RFID systems usually involve passive tags (with limited computing and storage capacity) to secure data exchange via wireless communication. This paper builds an effective lightweight privacy protection authentication protocol, over the XCro, rotation and XOR functions, to handle the privacy and security problems in RFID systems. We employ both BAN Logic and ProVerif to prove that the new protocol is secure, its writing logic is correct, the query results are true and the protocol is free of all common attacks. We also conduct the OPNET simulation to evaluate the performance of our protocol and the existing lightweight protocol of Fan, in terms of authentication time, throughput, bandwidth consumption rate and queuing delay. The obtained results show that our protocol is more secure and effective—because we can resist all of the mentioned common attacks by a more efficient authentication process which involves less calculations, communications and transmissions.
