A Cross Layer Protocol for Fast Identiﬁcation of Blocked Tags in Large -Scale RFID Systems

: Blocker tag attack is one of the denial-of-service (DoS) attacks that threatens the privacy and security of RFID systems. The attacker interferes with the blocked tag by simulating a fake tag with the same ID, thus causing a collision of message replies. In many practical scenarios, the number of blocked tags may vary, or even be small. For example, the attacker may only block the important customers or high-value items. To avoid the disclosure of privacy and economic losses, it is of great importance to fast pinpoint these blocked ones. However, existing works do not take into account the impact of the number of blocked tags on the execution time and suffer from incomplete identification of blocked tags, long identification time or privacy leakage. To overcome these limits, we propose a cross layer blocked tag identification protocol (CLBI). CLBI consists of multiple rounds, in which it enables multiple unblocked tags to select one time slot and concurrently verify them by using tag estimation in physical layer. Benefiting from the utilization of most collision slots, the execution time can be greatly reduced. Furthermore, for efficient identification of blocked tags under different proportions, we propose a hybrid protocol named adaptive cross layer blocked tag identification protocol (A-CLBI), which estimates the remaining blocked tag in each round and adjusts the identification strategy accordingly. Extensive simulations show that our protocol outperforms state-of-the-art blocked tags identification protocol.


Introduction
Radio Frequency Identification (RFID) technology is promoting the rapid development of the Internet of things [Han, Zheng, Wen et al. (2018); Wang, Gao, Yin et al. (2018); Wang, Gao, Liu et al. (2019); Ren, Liu, Ji et al. (2018); Medhane, Sangaiah, Hossain et al. (2020); Yin, Zhou, Zhang et al. (2017)]. The current researches on RFID have focused more on the problems in practical application scenarios. i.e., rapid inventory of moving goods [Chen and Feng (2019); Wang, Xie, Wang et al. (2019)], complete identification of missing goods [Yu, Chen and Wang (2019); Shahzad and Liu (2015); Chen, Wang, Xia et al. (2018); Liu, Li, Min et al. (2015)], inventory of different kinds of goods [Liu, Li, Jie et al. (2016)]. In recent years, the security problem in RFID system has also attracted extensive attention [Vahedi, Shah-Mansouri, Wong et al. (2011); Bu, Liu, Luo et al. (2013); Chen and Feng (2009) ;Liu, Xie, Zhao et al. (2018); Luo, Wen, Su et al. (2019)], among which the blocking attack can interfere with reader's identification of tags. Specifically, the blocker tag simulates a fake tag that has the same ID as the target tag. Once the reader wants to collect information about a target tag in a certain time slot, the fake tag will also respond to noise in this slot. If not be prevented, blocking attack can lead to incomplete information collection, thus prolonging identification time and causing energy waste. While existing techniques, i.e., encryption algorithms and cryptography [Bolotnyy and Robins (2017)], can be used to prevent the blocking attack, they are not suitable for lowcost tags. Another direct method called Poll & Listen (P & L) [Liu, Xie, Zhao et al. (2018)] identifies each tag one by one using the select command that contains the tags' ID. However, P & L is time consuming and may reveal personal privacy. Consider that in a hospital, the reader needs to quickly collect the patient's physical conditions such as temperature, heartbeat and blood pressure and provides them to the doctor. If some patients' information cannot be timely fed back due to the existence of blocked tags, the diagnosis of the disease will be delayed. At the same time, doctors should protect patients' personal information from being disclosed. Therefore, it is crucial to confirm exactly which tags are blocked and take effective action accordingly. So far, many anti-collision algorithms have achieved high throughput and time efficiency [Su, Sheng, Leung et al. (2019); ; ; Chen (2016)]. However, if there exist blocked tags, the reader cannot use the traditional Aloha method to separate the collision information. i.e., the fake tags and blocked tags always reply like a pair. Therefore, the ID of some specific tags cannot be determined. The tag identification protocols [Liu, Li, Min et al. (2015); Liu, Li, Min et al. (2014)], which construct the expected vector by using the IDs of the known tags and improve the proportion of singleton time slot in the vector by the use of bloom filter, multiple-hash, collision reconcilement and other methods. These protocols can be used to determine the existence of the blocking attack by comparing whether a singleton slot turns out to be collision during the actual execution. However, through extensive simulations, we find that these methods also suffer from performance degradation when the number of blocked tags changes. Different from most MAC layer tag identification protocols that only consider the use of singleton slots [Liu, Li, Min et al. (2015); Liu, Qi, Li et al. (2015)], we aim to extract information from the physical layer to assist in the design of the MAC layer protocol, so as to improve the identification efficiency of the blocked tag. Follow this idea, a cross layer blocked tag identification protocol (CLBI) is proposed. CLBI improves the time efficiency by extracting the information from not only the singleton slots but also collision slots. Through the tag estimation in collision slots, multiple unblocked tags can be verified in only one slot. Moreover, through extensive simulations, we observe that the efficiency of CLBI decreases with the increase of the blocked tags, hence an adaptive cross layer blocked tag identification protocol (A-CLBI) is proposed to achieve time efficiency with different number of blocked tags. The main contributions of this paper are summarized as follows: 1. We investigate the problem of blocked tags identification in RFID system and propose a cross layer method. Compare it with existing approaches, the proposed one can achieve higher time efficiency when the proportion of the blocked tags is small. 2. We estimate the number of blocked tags in each round and design an adaptive cross layer blocked tag identification protocol that is suitable for different proportion of blocked tags. 3. We theoretically analyze the optimization of parameters and calculate the optimal frame length of each round to maximize the time efficiency. 4. We conduct extensive simulation analysis to evaluate the performance of CLBI and A-CLBI under different working scenarios, and the results show that our approach outperforms the state-of-the-art. The rest of the paper is organized as follows: Section II reviews the related work. Section III presents the system models used in this study and formulates the problem. In Section IV, we propose our approach to solve the problem. In Section V, the proposed A-CLBI and CLBI are evaluated and compared with the state-of-the-art protocols. Section VI concludes the paper.

Related work
Research based on blocked tags has attracted more and more attention [Vahedi, Shah-Mansouri, Wong et al. (2011);Bu, Liu, Luo et al. (2013);Liu, Xie, Zhao et al. (2018); Zanetti, Fellmann and Capkun (2010); Lehtonen, Michahelles and Fleisch (2009) ;Wang, Xiao, Bu et al. (2013)]. However, the current works still face three problems: (1) incomplete identification of blocked tags (2) long identification time (3) privacy leakage. In Vahedi et al. [Vahedi, Shah-Mansouri, Wong et al. (2011)], the Probabilistic Blocker Tag Detection (P-BTD) algorithm was proposed for both Binary Tree walking systems and Aloha system. P-BTD compares information extracted from the previous interrogation with the current one to determine whether a blocked tag exists. However, P-BTD cannot accurately and completely identify the specific blocked tag, thus cannot fundamentally eliminate the harm of blocking attack. Synchronized Secrets (SYNC) was implemented to identify the specific clone tag [Chen and Feng (2009)]. SYNC scans the tag multiple times and each time the reader writes a random number into the tag's memory and records it. When it scans this tag next time, it recognizes the clone ID if it gets a different random number. Liu et al. [Liu, Xie, Zhao et al. (2018)] proposed a hybrid approach which consists of the Aloha Filtering (AF) and Poll & Listen (P & L) protocol, the approach firstly uses AF to filter most unknown tags and unblocked tags, then it adopts P & L to polls IDs of the target tags one by one and monitors the channel to check the responses of these tags. Once receiving a collision response, the corresponding tag can be identified as a blocked tag by the reader. However, both SYNC and P & L are time consuming, which are not applicable to large-scale RFID system. Moreover, these two protocols transmit the tags' ID directly in the air, thus may lead to privacy disclosure. Wang et al. [Wang, Xiao, Bu et al. (2013)] proposed the Tree-based protocol for blocked tag identification. However, the tree-based mechanism is not supported by the C1G2 RFID standard. In Bu et al. [Bu, Liu, Luo et al. (2013)], Broadcast Friendly Cloned-Tag Identification (BID) protocol was proposed based on slotted Aloha mechanism. In BID, each tag uses its ID and hash function to select a slot to reply to the reader. Specifically, the reader first predicts and records the expected singleton slots in a frame, and then detects the actual reply of these singleton slots. Once an expected singleton slot turns out to be a collision slot in the execution phase, the blocked tag can be identified. However, this approach only extracts the information of single slots with nearly 73.2% of the slots being wasted. Therefore, BID is also time-consuming when the proportion of blocked tags is small.

Problem statement 3.1 System model
In this paper, we consider an RFID system, which consists of a back-end server, an RFID reader and N tags [Chen, Wang, Xia et al. (2018)]. Each tag has a unique 96-bit ID and is equipped with a hash function. All the IDs of N tags are prestored in the database of the back-end server, which communicates with the reader via a high data rate link. Hence, we consider them as an integral part and use the "reader" to represent them. Note that in a large-scale application scenario, multiple readers can be treated as one if they are well synchronized and coordinated. For simplicity, our protocol only considers a singlereader in this paper and can be extended to multiple readers.

Attack model
The attack model [Bu, Liu, Luo et al. (2013); Zanetti, Fellmann and Capkun (2010); Lehtonen, Michahelles and Fleisch (2009)] is considered in this paper. As illustrated in Fig. 1, some fake tags simulated by blocker tags are pre-configured in some valid tags with the same IDs in set N and we called these valid tags as blocked tags. When the reader intends to collect information of a certain set of tags, each tag uses its ID and hash function ( ) , mod H ID r f as the selected slot to reply. However, the fake tag bundled with a blocked tag will also reply with a random number in the same slot, resulting in the reader not being able to correctly receive any useful information about the blocked tag.

Problem definition
Since blocking attacks will lead to failure of information collection, which increases the waste of time and energy, in this paper, we focus on how to completely identify the blocked tags in an efficient way. As shown in Fig. 1, the set of all target tags that we want to verify is denoted as N , whose IDs are known by the reader in advance. The set of blocked tags in set N is represented by B . Obviously, B N ⊆ . Neither the IDs nor the number of blocked tags is known by the reader. Therefore, the problem can be summarized as follow: Given the target tags set N known by the reader, identify all blocked tags B in N with the minimum execution time.
Tab. 1 summaries the main notations used in the paper.

Symbols Description
The set of all target tags in the system The set of blocked tags in the system The hash function with a uniform rand distribution The random seed that is fresh in each round i The length of the filter in each round i

Filter vector
The total execution time of the i th round The long-response slot which is 10 bits The tag slot which is 96 bits A variable given by i N f . The natural constant which is approximately equal to 2.71828.

Cross layer design 4.1 Motivation
In order to extract useful information in collision slots, we combine the physical layer tag estimation algorithm to design the cross layer blocked tag identification protocol (CLBI). As we have described above, previous protocols determine a blocked tag by checking whether the expected single slot becomes an actual collision slot. We illustrate the basic idea of CLBI in Fig. 2, that is, if the number of tags in the expected slot is equal to the number actual slot, all tags in this slot can be identified as non-blocked tags. Moreover, through the subsequent optimization of frame length, the number of collision slots and single slots can be increased, thus reducing the waste of empty slots. Therefore, CLBI can identify more tags with fewer time slots, thereby fundamentally improving the time efficiency.

Improved mean-shift algorithm
In the RFID system, the reader can down-converted the signal replied by multiple tags to the baseband and extract useful information. we can plot the base signal in the I/Q (in-phase amplitude/quadrature amplitude) plane [Angerer, Langwieser and Rupp (2010)]. Hence, the received signals are gathered around some center points, which form as several clusters. The number of collision tags can be obtained by counting the number of clusters. However, due to the presence of noise, it is difficult to determine the cluster boundary.  [Trieu and Maruyama (2011)]. Based on the feature that clusters are always located in pairs and symmetry to the center of all samples. PEAC adjusts the number of clusters, thus improving the accuracy of the estimation of tags in one slot. Fig. 3 plots the estimation accuracy of different tags. It can be observed that the accuracy of results is affected by the number of tags in a slot. In our design, the estimation results of tags in physical layer indicate that whether there exist extra tags, i.e., fake tag replies in a time slot. Taking advantage of the effective information in the physical layer, we design the so-called cross layer blocked tag identification protocol that will be described in the next section.

The proposed solution
CLBI consists of three phases: slot pre-allocation phase, tag filtering phase and tag identification phase. In slot pre-allocation phase, the reader allocates each tag a time slot and constructs a vector-based frame to broadcast accordingly. Once receiving the frame, each tag then decides whether to reply or keep silent based on the value of its selected time slot in the frame during the tag filtering phase. Subsequently, the reader estimates the number of tags in each slot and determines the status of these tags. We describe the detailed protocol process as follows.

Slot pre-allocation phase
As shown in Fig. 4 H ID r f as the time slot for each tag to select. Since the reader knows the IDs of all tags, it can construct an i f -bit vector, represented as V , according to the status of each slot. Note that time slots are classified into empty slots, singleton slots, or collision slots. To save the number of bits, we use Huffman coding to indicate the different states of the slot according to the following rules: a) "0": the time slot is expected to be empty. b) "10": the time slot is expected to be mapped by one tag. c) "11": the time slot is expected to be mapped by multiple tags. Note that if one time slot is selected by too many tags, the number of clusters will increase exponentially by 2, and the clusters will be closer to each other, which leads to an increase in detection errors. Therefore, we treat the time slot selected by more than 3 tags as "0", which is the same as the empty slot. An example is shown in Fig. 3 f . In addition, it checks the value of j th bit in V and records the number of slots before the its selected slot with the value of "10" and "11", which are denoted as m and l , respectively. If the value happens to be "11", the tag will transmit a long response in 1 j j l m + + th slot and wait for the next command A from reader. If the value happens to be "10", the tag will also transmit a long Similarly, 3 t replies in the third slot and 6 t replies in the fourth slot. However, 3 t and 6 t will not participate in the subsequent process.

Tag identification phase
In tag identification phase, the reader checks the actual replies of each slot from the active tags and constructs an actual frame denoted as VF . If the reader detects collision signals in a slot, it plots the I/Q constellation as described above, and then adopts the PEAC algorithm to extract the number of tags in this slot. The expected number of tags and the actual number of tags in a slot are denoted as EN and AN , respectively. By comparing EN and AN , the reader can know whether any tags are blocked. Note that only expected singleton slots and expected collision slots are used in VF , so we have the following cases: Case 1: if =10 VF and =1 AN , the tag corresponding to the j th slot is not blocked. , it means that at least one of these tags is blocked, thus the tags corresponding to the j th slot cannot be identified.
Subsequently, the reader constructs a vector, represented as A , whose length is equal to the total number of "11" slots. According to these four cases: ( ) 1 Then, it also splits the A into 96 A     segments and broadcasts them to tags. Each remaining active tag checks the value of j l th bit in A . If the value happens to be "1", it will not participate in the subsequent identification process. Otherwise, they will wait for the start of the next round. As shown in Fig. 4, the reader compares the expected and actual number of tags in each slot. Then it verifies that 3 t , 6 t are blocked while 4 t , 5 t are not blocked. Therefore, the reader constructs the vector A and encodes it as "01" to broadcast to all active tags. Consequently, 4 t and 5 t will not participate in the follow-up process and 1 t , 2 t will wait for the start of the next round.

Parameter optimization
In this subsection, we determine the optimal frame size i f in each round i to maximize the time efficiency of CLBI. We first assume that the current number of blocked tags B * is known by us, and then we'll estimate it later. We denote N * as the candidate tags (fake tags are not included) at the beginning of each round. For arbitrary time slot, the probability that it is selected by only one tag in N * is: Note that when i f is very large, Similarly, we calculate the probability of 2-collision slots and 3-collision slots as follows: Hence, we obtain the expected number of useful slots in arbitrary round i , which are denoted as D , as follow: In the tag identification phase, a tag can be identified in two cases: a tag selects a single slot or multiple tags select the same slot (no more than three), and none of which are blocked. Hence, we denote 11 P , 22 P and 33 P to represent the probability of each case and respectively calculate them as follow: Let denote total K as the total expected number of tags that can be identified in each round i , we can obtain: Let T represent the total execution time of the i th round in CLBI. T includes three parts: the time for the reader to broadcast the parameters and the vector V , the time required for the tag to reply, and the time for the reader to broadcast the vector A . Hence, we get: We denote the proportion of unblocked tags in each round as p and replace i N f with q . Combing Eqs.
(2), (3), (5)- (7) and (9), the average time to identify a tag in the i th round, which is denoted as E , can be calculated as follow: ( ) Note that we set = tag t 2.4 ms and long t = 0.8 ms which follow the settings in Bu et al. [Bu, Liu, Luo et al. (2013)

Protocol optimization
In our designed CLBI, when there are a small number of blocked tags, only one time slot is needed to identify two or three tags thus achieves higher efficiency. However, as the CLBI is continuously executed, the proportion of blocked tags may increase. Another situation is that the number of blocked tags is high initially. Therefore, directly executing the CLBI may not be the most efficient way. To solve this problem, we further propose the adaptive cross layer blocked tag identification protocol (A-CLBI). A-CLBI determines the execution strategy based on the predicted number of total blocked tags. If the proportion of blocked tags is small, A-CLBI chooses to execute the CLBI because CLBI can identify multiple tags within a time slot. On the contrary, if the proportion of blocked tags increases, the ES-BID method is more appropriate to solve the problem. Therefore, we denote this threshold of the blocked tag proportion as 0 p .
According to Bu et al. [Bu, Liu, Luo et al. (2013)], the optimal frame length is set as equal to the number of candidate tags N * . Therefore, the average time to identify a blocked tag is: Fig. 5 plots the average time spent by the two protocols to identify one tag. We can obtain the threshold 0 p as: 0 =0.2980 p . Therefore, in A-CLBI protocol, when the proportion of blocked tags is less than 0 p , it adopts CLBI method to quickly identify them. As the proportion of blocked tags exceeds 0 p , the ES-BID approach is adopted.

Cardinality estimation
In this section, we propose a quantity estimation method to fast estimate the number of blocked tags. Although there are many protocols [Chen, Zhou and Yu (2013); Liu, Xiao, Li et al. (2017)] that can accurately detect the number of tags, mixing these methods in the identification process will cause additional overhead and increases the protocol complexity. In the A-CLBI protocol, the number of slots with 3, 2, 1 tag selection can be obtained by using the physical layer information, which further assists the estimation of the blocked tags. Let j N denote the expected number of slots selected by j tags and jj N represent the expected number of slots in which the actual number of tags j is equal to the expected ones i.e., = j 1,2,3. Based on the difference between j N and jj N , we can estimate the remaining unidentified blocked tags. According to Eqs. (1) and (2), we calculate the expected number of slots selected by 1 tag, 2 tags and 3 tags as: Therefore, we can calculate the proportion of blocked tags as:

Performance evaluation
The performance of A-CLBI is compared with state-of-the-art protocols, i.e., BID, ES-BID [Bu, Liu, Luo et al. (2013)], SWIPT [Liu, Li, Ming et al. (2015)] and Poll & Listen [Liu, Xie, Zhao et al. (2018)]. Note that SWIPT has been modified where each tag transmits a long response in a singleton time slot. We adopt the execution time of the protocols as the performance metric. The communication channel between the reader and the tags is considered as error-free. According to the setting in Bu et al. [Bu, Liu, Luo et al. (2013);Liu, Li, Ming et al. (2015); Liu, Xie, Zhao et al. (2018)], we set tag t = 2.4 ms to transmit a tag ID or a segment (96 bits). A long response is required by the reader to distinguish between empty, singleton, and collision slots. Here, long t = 0.8 ms. For reliability, two hundred experiments are carried out for each parameter groups and the results are averaged.

Impact of number of blocked tags
As shown in Fig. 6, we compare the A-CLBI with existing protocols when varying the number of blocked tags B from 0 to 10000, 0 to 100, and 500 to 2500. Here we set =10000 N . It can be observed that the execution time of SFMTI, S-BID, ES-BID and P & L are stable. The reason is that all of these protocols are designed to use the singleton time slot to identify the corresponding tag. Therefore, these protocols do not consider the impact of the number of blocked tags on execution time. CLBI achieves better performance when the number of blocked tags is small. This is because CLBI enables multiple unblocked tags to hash to one slot and concurrently identify them. However, as the number of blocked tag increases, the performance of CLBI degrades. The reason is that most of the tags are blocked, resulting in the waste of 2-collision and 3-collision slots used to identify unblocked tags. A-CLBI achieves the best time efficiency when the number of blocked tags is small. Moreover, even B increases, A-CLBI can always get the optimal time efficiency by adaptively adjusting the size of the frame and the strategy to be used. For CLBI and A-CLBI, it is also shown in Fig. 6(b) that the execution time of each is close. Since the proportion of blocked tags changes from 0 to 0.01, CLBI can achieve desirable performance when there are few blocked tags. When the number of blocked tags increases as shown in Fig. 6(c), A-CLBI gains better performance.

Impact of number of target tags
The performance of A-CLBI is verified in Fig. 7 by varying the number of target tags N .
Here we vary N from 1000 to 10000 and =0.05 B N in (a) and =100 B in (b). It can be observed in Fig. 7(a) that the execution time of all these protocols increases with respect to the number of target tags. The reason is because all the protocols need more slots to identify more target tags. P & L consumes the most execution time since it identifies each tag by broadcasting its ID one by one. The execution time of SFMTI and ES-BID is close. A-CLBI achieves the optimal performance compared with other protocols. Moreover, when the proportion of blocked tags is fixed as shown in Fig. 7(b), the execution time of A-CLBI protocol grows slower than other protocols as the number of target tags increases.

Impact of different hashing strategies
In Fig. 8, we evaluate the impact of different hashing strategies. Here we set =10000 N , then vary B from 0 to 500 in (a) and change B from 1000 to 10000 in (b). According to the design of CLBI and A-CLBI, part of collision slots (2, 3, 4, ...) can be used to fast filter the unblocked tags. Considering the error of physical layer estimation, we compare three hashing strategies for CLBI using 2-collision slots, 2 & 3 collision slots, 2-4 collision slots in terms of execution time. We represent each strategy as CLBI (S2), CLBI (S3) and CLBI (S4), respectively.
It can be observed that when B N is low, CLBI (S4) outperforms CLBI (S2) and CLBI (S3). This is because most target tags are not blocked, the reader can utilize more collision tags to identify multiple unblocked tags together. However, as the proportion of B N increases, the execution time of three strategies becomes close. Moreover, when B N is large, the performance of CLBI (S2) is superiors to that of CLBI (S3) and CLBI (S4). The reason is because more blocked tags cause more collision slots to be wasted. A-CLBI is also compared with these three approaches. As B N increases, A-CLBI can adjust the frame size and protocol to get better performance.

Impact of estimation error
In Fig. 9, we evaluate the impact of clustering error in the physical layer by comparing the execution time and the accuracy of the proposed CLBI and A-CLBI protocols. As we illustrated above, the execution time of CLBI grows faster than A-CLBI as the proportion of B increases, hence we set =10000 N and B changes from 1000 to 2000. It can be observed in Fig. 9(a) that the execution time of both CLBI (S2), CLBI (S3) and A-CLBI is prolonged due to the clustering error. This is because some unblocked 2 or 3 collision tags cannot be verified timely due to the quantity estimation error in theirs slot, hence they will participate in subsequent process of identification. CLBI also achieves the best time efficiency. The accuracy of three protocols is shown in Fig. 9(b). Due to the clustering error, some slots may be misclassified, i.e., 3 tags are estimated to be 2 tags. Therefore, the identification results will suffer from bias. The accuracy of CLBI (S3) is lower than CLBI(S2) because it is more difficult to successfully estimate more than three tags. The accuracy of A-CLBI is gradually higher than CLBI (S3) with the increase of B . The reason is that A-CLBI makes use of the singleton slot to identify blocked tags when B N is high, thus its overall accuracy is higher.
In Fig. 10, we evaluate the impact of the estimation error of B by comparing the execution time of the proposed CLBI and A-CLBI protocols. Here we set =10000 N and B changes from 100 to 3100. Note that the setting of the optimal value of f is influenced by the estimated accuracy of B , which further determines the execution time.
It can be observed that the execution time of CLBI (perfect estimation) and A-CLBI (perfect estimation) is shorter than that of the imperfect ones. However, the execution time of the latter has only increased slightly. When the B is 3000, CLBI (perfect estimation) and A-CLBI (perfect estimation) need to consume 9.32 s and 8.68 s. The execution time of CLBI (using CLE) and A-CLBI (using CLE) is 9.38 s and 8.78 s. The reason is because no matter B N is high or low, the estimation method in BLKI selects the maximum number of time slots among the singleton slot, 2-collision slots and 3collision slots of the current frame, so as to increase the accuracy of the estimation.
Moreover, CLBI and A-CLBI estimate the number of B in each round rather than using other protocols. Therefore, the extra cost is reduced. Figure 10: Impact of estimation error of |B|

Privacy protection of A-CLBI
In A-CLBI, each tag uses the hash function to select the slot to reply to the reader, hence the IDs or category IDs cannot be inferred. Moreover, the ID of each tag is not directly transmitted in the wireless channel. Therefore, A-CLBI can protect the privacy of users compared with some existing protocols [Bu, Liu, Luo et al. (2013); Liu, Xie, Zhao et al. (2018)].

Conclusion
This paper investigates the problem of quickly and completely identifying the blocked tags with different cardinality, which is of great significance to the security of large-scale RFID systems. We first consider an RFID system with a small amount of blocked tags. Based on making full use of information in the physical layer, we propose a cross layer blocked tag identification protocol (CLBI). Different from previous works, CLBI estimates the tags in the physical layer, thereby utilizing collision slots to verify multiple tags simultaneously. Moreover, we propose an adaptive cross layer blocked tag identification protocol (A-CLBI) to apply to different proportions of blocked tags. We also propose a method to estimate the number of blocked tags without adding additional overhead. The extensive simulations have been conducted to demonstrate the superiority of the proposed protocols. According to the results, when the proportion of blocked tags is 0.01, our best protocol reduces the execution time by almost 50.5% , compared with the state-of-the-art.