To solve the problems of security and privacy caused by RFID tags search process, a lightweight service-less RFID security search protocol was designed. Firstly, through strict timestamp, the time permissions of the mobile reader were managed. Secondly, the method of combining loose timestamp and HASH function for the safety protection of the wireless channel was put forward, the one-way character of HASH function was used to ensure the integrity and confidentiality of interactive messages. Finally, the collision thought was made use of to realize the adjustable intensity of privacy and search efficiency. Under the UC framework, it was proved that the protocol could meet universally composable security, enabling the protocol to run in the concurrent environment. Under the standard security model, it was proved that the protocol could effectively resist replay attack, de-synchronization attack, track attack, anonymity attack and so on. It follows that the proposed protocol has strong security and privacy.