SEOTP: a new secure and efficient ownership transfer protocol based on quadric residue and homomorphic encryption

In systems equipped with radio frequency identification (RFID) technology, several security concerns may arise when the ownership of a tag should be transferred from one owner to another, e.g. the confidentiality of information related to the old owner or the new owner. Therefore, this transfer is usually done via a security protocol called the ownership transfer protocol. If the ownership of several things together transmitted from one owner to another during a single session, the protocol is referred to as the group ownership transfer protocol. Lee et al. recently proposed a new group ownership transfer protocol by using a cloud server, as a trusted third-party, and based on homomorphic encryption and quadratic residue. In this paper, at first, we explain some essential security attacks against this recently proposed RFID group ownership transfer protocol. The success probability of all attacks that are presented in this paper is one, and the complexities are just a run of the protocol. Zhu et al. also, to providesimultaneoustransfer of a group of tags in a multi-owner environment, proposed a lightweight anonymous group ownership transfer protocol. In this paper, we show that it suffers from a desynchronization attack. The success probability of this attack is one, and its complexity is only five runs of group ownership transfer protocol. Besides, to overcome the Lee et al.’s protocol security weaknesses, we present a new group ownership transfer protocol called SEOTP that is resistant against all known active and passive attacks, including the attacks presented in this paper. The provided security proof through informal methods and also formal methods such as Barrows–Abadi–Needham logic and the Scyther tool show the proposed protocol’s security correctness.