Due to the highly sensitive business information communicated within RFID-enabled supply chain networks, there is an urgent need for a secure and effective track & trace system. In this paper, we aim to design and implement a secure track & trace system (SecTTS) based on the EPCglobal network where the EPC Discovery Services (EPCDSs) is the most important component. In SecTTS, the EPCDS is designed as a semi-trusted server, contrasting the assumptions of previous works, which requires a trusted EPCDS. Our EPCDS is implemented based on the relay model where set-based relay policy is proposed to allow each supply chain partner to define different relay policies for information with different sensitivity. We implement a prototype of SecTTS and conduct extensive experiments. The results validate that our design is practical and cost effective.