traditional schemes,but not computational expensive to a [2]R.K.Pateriya and S.Sharma,"The evolution of RFID security and common portable digital device.(2)Offline authentication is privacy:A research survey,"in 2011 International Conference on not achieved in the proposed scheme;however,the internet is Communication Systems and Network Technologies,CSNT 2011,June 3,2011 June 5,2011,Katra,Jammu,India,2011,pp.115-119. pervasive along with the development of mobile networks [3] C.C.Tan,et al.,"Secure and serverless RFID authentication and search today protocols."leee Transactions on Wireless Communications,vol.7,pp. 1400-1407,Apr2008. V.CONCLUSIONS [4] I.-C.Lin,et al.,"Lightweight and Server less RFID Authentication and There are more and more researchers paying attentions to Search Protocol,"in Second International Conference on Computer and the Cloud-based RFID.However,present works are Electrical Engineering Proceedings,vol 2,pp.95-99,2009. insufficient in three aspects.(1)Most of them are focused on [5] J.Y.Chun,et al.,"RFID tag search protocol preserving privacy of mobile reader holders,"IEICE Electronics Express,vol.8,pp.50-56, functionalities,lacking of considerations about security and 2011. privacy.(2)There is no research in which cloud computing is [6 C.-F.Lee,et al.,"Server-less RFID authentication and searching applied to RFID authentication schemes.(3)There is no protocol with enhanced security," International Journal of research in which classical RFID schemes are enhanced to Communication Systems,vol.25,pp.376-385,Mar 2012. meet the special security and privacy requirements of cloud- [7] W.Zhao,et al.,"Saas mode based region RFID public service based applications.Moreover,current RFID authentication platform,"in 3rd International Conference on Convergence and Hybrid schemes are inapplicable to the cloud-based scenarios.It is Information Technology,ICCIT 2008,November 11,2008-November because that,on one hand,most current schemes are backend- 13,2008,Busan,Korea,Republic of,2008,pp.1147-1154. server-based.Wired (for security)and always accessible T.A.Bapat,et al.,"Information-gradient based decentralized data management over RFID tag clouds,"in 2009 10th International connections to a intranet are assumed between readers and a Conference on Mobile Data Management:Systems, Services and backend server.This assumption is not natively tenable in Middleware,MDM 2009.May 18,2009-May 20,2009.Taipei. public cloud-based RFID applications.On the other hand, Taiwan,.2009,Pp.72-81. readers and the backend database are belong to the same [9] J.Muller,et al.,"RFID middleware as a service-Enabling small and stakeholder,therefore totally trust each other,or even as an medium-sized enterprises to participate in the EPC network,"in 2009 identical participant in the traditional protocols.On the IEEE 16th International Conference on Industrial Engineering and contrary,reader owners and the cloud provider are generally Engineering Management,IE and EM 2009,October 21,2009-October 23,2009,Beijing,China,2009,pp.2040-2043 different stakeholders as independent participants in cloud- [10]C.Dabas and J.P.Gupta,"A cloud computing architecture framework based RFID applications.Thus,privacy of tags and readers are for scalable RFID,"in International MultiConference of Engineers and required to be preserved against not only attackers but also the Computer Scientists 2010.IMECS 2010.March 17.2010-March 19. cloud provider. 010,Kowloon,Hong kong,2010,pp.441-444. [11]Z.-W.Yuan and Q.Li,"Research on data processing of RFID The proposed cloud-based scheme adds the participant of middleware based on cloud computing,"in 5th International Conference VPN agency between readers and the cloud.It provides readers on Rough Set and Knowledge Technology,RSKT 2010,October 15. with secure backend channels against attackers and anonymous 2010-October 17,2010,Beijing.China,2010,pp.663-671 accesses to the cloud.The cloud database is constructed as an [12]A.Chattopadhyay,et al.,"Web based RFID asset management solution EHT.It prevents private user data from leaking to a malicious established on cloud services,"in 2011 2nd IEEE RFID Technologies and Applications Conference,RFID-TA 2011,Collocated with the 2011 cloud provider,or to attackers when the cloud server is IEEE MTT-S International Microwave Workshop Series on Millimeter compromised.We propose the first RFID authentication Wave Integration Technologies,IMWS 2011,September 15,2011- protocol which preserves tags and readers privacy against the September 16,2011,Sitges,Spain,2011,pp.292-299. database keeper.According to comparisons with two classical [13]L.Chu and S.-J.Wu,"An integrated building fire evacuation system schemes,i.e.the backend-server-based protocol in 16],and with RFID and cloud computing,"in 7th Intemational Conference on the server-less protocol in [3],the proposed cloud-based Intelligent Information Hiding and Multimedia Signal Processing, IIHMSP 2011.October 14,2011 -October 16,2011,Dalian,China. scheme has advantages in aspects as follows.(1)The resource 2011,pp.17-20. deployment is pay-on-demand.(2)The cloud-based service is [14]D.Guinard,et al.,"Cloud computing,REST and mashups to simplify pervasive and customized.(3)The proposed scheme is well RFID application development and deployment,"in 2nd International scalable with O(1)complexity to verify a tag.(4)The Workshop on the Web of Things,WoT 2011,in Conjunction with the proposed scheme preserves mobile reader holders' protocol 9th Interational Conference on Pervasive Computing,June 12,2011 (5)The database,which is crucial for RFID security,is June 12,2011,San Francisco,CA,United states,2011. encrypted and well protected in the proposed scheme. [15]S.Subashini and V.Kavitha,"A survey on security issues in service delivery models of cloud computing,"Journal of Network and Computer The future works include:(1)designs of cloud-based Applications,vol.34,pp.1-11,2011. authentication protocols which is lightweight in accordance [16]H.-Y.Chien and C.-H.Chen,"Mutual authentication protocol for RFID with the CIG2 standard and not based on state-update;(2) conforming to EPC Class 1 Generation 2 standards,"Computer Standards and Interfaces,vol.29,pp.254-259,2007. designs of cloud-based ownership transfer protocols. [17]J.Guo,et al.,"The PHOTON family of lightweight hash functions,"in REFERENCES 31st Annual International Cryptology Conference,CRYPTO 2011, August 14,2011-August 18,2011,Santa Barbara,CA,United states, [1]I.Syamsuddin,et al.,"A survey of RFID authentication protocols based 2011,pp.222-239. on Hash-chain method,"in 3rd International Conference on [18]T.-C.Yeh,et al.,"Securing RFID systems conforming to EPC class I Convergence and Hybrid Information Technology,ICCIT 2008, generation 2 standard,"Expert Systems with Applications,vol.37,pp November 11,2008-November 13,2008,Busan,Korea,Republic of, 7678.7683.2010. 2008,Pp.559-564.traditional schemes, but not computational expensive to a common portable digital device. (2) Offline authentication is not achieved in the proposed scheme; however, the internet is pervasive along with the development of mobile networks today. V. CONCLUSIONS There are more and more researchers paying attentions to the Cloud-based RFID. However, present works are insufficient in three aspects. (1) Most of them are focused on functionalities, lacking of considerations about security and privacy. (2) There is no research in which cloud computing is applied to RFID authentication schemes. (3) There is no research in which classical RFID schemes are enhanced to meet the special security and privacy requirements of cloud￾based applications. Moreover, current RFID authentication schemes are inapplicable to the cloud-based scenarios. It is because that, on one hand, most current schemes are backend￾server-based. Wired (for security) and always accessible connections to a intranet are assumed between readers and a backend server. This assumption is not natively tenable in public cloud-based RFID applications. On the other hand, readers and the backend database are belong to the same stakeholder, therefore totally trust each other, or even as an identical participant in the traditional protocols. On the contrary, reader owners and the cloud provider are generally different stakeholders as independent participants in cloud￾based RFID applications. Thus, privacy of tags and readers are required to be preserved against not only attackers but also the cloud provider. The proposed cloud-based scheme adds the participant of VPN agency between readers and the cloud. It provides readers with secure backend channels against attackers and anonymous accesses to the cloud. The cloud database is constructed as an EHT. It prevents private user data from leaking to a malicious cloud provider, or to attackers when the cloud server is compromised. We propose the first RFID authentication protocol which preserves tags and readers privacy against the database keeper. According to comparisons with two classical schemes, i.e. the backend-server-based protocol in [16], and the server-less protocol in [3], the proposed cloud-based scheme has advantages in aspects as follows. (1) The resource deployment is pay-on-demand. (2) The cloud-based service is pervasive and customized. (3) The proposed scheme is well scalable with O(1) complexity to verify a tag. (4) The proposed scheme preserves mobile reader holders’ protocol. (5) The database, which is crucial for RFID security, is encrypted and well protected in the proposed scheme. The future works include: (1) designs of cloud-based authentication protocols which is lightweight in accordance with the C1G2 standard and not based on state-update; (2) designs of cloud-based ownership transfer protocols. REFERENCES [1] I. Syamsuddin, et al., "A survey of RFID authentication protocols based on Hash-chain method," in 3rd International Conference on Convergence and Hybrid Information Technology, ICCIT 2008, November 11, 2008 - November 13, 2008, Busan, Korea, Republic of, 2008, pp. 559-564. [2] R. K. Pateriya and S. Sharma, "The evolution of RFID security and privacy: A research survey," in 2011 International Conference on Communication Systems and Network Technologies, CSNT 2011, June 3, 2011 - June 5, 2011, Katra, Jammu, India, 2011, pp. 115-119. [3] C. C. Tan, et al., "Secure and serverless RFID authentication and search protocols," Ieee Transactions on Wireless Communications, vol. 7, pp. 1400-1407, Apr 2008. [4] I.-C. Lin, et al., "Lightweight and Server less RFID Authentication and Search Protocol," in Second International Conference on Computer and Electrical Engineering Proceedings, vol 2, pp. 95-99, 2009. [5] J. Y. Chun, et al., "RFID tag search protocol preserving privacy of mobile reader holders," IEICE Electronics Express, vol. 8, pp. 50-56, 2011. [6] C.-F. Lee, et al., "Server-less RFID authentication and searching protocol with enhanced security," International Journal of Communication Systems, vol. 25, pp. 376-385, Mar 2012. [7] W. Zhao, et al., "SaaS mode based region RFID public service platform," in 3rd International Conference on Convergence and Hybrid Information Technology, ICCIT 2008, November 11, 2008 - November 13, 2008, Busan, Korea, Republic of, 2008, pp. 1147-1154. [8] T. A. Bapat, et al., "Information-gradient based decentralized data management over RFID tag clouds," in 2009 10th International Conference on Mobile Data Management: Systems, Services and Middleware, MDM 2009, May 18, 2009 - May 20, 2009, Taipei, Taiwan, 2009, pp. 72-81. [9] J. Muller, et al., "RFID middleware as a service - Enabling small and medium-sized enterprises to participate in the EPC network," in 2009 IEEE 16th International Conference on Industrial Engineering and Engineering Management, IE and EM 2009, October 21, 2009 - October 23, 2009, Beijing, China, 2009, pp. 2040-2043. [10] C. Dabas and J. P. Gupta, "A cloud computing architecture framework for scalable RFID," in International MultiConference of Engineers and Computer Scientists 2010, IMECS 2010, March 17, 2010 - March 19, 010, Kowloon, Hong kong, 2010, pp. 441-444. [11] Z.-W. Yuan and Q. Li, "Research on data processing of RFID middleware based on cloud computing," in 5th International Conference on Rough Set and Knowledge Technology, RSKT 2010, October 15, 2010 - October 17, 2010, Beijing, China, 2010, pp. 663-671. [12] A. Chattopadhyay, et al., "Web based RFID asset management solution established on cloud services," in 2011 2nd IEEE RFID Technologies and Applications Conference, RFID-TA 2011, Collocated with the 2011 IEEE MTT-S International Microwave Workshop Series on Millimeter Wave Integration Technologies, IMWS 2011, September 15, 2011 - September 16, 2011, Sitges, Spain, 2011, pp. 292-299. [13] L. Chu and S.-J. Wu, "An integrated building fire evacuation system with RFID and cloud computing," in 7th International Conference on Intelligent Information Hiding and Multimedia Signal Processing, IIHMSP 2011, October 14, 2011 - October 16, 2011, Dalian, China, 2011, pp. 17-20. [14] D. Guinard, et al., "Cloud computing, REST and mashups to simplify RFID application development and deployment," in 2nd International Workshop on the Web of Things, WoT 2011, in Conjunction with the 9th International Conference on Pervasive Computing, June 12, 2011 - June 12, 2011, San Francisco, CA, United states, 2011. [15] S. Subashini and V. Kavitha, "A survey on security issues in service delivery models of cloud computing," Journal of Network and Computer Applications, vol. 34, pp. 1-11, 2011. [16] H.-Y. Chien and C.-H. Chen, "Mutual authentication protocol for RFID conforming to EPC Class 1 Generation 2 standards," Computer Standards and Interfaces, vol. 29, pp. 254-259, 2007. [17] J. Guo, et al., "The PHOTON family of lightweight hash functions," in 31st Annual International Cryptology Conference, CRYPTO 2011, August 14, 2011 - August 18, 2011, Santa Barbara, CA, United states, 2011, pp. 222-239. [18] T.-C. Yeh, et al., "Securing RFID systems conforming to EPC class 1 generation 2 standard," Expert Systems with Applications, vol. 37, pp. 7678-7683, 2010