Abstract: With the extensive usage of radio frequency identification (RFID) systems,the challenge of security is emerging．In order to reduce the computational cost of the tag,a series of ultralightweight RFID authentication protocols that only involve simple bit-wise operations like AND,OR,XOR,rotation,have incurred many concerns．But the existing ultralightweight RFID authentication protocols are unable to guarantee the strong security property．A heuristic attack strategy based on simulated annealing algorithm was proposed to reckon the secret data against the improved LMAP＋protocol present by Gurubani in 2012．With the untraceability model proposed by Juels and Weis,a traceability attack was undertaken based on our heuristic attack strategy．And the secret values of improved LMAP＋could be disclosed successfully after repeated experiments of the attack strategy．The experiment evidences that,through the passive attack by eavesdropping the exchanged messages between the reader and the tag,the reckoned secret values are approximately equal to the genuine values of the secret data．And in a full-disclosure attack experiment,the secret data will be cracked completely with a 70percent probability．At the same time,the attack process has a fast convergence speed with desired effectiveness.

Key words: RFID authentication,Simulated annealing algorithm,Heuristic attack,Ultralightweight,Untraceability