# Novel Designated Ownership Transfer with Grouping Proof
## 2 Proposed Protocol
### Ownership Transfer Phase  
Once the verifier confirms that there are no problems with the proof received from reader \(RID_{0}\), it generates new ownership by shared key \(Ky_{j}^{q}\) for the recipient's tag, as shown in Figure 5.  
Figure 4: Affirming tags and proofs signed by both sides and verifying time constraint.  
**[Message 9]** The verifier uses the tag's current shared key \(Ky_{j}^{q^{\prime}}\) and the random number \(Nt_{i}^{q}\) previously generated by the tag to compute the new ownership by shared key \(Ky_{i}^{q}=E(Ky_{i}^{q^{\prime}},Nt_{i}^{q})\). Subsequently, two encrypted messages are generated using the recipient's public key \(PK^{q}\) and the tag's shared key \(Kt_{i}^{q}\). The encrypted message \(M_{k}^{q}\) consists of the recipient identification code \(PID^{q}\), new ownership by shared key \(Ky_{i}^{q}\), tag's identification code \(TID_{i}^{q}\), and the new timestamp \(TS_{v}\), whereas \(M_{i}^{q}\) consists of the new ownership by shared key \(Ky_{i}^{q}\) and the tag's identification code \(TID_{i}^{q}\). Moreover, a new set of group keys \(G_{0}^{0}\) is generated and transmitted to the reader \(RID_{0}\) along with \(TS_{v}\), \(M_{k}^{q}\), and \(M_{i}^{q}\).  
After receiving the transmitted message from the verifier, the reader \(RID_{0}\) proceeds to encrypt the message \(M_{i}^{q}\) by using the session key \(SK_{j}^{q}\) along with \(PID^{q}\) and the group key \(GK_{0}^{0}\) as the encrypted message \(F_{i}\). Both encrypted messages \(M_{k}^{q}\) and \(F_{i}\) are simultaneously transmitted to the recipient's tags and reader \(RID_{k}^{q}\).  
**[Message 10]** Once the recipient's tag receives the encrypted messages from reader \(RID_{0}\), the recipient's tag decrypts the message to verify whether \(PID^{q}\) is correct. If the verification is successful, the recipient's tag updates the current ownership by shared key \(Ky_{i}^{q^{\prime}}\) with the new ownership by shared key \(Ky_{i}^{q}\), as shown in Figure 6.  
**[Message 11]** After receiving the encrypted message from \(RID_{0}\), the reader \(RID_{k}^{q}\) proceeds to decrypt the message by using the session key \(SK_{j}^{q}\). Depending on the child node, \(RID_{k}^{q}\) splits \(RG_{j}^{q}\) (refer to  
Figure 5: Acquiring the new ownership of shared keys from the verifier.  
Figure 6: Updating ownership by shared keys.  
Figure 2) accordingly and then encrypts \(PID^{q}\), \(TS_{v}\), \(M_{t}^{q}\), and \(RG_{j}^{q}\) by using the child node session key \(SK_{j}^{q}\) as message \(F2_{j}\) and then transmits it to the reader \(RID_{j}^{q}\).  
**[Message 12]** Upon receiving the encrypted message \(F2_{j}\) from \(RID_{k}^{q}\), the leaf node reader \(RID_{j}^{q}\) uses its session key \(SK_{j}^{q}\) to decrypt the encrypted message. All group keys in \(RG_{j}^{q}\) are extracted, and the multicast message \(MG2_{j,s}^{q}\) is encrypted by using the group keys \(GK_{s}^{q}\) along with \(PID^{q}\), \(TS_{v}\), and \(M_{t}^{q}\) and then transmitted to each tag.  
**[Message 13]** When any tag \(TID_{i}^{q}\) receives a multicast message \(MG2_{j,s}^{q}\), the tag will proceed to decrypt the message by using the shared key \(Kt_{i}^{q}\) and then determine whether the decrypted message contains the correct \(PID^{q}\). If \(PID^{q}\) is correct, the message \(M_{t}^{q}\) is decrypted to retrieve the tag \(TID_{i}^{q}\) for further confirmation. When the message is successfully authenticated, the tag updates its current ownership by shared key \(Ky_{i}^{q^{\prime}}\) with the new ownership by shared key \(Ky_{i}^{q}\), thus effectively completing the ownership transfer protocol.