This paper presents a low-cost and secure authentication protocol to reduce the computational load on both the back-end database and the tags in a distributed RFID system. The proposed protocol is based on a hierarchical group-index to reduce the search time for a tag ID in the back-end database. Thus, when a tag is included in the k-thlevel subgroup, the database system takes at most (k + 1) · (k+1) √ m hash operations to find the tag to be authenticated, where m is the number of tags. Furthermore, the proposed protocol also guarantees most security requirements, including robustness against replay and spoofing attacks, synchronization, and indistinguishability.