Radio Frequency Identification (RFID) technology has been widely used in supply chains to track and manage shipments. By tagging shipments with RFID tags, which can be remotely accessed by RFID readers, shipments can be identified and tracked in a supply chain. Security issues in RFID have been major concerns, since passive RFID tags have very weak computational power to support authentication. Sound authentication between tag and reader remains a challenging problem. In this paper, we provide a novel authentication scheme to protect tags from being tracked and identified by unauthorized readers and protect authorized readers against bogus tags. Our scheme can be applied to supply chain security. It also exhibits an additional feature that a supply chain can be dynamically updated.