Abstract: This paper studies the security of two-way authentication protocol (PUMAP) based on ultra-lightweight radio frequency identification(RFID) of physical non-cloning functions. After the analysis of the certification process, it is found that the shift digits of the shift operation can be obtained by hacking one certification process, then the formulas in the certification is simplified, and the secret information is obtained by calculating between reader and tags. In addition, this protocol couldn't prevent location tracking attack. The analysis result shows that PUMAP is not secure, and its safety performance really couldn't satisfy the security requirement of RFID systems.