969

Sensors and Materials, Vol. 31, No. 3 (2019) 969–979
MYU Tokyo
S & M 1828

Improved Privacy-preserving Authorized Out
Authentication Protocols
Jinbin Zheng1* and Fangguo Zhang2,3
1School of Mathematics and Information Engineering, Longyan University, Longyan, Fujian, China
2
School of Data and Computer Science, Sun Yat-sen University, Guangzhou 510006, China
3
Guangdong Provincial Key Laboratory of Information Security, Guangzhou 510006, China(Received November 23, 2018; accepted March 4, 2019)

Keywords: radio frequency identification (RFID), authorization, privacy-preserving authorization,authentication protocol

With wide applications of the radio frequency identification (RFID) technology in areas
such as the supply chain, warehouse management, and so on, the privacy and security of RFID
gradually become one of the hot topics. RFID privacy and security authentication protocols
have been proposed to suit different scenarios. In 2014, the Alert Response Address (ARA)
protocol based on the application scenario of a privileged membership club was presented, theformal definition of its privacy and security models was described, and the tag and reader’sprivacy were preserved. In this study, we analyze the efficiency of the ARA scheme andfind that it is not very good because the scheme overuses bilinear maps. Under the premiseof without losing the ARA scheme’s privacy and security, we improve its two subprotocols,
IARA1 and IARA2, with higher performance in the ARA protocol. The results show thatthe improved protocol is more efficient than the ARA protocol through the performancecomparison of the protocols.

1.

Introduction

Radio frequency identification (RFID) technology is widely used in today’s intelligent
logistics and management supply chain, manufacturing and assembly, ticket management andwarehouse management, and other systems, and is a very common and effective technology. In
the RFID system, users’ personal information, hobbies, and the like can be linked by the unique
identification code of the tags themselves, and the privacy leakage of the RFID system may becaused. At the same time, tags should not disclose any sensitive information to unauthorized
readers, for which system security issues must be taken into account. Therefore, when
designing and using the RFID system protocol, how to ensure that only authorized readers canidentify legitimate tags and how to prevent attackers from malicious attacks, such as tracking,intercepting, and leaking to protect the privacy of users’ information and ensure the security ofthe system, should be considered.
*

Corresponding author: e-mail: jbzheng518@163.com
https://doi.org/10.18494/SAM.2019.2221
ISSN 0914-4935 © MYU K.K.
https://myukk.org/

970

Sensors and Materials, Vol. 31, No. 3 (2019)

To resolve the privacy and security issues of the RFID system, many related RFID
authentication protocols, such as LAMP,(1) LAMP + l,(2) SASI,(3) Gossamer,(4) AFMAP,(5) andRAPP(6) protocols, have been proposed. These protocols are authenticated by the introductionof the IDS (index-pseudonym), which is used to store a corresponding index in the tag
information record, and each tag is associated with a key K. These solutions are based on theassumption of a secure communication of a back-end information channel that can only be used
to perform simple binary bit operations, and most of the solutions are applied to the security
certification of lightweight and ultra-lightweight RFID systems. In 2008, Tan et al.(7) proposed
an RFID security authentication protocol without a back-end database. In this protocol, it isassumed that the information channel between the reader and the certification agency (CA)is secure, and the reader must download the tag-related information from the third-party CA
to the device in the form of the access list L. Then, the protection of private information of
the tag in the list L is implemented by a one-way hash function, and the authentication of the
tag is realized. The protocol realizes functions such as antiprivacy disclosure, anticloning,
antitracking, and antieavesdropping. In the same year, Ahamed et al.(8) proposed a lightweight
RFID security search protocol without a back-end database for readers to search for a specified
tag in a set of tags. On the other hand,(9) Lee et al.(9) pointed out that Tan et al.(7) only realized
the one-way authentication of the tag by the reader, not the authentication of the reader by thetag. Once the mobile terminals of readers are stolen, the tag information will face the threatof being leaked. Therefore, they proposed a protocol to enhance authentication security andpointed out that the protocol could also resist attacks, such as privacy disclosure, cloning,
tracking, and eavesdropping, and has better security than the previous protocol. To reduce thecalculated amount of the authentication protocol indicated in Ref. 7 to improve its efficiency
and meet the same security requirements, Lin et al. proposed a lightweight RFID authenticationand search protocol without a back-end database.(10) However, with the widespread use of theInternet of Things and the rapid development of cloud computing, cloud servers tend to replace
RFID-specific back-end servers with their advantages of large storage capacity, abundantresources, and strong computing power. For example, Chen et al.(11) used a cloud database to
reduce the complexity of search and avoid data inconsistency, thus proposing an RFID privacy
protection authentication protocol. Kardas et al.(12) proposed a cryptographic protocol based ona symmetric key using cloud computing. In order to realize the identification of tags by fixed
or mobile readers anytime and anywhere, Xei et al.(13) proposed a cloud-server-based RFID
authentication protocol and pointed out that the protocol could provide large-scale backgroundresource services with better robustness. Kiraz et al.(14) explored a two-way authentication
protocol for RFID systems based on trusted cloud providers.
The corresponding RFID authentication protocols are required to be implemented indifferent application scenarios because of the different needs of enterprises. In 2014, Li et al.(15)
proposed the Alert Response Address (ARA) protocol based on the application scenarios ofclub members’ consumption and gave formal definitions of system privacy and security model,
which realized the privacy protection of tags and readers. In this study, on the basis of thesystem model of the ARA protocol, the ARA protocol, referred to as the IARA protocol, wasimproved without any loss of privacy and security. The results showed that the improved IARA

Sensors and Materials, Vol. 31, No. 3 (2019)971

protocol had a higher operating efficiency by analyzing and comparing the efficiencies of the
ARA and IARA protocols.
In Sect. 2 of this paper, we provide a brief introduction of the prerequisites for the privacy
and security of the RFID system. In Sect. 3, we mainly describe the specific certification
process of the ARA protocol proposed by Li et al.(15) In Sect. 4, we detail the authentication
process for the improved IARA protocol proposed in this paper. In Sect. 5, we show that the
IARA protocol is more efficient than the ARA protocol through performance analysis andcomparison. Finally, in Sect. 6, we provide the conclusion.

2.

Prerequisites

2.1

Composition and security model of RFID system

Usually, an RFID system generally consists of the following three major components: RFID
tag (tag or transponder), RFID reader (reader or transceiver), and back-end database (back-end
server),(16) as shown in Fig. 1. It is generally assumed that a tag does not have the ability toprevent tampering and destruction, and attackers can damage the tag and obtain all the secret
information stored in the tag; at the same time, the tag has limited storage and computing
resources. Public key cryptosystems generally do not apply to the tag, which can perform
operations such as hash function and pseudorandom number generation. However, a reader
is a device with relatively strong computing and storage capabilities, and can perform more
complete cryptographic operations. The back-end server, as a storage device, stores all relevant
information(17) about the tag in the system. In addition, in the design of an RFID system, thereader and back-end database are generally regarded as a whole, and the internal communication
between them is assumed to be secure; on the other hand, the public wireless communication
channel between the tag and the reader is unsafe, which may suffer from various active or
passive attacks.
The security of an RFID system should meet the following requirements:

Fig. 1.

(Color online) Components of RFID system.

972

Sensors and Materials, Vol. 31, No. 3 (2019)

1. Forward privacy: In a forward secure game, adversary A can obtain the current key of thereader and attempt to distinguish whether the currently authenticated tag has interacted with1
the server or other readers. If no adversary can win the game with the probability of + ε (ε2is a negligible function), then the system is considered to meet forward privacy.￼
2. Backward privacy: In a backward security game, after the reader updates the key, adversary
A attempts to determine whether any tag has interacted with the server or other readers
1
after that. If no adversary can win the game with the probability of + ε (ε is a negligible2function), then the system is considered to meet backward privacy.
3. Readers’ privacy: In the privacy security game of the reader, adversary A can obtain theserver’s key and try to determine which registration tag is authenticated at the moment. If
the probability that adversaries win the game is negligible, then the system is considered tomeet readers’ privacy.
4. Unforgeability security: In the unforgeability security game, adversary A can obtain the keysof the server and reader, and try to forge the output information of a certain tag for passing
the authentication of the system during the authentication phase. If the probability thatadversaries win the game is negligible, then the system is considered to be unforgeable orsecure.
To describe the operations that adversary A and challenger C can perform in a secure game,
Li et al. abstractly proposed a type of Oraclas program for calling(15) and gave a formalized
definition of the RFID system security model. Detailed definitions and certifications are shown
in Ref. 15.
2.2

Definition and properties of bilinear map

Suppose G and GT are cyclic groups whose order is prime q, and g is the generator of group G;
then, ê : G × G → GT is called a bilinear map, with only the following three properties:(18)(1) Bilinearity: ê (ua, vb) = ê (u, v)ab, in which u, v ∈ G, a, b ∈ ℤq;(2) Computability: For any u, v ∈ G, bilinear map ê (u, v) is valid and computable;(3) Nondegeneration: If g is a generator of G, then ê (g, g) is a generator of GT.

3.

ARA Protocol Described by Li et al.

To protect the personal privacy of privileged members in the club, a new authorization
protocol, referred to as the ARA protocol, was proposed.(15) The significant differences
between this protocol and many of the previous authentication protocols are as follows: forconsistency, reader R and background server S are relatively independent; reader R should be
authorized by background server S before tags can be authenticated; in the process of reader R
authenticating tag T, background server S does not know the information of tag T. Li et al.(15)
divided the ARA protocol into three subprotocols P1, P2, and P3, according to the degree ofprotection of privacy information of tags; in this paper, we will not discuss P1 further because

Sensors and Materials, Vol. 31, No. 3 (2019)973

it only basically realizes the members’ privacy protection, but it is mainly for the briefing andimprovement of P2 and P3.
3.1

Algorithm description of ARA protocol

The authentication process of the ARA protocol mainly consists of four algorithms, as
shown in Table 1.
3.2

P2 and P3 of the ARA protocol

The authentication of the P2 and P3 of the ARA protocol can be divided into two stages:
The first stage is the tag registration or parameter initialization stage, that is, when the tag isregistered, the server issues a series of public information such as the server public key, andthe tag selects the required public information according to its own needs for initialization.
When the membership card is activated, the public key of the tag is sent to the server, and theprivate key is reserved by the tag itself. Then, the server authorizes the reader, that is, theserver assigns a deadline key to the corresponding reader, and once the deadline of the key has
expired, the reader no longer has the authority of tag authentication; the second stage is thatthe reader authenticates the tag, in which the reader and server must work together to confirm
whether the tag has been registered and legal.
In the P2 and P3 of the ARA protocol, a multiplicative cyclic group whose order is prime p
is denoted by G and GT; g, h ∈ G are two different generators of G, and x , α ∈ Z q* are bilinear
maps associated with the cyclic group. γ , x , α ∈ *p, TR is a collection of tags. Assume thatH 2 :{0,1}* → *p is a hash function that maps an arbitrary bit string to a multiplicative cyclic

group in the number field ℤp, and H3: {0,1}*→ G is a hash function that maps an arbitrary bit
string to the cyclic group G. The specific authentication processes for the P2 and P3 of the
ARA protocol are shown in Figs. 2 and 3, respectively. The authentication steps are shown in
Ref. 15.

4.

Improved Protocol

Li et al. proposed the ARA protocol for the application scenario of a privileged member
club,(15) which realized the privacy protection of authorized RFID. On the basis of the ARA
Table 1Main description of ARA protocol.
Algorithm name Input parameters Output parameters
ServerKeyGen()(k)
Generate public and private key pair of the server: (PK , SK).
TagkeyGen()(t, k)
Generate public and private key pair of the tag: (pk, sk).
Generate public and private key pair of the reader: (rpk, rsk).
({pki}, TR , sk, R)
ReaderAuth()
Send rsk to the server and send rpk to the reader.
The reader authenticates the tags; if passed, the corresponding tag identifier T(sk, PK, rsk, rpk)
Auth()
is output; otherwise, the algorithm is terminated.

974

Sensors and Materials, Vol. 31, No. 3 (2019)

Tag T
x

α

Server S({γ , (Ti , g ) : Ti ∈ Τ R })(γ , α , Τ R ,{g xi })xi( g , x, g , g )
B, γ
←


*
p

r∈

Reader R
B ∈G

ω = H 2 (gα r )s = H 2 (ω , g x , B, γ )C1 = H 2 ( s )1

C2 = g x + s
C1 , C2 , C3→C3 = g r

B , C3
→ if ∈ Τ R , computes( B, C1 , C2 , C3 )

ω ′ = H 2 (C3α )Vi = H 2 (ω ′, g xi , B, γ ){(Ti ,Vi ,U i ):Ti ∈Τ R }←
 U i = H 2 ( Vi )Outputs Ti if

C1 = U i and eˆ(C2 , g xi +Vi ) = eˆ( g , g )Fig. 2.

Specific authentication process of ARA protocol 2.

Tag T
x

α

r, s ∈*pγ(g , h )Reader R

Server S

α xi γ(hα , γ , g γ )({g , (Ti , hγ

B, g←
) : Ti ∈ Τ R })B∈G

C1 = g x r sr

C2 = g , C3 = hαs1

C4 = H 3 ( B, g γ , C1 , C3 ) r

1

C1 ,C2 ,C3 ,C4 ,C5
C5 = H 3 ( B, g γ , C4 , C3 ) s 
→ A = H 3 ( B, g γ , C1 , C3 )eˆ(C2 , C4 ) = eˆ( g , A)

B , C3 , C4 , C5
→ A′ = H 3 ( B, g γ , C4 , C3 )eˆ(C3 , A′) = eˆ(hα , C5 )eˆ(V , g ) = eˆ(C3 , g γ )V← V = C3γαxγeˆ(V , C1 ) = eˆ(h i , C2 )Fig. 3.

Specific authentication process of ARA protocol 3.

system model, under the premise of without losing its privacy and security, for the P2 and P3of the ARA protocol, we proposed two more efficient optimization protocols in this paper,
namely, the improved IARA protocols, referred to as IARA1 and IARA2.

Sensors and Materials, Vol. 31, No. 3 (2019)

4.1

975

Authentication process of IARA1
Let G, GT be a cyclic group whose order is prime p, x,α ∈ Z q* a bilinear map associated withthe cyclic group, and g the generator of G. H1: {0,1}*→ {0,1}n is a hash function (such as SHA1) that maps an arbitrary bit string to a fixed bit string. The protocol process is described asfollows.
4.1.1

Initialization phase(1) ServerKeyGen(): Select α ∈ *p randomly and calculate (PK, SK) = (gα, α) as the public andprivate keys of server S;(2) TagKeyGen(): Select x ∈ *p randomly and calculate (pk, sk) = (gx, x) as the public andprivate keys of tag T; tag T is stored as (g, sk, pk, PK). The public key of server S for storingtag T is pk;(3) ReaderAuth(): To authorize reader R to verify tag set TR, server S randomly selects that andstores it as γ ∈ *p. The reader stores rpk = (γ, TR).

4.1.2

Stage of the reader authenticating tags

Algorithm Auth() for readers authenticating tags: During the execution of the algorithm, thespecific process of interactive authentication among the tag, the reader, and the server is shownin Fig. 4.
4.2

Authentication process of IARA2

Following the symbolic description of the IARA protocol in the previous text, h is thegenerator of G and h ≠ g. The authentication process of IARA2 is described as follows.

Fig. 4.

The specific authentication process of IARA1 protocol.

976

Sensors and Materials, Vol. 31, No. 3 (2019)

4.2.1

Initiation phase(1) ServerKeyGen(): Select α ∈ *p randomly and generate the public and (PK, SK) = (hα, α)private key pair corresponded by server S;*(2) TagKeyGen(): Randomly select the parameters x ∈  p and generate the (pk, sk) = (hx, gx)
public and private key pair corresponded by tag T. Tag T stores the information (g, sk, pk,
PK) and server S stores the public key pk of tag T;(3) ReaderAuth(): To authorize reader R to verify tag set TR, server S randomly selects and storesγ ∈ *p , and calculates gγ. For each tag Ti ∈ TR, the corresponding (h xi )αγ is calculated.
αxγ
γ=
Reader
R stores rpk ( g ,{(Ti , h i ) : Ti ∈Τ R }).

4.2.2

Stage of tag authentication by the reader

Algorithm of the reader authenticating tag Auth(): The specific process of interactive
authentication among the tag, the reader, and the server is shown in Fig. 5.
(1) Reader R randomly selects b ∈ {0,1}l and sends (b, gγ) to tag T.
*(2) Tag T randomly selects t wo values r , s ∈  p , f ig ures out C1 = H1(ê( g γ,h) s) andsx
C2 = H1(C1, b, r, g ), and sends (r , C2 , g ) as a response value to reader R;

γ

s

s

(3) After reader R receives the tag feedback information (r , C2 , g x ) , it sends g x to server S;s(4) Server S calculates V = g xα and returns V to reader R;
α xi γ)), b, r , g γ ) === C2 one by one for the stored
α xiγ
α xiγ
) that satisfies the equation, indicating). If there is a data pair (Ti , hinformation (Ti , hthat there exists a tag that has been registered with server S and is legal, the corresponding
legitimate tag identifier Ti is output; otherwise, the authentication process is terminated.

(5) Reader R calculates and judges H 3 ( H 3 (eˆ(V , hFig. 5.

The specific authentication process of IARA2 protocol

Sensors and Materials, Vol. 31, No. 3 (2019)

5.

977

Protocol Analysis and Comparison

Li et al. performed an efficiency analysis for the P2 and P3 of the ARA protocol.(15) To
illustrate that the improved protocol in this paper is more efficient than the protocol proposedby Li et al. in this section, performance analysis, comparison, and security descriptions are
performed for IARA1, IARA, P2, and P3.
5.1

Performance analysis and comparison

The operating efficiency of this protocol scheme is mainly reflected in the reader computing
load and server computing load, and the communication traffic depends on the number of bitsof data transmitted between the reader and the server. The following is a performance analysis
for the calculated amount at the reader and server sides and the traffic between the reader andthe server for IARA1 and IARA2:
Without loss of generality, we assume that the difference in operational efficiency between
different hash functions is negligible, and in the efficiency analysis, the running time of any
hash function is represented by H. G is used to indicate the time of the group operation. ê isused to represent the operation time of the bilinear pair. The number of bits of any element X isrepresented by |X|.
1. Calculated amount at the reader side: In IARA1, the reader only needs to compare C = Cionce for the Ci returned by the server, so the calculated amount of the reader is O(1).
Compared with the protocol P2, the reader needs to execute the group element and bilinear
mapping operation, and the execution efficiency of the protocol reader is significantly
improved.
2. Calculated amount at the server side: The information α and g xi have been prestored at
the server side, and g α xi can be obtained by precalculation. When Ci = H1 ( g α xi , r , b, γ ) is
calculated, only the H hash operation is completed once; thus, when the number of tags isn, the calculated amount of the server is nH. The execution efficiency is also significantly
higher than G + (2n + 1)H in the computation of the P2 of the ARA protocol.
3. Communication traffic: According to the assumption of the P2 of the ARA protocol, thereader has prestored the tag information Ti ∈ TR, and the server does not consider thetransmission of Ti when transmitting the data to the reader, so only the data set {Ci} shouldbe transmitted. When there are n tags, the traffic of the IARA1 is nba, which saves halfof the data transmission amount compared with that of the P2, so IARA1 has a higher
operating efficiency.
According to the efficiency analysis result of IARA1, the efficiency analysis result of IARA2
can also be obtained as well. The results of the efficiency analysis and comparison between the
improved IARA protocol proposed in this paper and the ARA protocol proposed by Li et al. areshown in Table 2. The results of the analysis higher than that of the previous ARA protocol are
shown in Table 2.
In fact, the performance analysis in Ref. 15 is incorrect, taking P2 as an example. The
calculated amount of P2 should not be G + 2nH at the server side but G + (2n + 1)H. The

978Sensors and Materials, Vol. 31, No. 3 (2019)

Table 2
Performance comparison between ARA and IARA protocols.
ProtocolCalculation at reader side Traffic Calculation at server side
G + (2n + 1)H
P2
G+ê
P3
(n + 5)ê
|G|
G + 2ê
IARA1
O(1)
nH
|G|
G
IARA2
nê

Table 3
Security analysis between ARA and IARA protocols.
Protocol
P2
P3
IARA1
IARA2

Forward Backward Reader Unforgeability
Constant level
privacy privacy privacyof tags
communication cost
√
√
√
√

√
√
√
√

√
√
√
√

√
√
√
√

×
√
×
√

ConstantTaglevel reader
performanceauthentication cost
√
H
×
H, PK
√
H
×
H, PK

Note: √: may solve the security problem; ×: cannot solve the security problem; H: need to complete the hashoperation; PK: need to complete the ECC operation.

calculated amount of P3 should not be (n + 1)ê at the reader side but (n + 5)ê. The calculated
amount of P3 should not be G + ê at the server side but G + 2ê.
5.2

Security analysis

The ARA protocol constructs a privacy and security model based on the adversary challenge
and Oracle machine definition, and assumes that the communication channel between thereader and the server is secure, and then analyzes that the protocol can prevent the leakage ofthe privacy information of tags and has forward privacy, backward privacy, and unforgeabilityof tags. Since the construction method for the privacy and security model of the IARA protocol
is the same as that for the ARA protocol, specific proof is found in Ref. 15. Therefore, theIARA protocol has the same privacy and security as the ARA protocol, as shown in Table 3.

6.

Conclusion

On the basis of the system model of the ARA protocol, we provide the definition of RFID
system security in this paper. By describing the authentication processes of the P2 and P3 of
the ARA protocol, we propose two subprotocols, IARA1 and IARA2, with higher performance,and calculate and analyze the calculated amount at the reader side, the calculated amount at theserver side, and the traffic between the reader and server sides. Without losing its privacy andsecurity, we compared and analyzed the performance and security before and after the ARA
protocol was optimized. The results show that the improved IARA protocol is more efficientthan the ARA protocol.

Sensors and Materials, Vol. 31, No. 3 (2019)

979

References
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

P. Peris-Lopez, J. C. Hernandez-Castro, and J. M. Estévez-Tapiador: Workshop on RFID Security (2006) 12.
T. Li: Vehicular Technology Conf. (IEEE, 2008) 1.
H. Chien: Dependable Secure Comput. 4 (2007) 337.
P. Peris-Lopez, J. C. Hernandez-Castro, and J. M. E. Tapiador: Information Security Applications: 9th Int.
Workshop (2008) 23.
A. Sadighian and R. Jalili: Emerging Security Information, Systems and Technologies (IEEE, 2009) 31.
Y. Tian, G. Chen, and J. Li: IEEE Commun. Lett. 16 (2012) 702.
C. Tan, B. Sheng, and Q. Li: IEEE Trans. Wireless Commun. 7 (2008) 1400.
S. I. Ahamed, F. Rahman, and E. Hoque: Proc. 2008 2nd Int. Conf. Computer and Electrical Engineering (IEEE,
2008) 187.
C. F. Lee, H. Y. Chien, and C. S. Laih: Int. J. Commun. Syst. 25 (2012) 376.
I. C. Lin, S. C. Tsaur, and K. P. Chang: Proc. 2009 3rd Int. Conf. Computer and Electrical Engineering (IEEE,
2009) 295.
S. M. Chen, M. E. Wu, and H. M. Sun: J. Future Generation Comput. Syst. 30 (2014) 155.
S. Kardas, S. Celik, and M. A. Bingöl: IEEE 5th Int. Conf. Cloud Computing Technology and Science (CloudCom)(IEEE, 2013) 171.
W. Xie, L. Xie, and C. Zhang: IEEE Int. Conf. RFID (IEEE, 2013) 168.
M. S. Kiraz, M. A. Bingöl, and S. Kardaş: Inter. J. Inf. Security Sci. 1 (2012) 32.
N. Li, Y. Mu, and W. Susilo: Radio Frequency Identification: Security and Privacy Issues (Springer, Berlin,2014) 108.
Z. Ding, J. Li, and B. Feng: J. Comput. Res. Dev. 46 (2009) 583 (in Chinese).
S. Wang, S. Liu, and D. Chen: J. Comput. Res. Dev. 50 (2013) 1276 (in Chinese).
D. Boneh and M. Franklin: CRYPTO 2001 (Springer, Berlin, 2001) p. 213.

About the Authors
Jinbin Zheng graduated from Xiamen University in 2004. He is a college
lecturer in the School of Mathematics and Information Engineering, Longyan
University. His research interests are in the areas of information security,
RFID system anonymity, and privacy protection technology.
(jbzheng518@163.com)

Fangguo Zhang is a professor in the School of Data and Computer Science,
Sun Yat-sen University, and also a vice director of the Guangdong Provincial
Key Laboratory of Information Security. His research interests are in theareas of cryptography theory and its applications. (isszhfg@mail.sysu.edu.cn)