Tag cost and privacy of RFID technology are two mai n factors that determine whether it will be applied to Internet of Things on a large scale. Recently, RFID industry an d research community have focused on RFID authentic ation protocols with provable privacy and low tag cost. I n this paper, we propose an RFID security protocol that achieves all security requirements based on a hash function and XOR operations. In addition, BAN logic was used to do the formal analysis and proved that the proposed protoc ol is safe and reachable. The RFID technology is wi dely used for industrial and individual applications. In the late st design of RFID system, the mobile handheld reade r generally is adopted, so considering the RFID system's security and efficiency, we should consider two aspects’ sec urity of reader and tags at the same time in the proposed protocol. The ensuring strong privacy has been an enormous c hallenge due to extremely inadequate computational power of typi cal RFID tags. In the proposed protocol, to achieve mutual authentication between the server and the Tags, at the same time we also achieve mutual authentication between the server and the mobile reader.