A Lightweight and Secure Authentication Protocol for Mobile Radio Frequency Identification Systems Using Quadratic Residue Theory

Radio frequency identification (RFID) systems are increasingly used in applications such as supply-chain tracking, mobile commerce, pervasive computing, and smart healthcare. However, the highly constrained nature of RFID systems in dynamic and insecure environments creates significant challenges for designing authentication mechanisms that are both secure and efficient. In addition, Mobile RFID environments face strict constraints on energy, computation, and storage, making traditional security mechanisms unsuitable. To address these limitations, this work introduces a lightweight and secure authentication protocol tailored specifically for mobile RFID systems. The protocol leverages minimal cryptographic primitives, optimized message flows, and dynamic session parameters to reduce computational load, communication overhead, and energy consumption. At the same time, it ensures strong server-mediated authentication between mobile readers and RFID tags—with the back-end server acting as a trusted third party—and supports key-updating mechanisms that protect long-term privacy. The design mitigates a wide range of threats, including desynchronization attacks, replay attacks, and tag impersonation, while maintaining compatibility with the low-power hardware commonly found in RFID tags. The security validation of the proposed RFID authentication protocol was performed through both informal and formal analysis to provide comprehensive assurance of its resilience against potential attacks. Informal security analysis demonstrates that the proposed protocol achieves robust resistance to known attacks, preserves tag anonymity, and provides forward security—all without relying on heavy cryptographic operations. In order to validate these security properties, formal verification was conducted using Scyther and ProVerif, two widely recognized automated security verification tools. Performance evaluation further shows that the protocol outperforms existing schemes in terms of execution time, memory usage, and communication cost, making it a practical solution for real-world mobile RFID deployments.