because the
RFID tag is low in price, small in size, and easy to take.
Besides, massive tags can be read simultaneously compared
with bar codes. However, once the object is labeled a tag,
the data privacy and the owner’s location privacy would
be threatened. So the owner’s location privacy and security
protection are the prerequisites for popularizing the RFID
technology.
e traditional RFID system is composed of tags, readers,
and a backend database, as seen in Figure . e reader
activates the tag by sending the RF signals to communicate
and exchange information with it in a noncontact way and
submits the relevant data to the backend database. ere
are a lot of authentication schemes under this architecture
[–]. ese authentication schemes always assume that
there is a secure backend server and the link between the
reader and the backend server is reliable. For instance, Wei
et al. [] proposed a mutual authentication protocol based
on hash function and Dong et al. []proposedamutual
authentication protocol based on SHA-. In their schemes,
the backend server needs to search the matching records
by computing hash function; the computing ability of the
backend server will be the bottleneck of the system. He et al.
[]proposedanECCbasedauthenticationschemeinwhich
the tag needs to compute scalar multiplication over the
elliptic curve, so it does not satisfy the requirements of the
lightweight tag. What is worse is that the backend-server-
based architecture limits the mobility of the reader and the
cost of deploying and maintaining the backend server is high.
e serverless architecture consists of three kinds of
entities: readers, tags, and a Certicate Authority (CA).
Readers authenticate tags via the help of online CA, as seen
in Figure . Each tag registers in the CA and each authorized
reader downloads the Access List (AL) from the CA through a
secure channel during the initialization process. For example,
Lee et al. [] proposed a serverless RFID authentication and
search protocol. Hoque et al. [] proposed enhancing privacy
Hindawi Publishing Corporation
International Journal of Distributed Sensor Networks
Volume 2015, Article ID 937198, 9 pages
http://dx.doi.org/10.1155/2015/937198