The Internet of Things (IoT) is changing human lives by connecting everyday objects together. For example, in a grocery store, all items can be connected with each other, forming a smart shopping system. In such an IoT system, an inexpensive radio frequency identification (RFID) tag can be attached to each product which, when placed into a smart shopping cart, can be automatically read by a cart equipped with an RFID reader. As a result, billing can be conducted from the shopping cart itself, preventing customers from waiting in a long queue at checkout. Additionally, smart shelving can be added into this system, equipped with RFID readers, and can monitor stock, perhaps also updating a central server. Another benefit of this kind of system is that inventory management becomes much easier, as all items can be automatically read by an RFID reader instead of manually scanned by a laborer. To validate the feasibility of such a system, in this paper we identify the design requirements of a smart shopping system, build a prototype system to test functionality, and design a secure communication protocol to make the system practical. To the best of our knowledge, this is the first time a smart shopping system is proposed with security under consideration.