# Novel Designated Ownership Transfer with Grouping Proof
## 2 Proposed Protocol
### Integrity Verification Phase  
After the transporter delivers the cargo to the recipient \(P^{q}\) and simultaneously generates grouping proofs by using a reader with a maximum reading capacity of \(r\), the group keys are distributed to several mobile readers from the transporters' reader \(RID_{0}\) to securely multicast messages to \(\delta q\) tags via the recipients' readers \(RID_{j}^{q}\), thus enabling each reader to receive the maximum number of tags by performing only one multicast. In other words, the grouping proof is generated using the minimum number of group keys. In this phase, the reader \(RID_{0}\) uses the distributed keys to encrypt the recipient's identification code \(PID^{q}\), ownership transfer request \(OT\), timestamp \(TS_{v}\), group key set \(RG_{j}^{q}\) for the child node reader \(RID_{j}^{q}\), and tag verification code set \(RT_{j}^{q}\), and then transmits the ciphertext until all leaf nodes are reached. For example, as shown in Figure 2, the reader \(RID_{0}\) first uses the key \(SK_{1}^{q}\) to encrypt \(PID^{q}\), \(OT\), \(TS_{v}\), \(RT_{1}^{q}=\{TH_{13}^{q},\,TH_{14}^{q},\,TH_{15}^{q},\,TH_{16}^{q}\}\), and \(RG_{1}^{q}=\{GK_{8}^{q},GK_{9}^{q}\}\), and then transmits them to the reader \(RID_{1}^{q}\), which will use the session key \(SK_{1}^{q}\) to decrypt the message, split \(RT_{1}^{q}\) and \(RG_{1}^{q}\) and, accordingly, encrypt \(PID^{q}\), \(OT\), \(TS_{v}\), \(RT_{7}^{q}=\{TH_{13}^{q},TH_{14}^{q}\}\), \(RG_{7}^{q}=\{GK_{8}^{q}\}\), \(PID^{q}\), \(OT\), \(TS_{v}\), \(RT_{8}^{q}=\{TH_{15}^{q},\,TH_{16}^{q}\}\), and \(RG_{8}^{q}=\{GK_{9}^{q}\}\) into separate messages by using the session keys \(SK_{7}^{q}\) and \(SK_{8}^{q}\), and send them to the leaf node readers \(RID_{7}^{q}\) and \(RID_{8}^{q}\). Subsequently, the encrypted messages will be distributed to the corresponding tags. The leaf reader will then collect pieces of proof from the tags, which will be transmitted back to the upper levels and then to reader \(RID_{0}\) to generate a grouping proof, as shown in Figure 3.  
**[Message 1]** After receiving the encrypted message from \(RID_{0}\), the reader \(RID_{k}^{q}\) proceeds to decrypt the message using the session key \(SK_{j}^{q}\). Then, depending on the child node, \(RID_{k}^{q}\) splits \(RT_{j}^{q}\), and \(RG_{j}^{q}\). Furthermore, \(RID_{k}^{q}\) encrypts \(PID_{k}^{q},OT,TS_{v},TSC,RT_{j}^{q}\), and \(RG_{j}^{q}\) by using the child node session key \(SK_{j}^{q}\) as message \(F_{j}\) then transmits to \(RID_{j}^{q}\). **[Message 2]** Upon receiving the encrypted message \(F_{j}\) from \(RID_{k}^{q}\), the leaf node reader \(RID_{j}^{q}\) uses its session key \(SK_{j}^{q}\) to decrypt the message. The multicast message \(MG_{j,s}^{q}\) is constructed, encrypted using the group key \(GK_{s}^{q}\) along with \(PID^{q},OT,TS_{v}\), and \(TSC\), and then transmitted to the corresponding tags to generate pieces of proof. **[Message 3]** When any tag \(TID_{i}^{q}\) receives a multicast message \(MG_{j,s}^{q}\), the tag will proceed to decrypt the message by using the shared key \(Kt_{i}^{q}\), and then verify whether the decrypted message contains the correct \(PID^{q}\) and ownership transfer request \(OT\). When the verification is correct, the shared key \(Kt_{i}^{q}\) is then employed to compute the pieces of proof \(M_{j,i}^{q}\) along with the tag \(TID_{i}^{q}\), a randomly generated number \(Nt_{i}^{q}\), and a timestamp (if offline then \(TSC\) else \(TS_{v}\)). Subsequently, a message verification code  
Figure 2: One group key. \(V_{j,i}^{q}\) is computed for the reader \(RID_{j}^{q}\) to verify the tag by using the hashing value \(H(TID_{i}^{q}\|Kt_{i}^{q}\|TS_{v})\), the shared key \(Kt_{i}^{q}\), the timestamp \(TS_{v}\), pieces of proof \(M_{j,i}^{q}\), and a random number \(Nt_{j,i}^{q}\).