# Novel Designated Ownership Transfer with Grouping Proof
## 2 Proposed Protocol
### Integrity Verification Phase
**[Message 4]** To verify the message integrity, a leaf node reader \(RID_{j}^{q}\) receives a response messages from the tags, the obtained \(Nt_{i}^{q}\), \(M_{j,i}^{q}\), and tag verification value \(TH_{i}^{q}=H(TID_{i}^{q}\|Kt_{i}^{q}\|TS_{v})\) transmitted from \(RID_{k}^{q}\) previously, and further, the reader computes \(V_{j,i}^{q}\). Through comparison with the message verification code \(V_{j,i}^{q^{\prime}}\) transmitted by the tags, the reader \(RID_{j}^{q}\) can block and prevent proof that is not associated with this delivery. Subsequently, the reader \(RID_{j}^{q}\) employs the XOR operation to combine all pieces of proof \(M_{j,i}^{q}\) and the verification code \(V_{j,i}^{q}\) into pieces of proof \(M_{j,0}^{q}\) and message verification code \(V_{j,0}^{q}\). The pieces of proof \(M_{j}^{q}\) generated by the reader are then computed using the shared key \(Kr_{j}^{q}\) along with the reader identification code \(RID_{j}^{q}\), and randomly generated numbers \(Nr_{j}^{q}\) and \(M_{j,0}^{q}\). Moreover, a message verification code \(V_{j}^{q}\) is also computed by hashing \(M_{j}^{q}\), \(V_{j,0}^{q}\) and \(Nr_{j}^{q}\). The session key \(SK_{j}^{q}\) is used to encrypt \(PID^{q}\), \(M_{j}^{q}\), \(V_{j}^{q}\), \(Nr_{j}^{q}\), \(M_{j,i}^{q}\), and \(Nt_{i}^{q}\) for all group member tags, and the encrypted messages are transmitted back to parent node reader \(RID_{k}^{q}\). After the parent node reader \(RID_{k}^{q}\) receives the response message \(F_{k}\) transmitted by child node reader \(RID_{j}^{q}\), the encrypted message is decrypted by using the session key \(SK_{j}^{q}\) to verify whether the message contains the same recipient \(PID^{q}\). Once the recipient is authenticated, the reader \(RID_{k}^{q}\) uses the same method as the reader \(RID_{j}^{q}\) to generate the required message, then transmit the message \(F_{\lfloor(k-1)/r\rfloor}\) to the reader at the upper level, and finally back to the reader \(RID_{0}\). As shown in Figure 4, the reader \(RID_{0}\) receives a response message from the recipient \(PID^{q}\). Figure 3: Generating grouping proofs by using a multilayered reader. **[Message 5]** Once all messages transmitted by the child node reader are verified by matching the message verification code \(V_{0}^{q}\) to reconfirm message integrity, the reader \(RID_{0}\) combines all pieces of proof received from \(RID_{k}^{q}\) into a combined proof \(M_{0,0}^{q}\). The shared key \(Kr_{0}\) is employed to generate the grouping proof \(M_{0}^{q}\) by using the identification code \(RID_{0}\), a random number \(Nr_{0}^{q}\) generated by reader \(RID_{0}\), and the combined proof \(M_{0,0}^{q}\). The grouping proof \(M_{0}^{q}\) is then transmitted to the transporter's tags to be signed. **[Message 6]** When the transporter's tags receive a request message from the reader \(RID_{0}\) to sign the grouping proof \(M_{0}^{q}\), a random number \(Na\) is generated to be used along with the transporter's private key \(PR^{a}\) to sign the grouping proof \(M_{0}^{q}\) and change it into a signed proof \(M_{a}^{q}\). The signed proof \(M_{a}^{q}\) and the random number \(Na\) are then transmitted back to the reader \(RID_{0}\). **[Message 7]** After the reader \(RID_{0}\) receives the signed proof \(M_{a}^{q}\) from the transporter's tag, the signed proof \(M_{a}^{q}\) is transmitted to the recipient's tag for signing. Using the random numbers \(Np^{q}\) generated by the recipient's tag and the private key \(PR^{q}\), the recipient uses the signing function to sign \(M_{a}^{q}\) into the signed proof \(M_{p}^{q}\). The signed proof \(M_{p}^{q}\) and a random number \(Np^{q}\) are then transmitted back to the reader \(RID_{0}\). **[Message 8]** After the reader \(RID_{0}\) receives the signed proof from both the transporter's tag and the recipient's tag, the final grouping proof \(P\) is then transmitted to the verifier.