無線射頻辨識 (Radio Frequency Identification, RFID) 是採用非接觸式的方式對無線射頻標籤達成自動化識別的技術，此技術運用在許多不同的領域上，其易於讀寫的特性尤其適合在供應鏈的物流管理上應用，讓供應鏈中的企業夥伴有效控管庫存和分享資訊。
供應商管理庫存 (Vender Managed Inventory, VMI) 是一種共同管理庫存的方式。其主要目的是整合供應鏈中的企業資源以抑制長鞭效應，並在共同的協議下由製造商管理庫存，分攤以往下遊廠商獨自負擔的庫存成本。
在這篇論文中，我們針對應用VMI的供應鏈設計了兩套多擁有者的RFID所有權轉換協定。目的是為了解決VMI在RFID實務執行上的困難，並增進庫存成本分配的效率。我們根據情境設計出能夠處理多個擁有者同時擁有某一物件的協定，且能根據情境取消某些擁有者的擁有權或是加入新的擁有者。我們也提出並解決可能的攻擊方式，以確保其安全性。
第一個協定應用了公正第三方 (Trusted Third Party, TTP)　的概念，讓企業夥伴在公正第三方的協助下共同管理庫存，並且將企業夥伴分級管理，達到具安全性的擁有權轉移目的；第二個協定則針對了應用電子產品碼資訊服務 (Electronic Product Code Information Service, EPCIS) 的供應鏈，讓企業夥伴能夠在雲端上即時的共享庫存訊息或處理擁有權轉移的方式。

Radio Frequency Identification (RFID) is a contactless automatic identification technology. This technology is used in variety of fields, its easy-to-read feature is particularly suitable for applications in the logistics supply chain management, and it permits business partners in supply chain to effectively control inventory and sharing information.
Vendor Managed Inventory (VMI) is an inventory co-management approach. The purpose of which is to integrate enterprise resource and inhibit the bullwhip effect. Moreover, the vendor will be able to manage the inventory under mutual agreement to share the inventory costs which were solely borne by the dealer in the past.
Two RFID multi-ownership transfer protocols aimed for the VMI environment are presented in this thesis. They are developed to solve the difficulties of the RFID system implementation in VMI environment, and to improve the efficiency of the inventory costs allocation. These protocols are designed to handle one object with multiple owners based on the situations encountered; the ownership of particular users can be added or terminated as needed. Possible security issues and strategies to prevent such attacks are also discussed.
The first protocol is referred to as Multi-ownership Transfer Protocol with Trust Third Party (TTP), as it would allow business partners to manage inventory in the control of TTP. It also provides a level mechanism to divide business into two levels, to maintain the confidential information privacy.
The second protocol is called EPCIS-oriented multi-ownership transfer protocol, which is designed to support supply chain members who uses Electronic Product Code Information Service (EPCIS). It provides an information transparency environment to allow the users to share information and control the ownership immediately.

Contents1
List of Figures2
List of Tables3
中文摘要4
Abstract5
致謝7
Chapter 1 Introduction8
Chapter 2 Related Work12
Chapter 3 The Proposed Protocols16
3.1Environment and Assumption16
3.2The Proposed Multi-ownership Transfer Protocol with TTP20
3.2.1The Stepup Stage22
3.2.2Tag Reading Stage23
3.2.3Current Owner Leaving Stage25
3.2.4New Owner Joining Stage31
3.3The Proposed EPCIS-oriented Multi-ownership Transfer Protocol33
3.3.1The Stepup Stage35
3.3.2Tag Reading Stage35
3.3.3Current Owner Leaving Stage37
3.3.4New Owner Joining Stage40
Chapter 4 Security Analysis43
Chapter 5 Conclusions49
References50
Appendix53

[1]Disney, S.M., Towill, D.R., “The Effect of Vendor Managed Inventory (VMI) Dynamics on the Bullwhip Effect in Supply Chains,” International Journal of Production Economics, Vol.85, Issue 2, pp. 199–215, August 2003
[2]Doss, R., Zhou, W., Yu, S., “Secure RFID Tag Ownership Transfer Based on Quadratic Residues,” Proceedings of IEEE Transactions on Information Forensics and Security, Vol. 8, No. 2, pp. 390-401, February 2013.
[3]Evdokimov, S., Günther, O., “Practical Access Control Management for Outsourced EPC-Related Data in RFID-Enabled Supply Chain,” Proceedings of 2007 IEEE International Conference e-Business Engineering, pp. 331 - 336, October 2007.
[4]Hu, X.Z., “Coordinated Pricing and Replenishment Interval in Distribution System with VMI,” NCU Department of Industrial Management, June 2008.
[5]He, W., Li, Y.J., Chiew, K., Li, T., Lee, E.W., “A Solution with Security Concern for RFID-Based Track & Trace Services in EPCglobal-Enabled Supply Chains,” Designing and Deploying RFID Applications, ISBN 978-953-307-265-4, June 2011.
[6]Harrison, M., “EPC Information Service (EPCIS),” Proceedings of 2004 Auto-ID Labs Workshop, pp. 29-30, August 2004.
[7]Kapoor, G., Piramuthu, S., “Vulnerabilities in Some Recently Proposed RFID Ownership Transfer Protocols,” Proceedings of IEEE Communications Letters, Vol. 14, No. 3, pp. 354-357, March 2010.
[8]Kardaş, S., Akgün, M., Kiraz, M.S., Demirci, H., “Cryptanalysis of Lightweight Mutual Authentication and Ownership Transfer for RFID Systems,” Proceedings of 2011 Workshop on Lightweight Security & Privacy: Devices, Protocols, and Applications, pp. 20-25, March 2011.
[9]Kapoor, G., Zhou, W., Piramuthu, S., “Multi-tag and Multi-owner RFID Ownership Transfer in Supply Chains”, Proceedings of 2011 Decision Support Systems, Vol. 52, pp. 258–270, September 2011.
[10]Lin, W.Z., “Research of Vendor Managed Inventory Optimal Strategy Implementation,” NSYSU Department of Business Management, June 2005.
[11]Peris-Lopez, P., Hernandez-Castro, C. J., Tapiador, M.E. J., Li, T., Li, Y.J., “Vulnerability analysis of RFID protocols for tag ownership transfer,” Proceedings of 2010 Computer Networks Conference, Vol.54, pp. 1502–1508, November 2010.
[12]Ray, R. B., Chowdhury, M., Abawajy, J., “Secure Mobile RFID Ownership Transfer Protocol to Cover all Transfer Scenarios,” Proceedings of 2012 7th Computing and Convergence Technology International Conference, pp. 1185 - 1192, December 2012.
[13]Song, B., Mitchell, J. C., “Scalable RFID Security Protocols Supporting Tag Ownership Transfer,” Proceedings of 2011 Computer Communications Conference, Vol. 34, pp. 556–566, March 2011.
[14]Safkhani, M., Bagheri, N., Naderi, M., Luo, Y., Qi C., “Tag Impersonation Attack on Two RFID Mutual Authentication Protocols,” Proceedings of 2011 Availability, Reliability and Security 6th International Conference, pp. 581 - 584, August 2011.
[15]Yang, M.H., “Across-authority Lightweight Ownership Transfer Protocol,” Proceedings of 2011 Electronic Commerce Research and Applications Comference, Vol.10, pp. 375–383, March 2011
[16]Yang, M.H., “Secure Multiple Group Ownership Transfer Protocol for Mobile RFID,” Proceedings of 2012 Electronic Commerce Research and Applications Conference, Vol. 11, pp. 361–373, January 2012
[17]Zanoni, S., Jaber, Y. M., Zavanella, E. L., “Vendor Managed Inventory (VMI) with Consignment Considering Learning and Forgetting Effects,” International Journal of Production Economics, Vol.140, Issue 1, pp. 721–730, December 2012
[18]Zhou, W., Yoon, E.Y., Piramuthu, S., “Simultaneous multi-level RFID tag ownership & transfer in health care environments,” Decision Support Systems, Vol. 54, Issue 1, pp. 98–108, December 2012.
[19]Zhou, W., Piramuthu, S., “Preventing ticket-switching of RFID-tagged items in apparel retail stores,” Proceedings of 2013 Decision Support Systems Conference, Vol. 55, pp. 802–810, March 2013
[20]Zhen, X.M., “Grouping Proof Protocols based on Low-cost RFID Tags,” NTUST department of Information Management, July 2013.