# Mutual Authentication Protocol for Role-Based Access Control Using Mobile RFID
## 3 System Architecture and Concept
### Mobile RFID System Architecture
#### 3.3.2 Number of Reads and Time Stamp Updating  
The reader must first be authorized by the back-end database before it is given a security certificate. Then, after certification with the back-end database, it can read the electronic tag. In this mechanism, the back-end database first verifies the reader to permit it to read the electronic tag information. The proposed method authorizes readers, and the maximum number of times one reader can retrieve tag information and the updated time stamp are not affected when other readers read the same tag, in order to increase security. Figure 5 shows the architecture for the maximum number of reads and time stamp updating. Every reader has its allocated reading amount. If a reading is requested, the allocated reading amount will decrease by 1 time. The detailed mechanism is illustrated in Figure 6.  
After receiving security authorization, the reader reads the electronic tag and the tag automatically updates the time stamp and uses the shared key to send it to the back-end database. The role-class is compared to the internal table to confirm executable commands, and the remaining number of reads is  
\begin{table}
\begin{tabular}{c p{142.3 pt}} \hline \hline \(\text{r}_{1},\text{r}_{2},\text{r}_{3}\) & Random numbers generated by the electronic tag \\  & reader and back-end database \\ \hline TID, RID & Electronic tag identification number and reader \\  & identification number \\ \hline TS\({}_{1}\)... TS\({}_{n-1}\) & Time stamp \\ \hline command & Reading command sent from reader to electronic tag \\ \hline role-class & Role and permissions \\ \hline \(\text{Cert}_{\text{R}}\) & Security certificate given to the reader by the \\  & back-end database \\ \hline TC\({}_{n}\) & Number of times \(n\) a reader can retrieve information \\ \hline K\({}_{x}\) & Shared back-end database key for an electronic tag \\ \hline K\({}_{y}\) & Shared back-end database key for a reader \\ \hline M\({}_{n}\) & Encrypted value using the shared keys K\({}_{x}\) and K\({}_{y}\) \\ \hline \hline \end{tabular}
\end{table}
Table 1: Certification mechanism symbols.  
Figure 5: The architecture for the maximum number of reads.  
sent back to the reader. After the reader is given a security certification from the back-end database and reads an electronic tag, the database notifies the reader of the remaining number of reads and the updated time stamp. These are then recorded in the back-end database. Figure 6 shows the mechanism for the number of reads and RBAC role-class certification.
* M4 and M5 are sent to the electronic tag. The tag can check the correctness of M5 using TS1 and r2 which were obtained by decrypting M4. Therefore, the tag can authenticate the reader
* One is subtracted from TC\({}_{n}\) to become TC\({}_{n-1}\)
* TS1 is verified as the initial time stamp sent from the electronic tag. If it is, it is updated to TS2
* TS2, TC\({}_{n-1}\), r2, and K\({}_{x}\) are used to create an encrypted M6, which is sent to the reader
* The reader receives M6
* K\({}_{y}\), CertR, r2, and M6 are encrypted to create M7, which is sent to the back-end database
* The back-end database receives M7
* After receiving M7, K\({}_{y}\) is used to decrypt M6, CertR, and r2. If CertR verifies the reader is authorized, K\({}_{x}\) is used to decrypt M6 to retrieve the updated time stamp TS2
* The back-end database uses K\({}_{y}\) to encrypt M8
* The reader receives M8
* The reader uses K\({}_{y}\) to decrypt TS2, TC\({}_{n-1}\) and r\({}_{2}\). r\({}_{2}\) is checked to ensure that the signal is sent from the back-end database  
We conclude the performance of Figures 4 and 6 in Table 2. The first number represents the execute times in Figure 4 and the second number represents the execute times in Figure 6.