# Lightweight NFC Protocol for Privacy Protection in Mobile IoT
## 3 Lightweight NFC Protocol for Privacy Protection in Mobile IoT
### The Proposed Protocol  
Figure 5 shows the proposed authentication protocol. The details of the protocol are as following:  
1. In order to communicate with the tag, the NFC enabled device generates a random number \(mp\), then encrypts \(mp\) with \(Kgroup\) using the \" \(\oplus\) \" operation and sends the authentication query \(Query,Kgroup\oplus mp\) to the NFC tag.
2. After the NFC tag receives the query from the phone, it gets \(mp\). Then the tag uses the group key \(Kgroup\) to encrypt the tag's identity. Then we have \(Kgroup\oplus VIDt\). In the expression \(VIDt=Kt\oplus IDt\), \(VIDt\) represents the tag's secret identity. In addition, the tag generates a random number \(mt\) and then it calculates \(Kt\oplus(mt||IDt\oplus mp)\). Lastly, the tag sends the two parts to the phone.
3. After the NFC phone receives message \(Kgroup\oplus VIDt||Kt\oplus(mt||IDt\oplus mp)\), it gets \(Kt\oplus mt\) from the second part of the message and calculates \(Kt\oplus mt\oplus IDp\). Afterward, we obtain \(Kgroup\oplus VIDt||Kt\oplus(IDp\oplus mt||IDt\oplus mp)\) and encrypt this expression with the phone's private key \(Kp\). We also add \(Kgroup\oplus IDp\oplus Kp\) and \(IDp\) to the message. After that, the phone sends the following message to the authentication server: \(VIDp||(Kgroup\oplus vid||Kgroup\oplus IDp||Kn\oplus(IDp\oplus mn||IDn \oplus mp))\oplus Kp\).
4. After receiving the message, the cloud server searches a set of values with \(VIDp\) and gets \(IDp,Kp,Kgroup\). Then the server decrypts the message and gets \(VIDt\). After searching for \(VIDt\) in the database, the server gets \(IDt,Kt,Kgroup\). Lastly, the server gets \(mt,mp\). During inspection and decryption, if the server finds that the identity of the device or tag is wrong, the protocol will stop. If the inspection and decryption pass, then the server generates a random number \(ms\) and also a _Token_, where _Token_ is equal to \((IDt+mt+ms)\oplus(mp+ms)\). Then the server calculates \((Token||Kt\oplus ms||mp)\oplus Kgroup\oplus Kp\) and sends the message to the NFC phone. After decryption, the phone sends the message to the tag.
5. Step 5. After the tag receives the message, it gets \(ms\). Then \(Tokent=(IDt+mt+ms)\oplus(mp+ms)\), if \(Token=Token\) and the tag can confirm that the server and phone are reliable. In the next step, the tag lets the server know that it has received the _Token_. The tag generates random number \(mt\) and calculates \(Kt\oplus mt||mt\oplus ms\). Lastly, it sends the calculation result to the server through the phone.
6. Once it has received the relevant message from the mobile phone, the server gets \(mt\)/ after decryption. The message can be divided into 2 parts. Each part can be used to verify the other. If the \(mt\) is right, the server can confirm that the tag has received the _Token_. In order to resist against brute attacks, we should make sure that \(Kt,Kp\) is changed after each communication. To do this we generate new device keys and synchronize them. The server generates \(ms,ms\prime\prime\) and then Update \(Ktt,VIDt,Kp,VIDp\prime\). After that, the server generates a new \(Kt,Kp,VIDt\)_and_\(VIDp\). After completing the above steps, the server calculates \((Kt\oplus ms||mt\oplus ms\prime||Kp\oplus ms\prime||mp\oplus ms\prime, ACK)\oplus Kp\) and sends it to the tag through the phone.
7. Once it has received the message, the phone gets \(ms\prime\prime\) from \(Kpt\oplus ms\prime||mp\oplus ms\prime\prime\) and then updates \(Kp\) as \(Kpt\oplus mp+ms\prime\prime\). After that, the phone sends \(Kt\oplus ms\prime||mt\oplus ms\prime\), \(ACK\prime\) to the tag.
8. Once it has received the relevant message from the mobile phone, the tag gets \(ms\prime\) after decryption. The two parts of the message can be mutually verified. If \(ms\prime\) is right, the tag updates \(Kt\) as \(Kt\oplus mt+ms\prime\). After that, the protocol is complete.