# Novel Designated Ownership Transfer with Grouping Proof
## 1 Introduction  
In supply chain management (SCM), mobile radio frequency identification (RFID) has recently been widely and rapidly adopted for tracking and identifying objects. An RFID system consists of mobile readers, a back-end server that acts as a trusted third party (TTP), and tags that can be further classified into two types: active and passive. An active tag usually contains an internal power source (typically a battery) to continuously power it, thus giving it a long reading range, whereas a passive tag relies on the radio frequency energy transmitted from the reader as its power source, resulting in a shorter reading range. In SCM, passive tags are more widely used than active tags because of their lower implementation cost. In the early stages of SCM, tags were employed to store information about cargo and facilitate automated stocktaking. However, with this setup, in the later stages of SCM, increasing challenges led to a rise in cargo theft [1]. The key task under such circumstances is to identify the suspect among the supplier, transporter, and recipient based on evidence. To solve this problem, a protocol is needed to generate an undeniable proof of cargo. In 2004, [PERSON] [2] introduced the yoking-proof protocol that proves the existence of two tags within the range of an RFID reader. However, [PERSON] and [PERSON] [3] proved that this protocol is insecure, and they extended the concept into the grouping proof. [PERSON] and [PERSON]'s proposed protocolallows a single RFID reader to simultaneously prove the existence of a group of tags. The generated proof is later sent to a TTP for further verification. Based on Elliptic Curve Cryptography (ECC), [PERSON] et al. [4] proposed a privacy-preserving multiparty grouping-proof protocol in the setting of a narrow-strong attacker. [PERSON] et al. 's proposed protocol allows generating a proof that is verifiable by a trusted verifier in an offline setting, even though readers or tags are potentially untrusted. However, [PERSON] and [PERSON] [5] demonstrated that an adversary can generate a valid grouping proof in [PERSON] et al. 's protocol [4]. In addition, [PERSON] and [PERSON] introduced two formal models for yoking proofs. Based on the proposed models, they further proposed two protocols to generate sound yoking proofs. [PERSON] et al. [6] proposed a lightweight RFID grouping authentication protocol, in which one object to be authenticated is attached with a group of RFID tags. If only some of the tags are successfully authenticated, the generated proof can be used to guarantee that the object is here and trace the identities of the disabled tags. In 2016, [PERSON] et al. [7] proposed an offline two-round grouping-proof protocol. [PERSON] et al. 's proposed protocol improves tag's memory and computing performance. [PERSON] and [PERSON] [8] presented an anonymous grouping-proof with untrusted readers, in which the generated proof can be checked by the trusted verifier and the untrusted reader can recover the identifiers for missing tags, but the untrusted reader cannot generate a proof if tags are missing. In the same year, [PERSON] and [PERSON] [9] extended earlier work on grouping proofs and group codes to capture resilient group scanning with untrusted readers. [PERSON] et al. [10] adopted authenticated encryption to design a scalable grouping proof protocol with message authentication code, which provides both confidentiality and message integrity simultaneously. Each tag individually computes authenticated message, and the reader is responsible for gathering the response messages of all tags in the authentication phase. That is, [PERSON] et al. 's protocol eliminates the dependency among the tags' responses. Based on parallel mode and dynamic host configuration protocol, [PERSON] et al. [11] proposed a lightweight RFID grouping-proof protocol that adopts parallel communication mode between reader and tags. It achieves grouping-proof efficiency. When cargo is delivered to a new party, the ownership of that cargo should be transferred simultaneously.