Counterfeit automotive parts pose serious risks to public safety. They are among the most dangerous counterfeits due to risk of harm, injury, or death. ² According to the World Health Organization, approximately 1.3 million deaths and 20–50 million injuries annually are caused by motor vehicle accidents; in India, approximately 20% of the accidents are attributed to counterfeit automotive parts (Shen et al., 2022).

Automotive parts and electronics are currently among the top four most commonly counterfeited products. ³ Demand for counterfeit automotive parts has nearly tripled in the wake of the global COVID-19 pandemic due to increased costs and shortage of replacement parts. The integration of automotive embedded devices in IoT further increased demand for fake parts due to a shortage in electronic components.

The magnitude of automotive counterfeiting is staggering. Toyota Australia recently reported that 62% of their products online were counterfeit. ⁴ BMW has reported fakes from Amazon, eBay, and other online marketplaces. German automaker Daimler AG discovered $1.7 million in counterfeit parts in 1 year. In July 2021, U.S. Customs and Border Protection seized 5,657 counterfeit ($295,302) vehicle parts from China. In 2022, automotive parts suppliers in three retail stores were charged with selling counterfeits in New York.

Counterfeiters tend to focus on profitable automotive parts that are most often replaced. Commonly counterfeited auto parts include brake pads, lights, tires, rims, windscreens, and body parts. These parts are counterfeited in high volumes, and they can lead to premature failure, injuries, and accidents. Figure 1 ⁵ depicts commonly counterfeited parts that are particularly dangerous, including airbags, engine components, and brakes.

The detection of counterfeit automobile parts should be coordinated with the growing field of cyber security of autonomous vehicles. The research activity in this field is, recently, very high. For example (Kennedy et al., 2019), discuss automotive cyber security from the viewpoint of criminology theory and vehicle-related cybercrime. Especially pertinent to this work is the role of guardianship strategies. Collaboration and information sharing among automakers, suppliers, policymakers, and security researchers is an effective approach counterfeit and other cybercrime prevention.

There is an opportunity to merge counterfeit prevention with the cyber technologies and policies under development protecting vehicles. Ensuring security of authentication systems poses a significant challenge. Advanced anti-counterfeiting architectures are based on embedded systems, IoT, sensing, networking, and communication technologies. Currently, these technologies in vehicles are vulnerable. A remote attack was demonstrated in 2015 by security researchers with the compromise of a 2014 Jeep Cherokee’s electronic functions. ⁶ The researchers were able to control everything from locks to steering by attacking the Jeep’s Controller Area Network (CAN) bus system through the entertainment system. Further research into connected vehicle vulnerabilities revealed that the on-vehicle computer and communication systems are unsecured. (Hashem Eiza and Ni, 2017; El-Rewini et al., 2020; Khan et al., 2020; Aliwa et al., 2021; Elkhail et al., 2021; Khan et al., 2022; Labrado et al., 2022). Other connected vehicles communications could be compromised, including transmission of geolocation data (Kumar et al., 2019), communication with charging stations for electric vehicles (Acharya et al., 2020), and communication with traffic signals (Feng et al., 2022). If vehicle systems are not secured, then counterfeit detection and monitoring systems could also be easily compromised.

In the next section, we review current anti-counterfeiting strategies and highlight the gaps in anti-counterfeiting technology for automotive supply chains.

The automotive industry relies heavily on customer education to fight counterfeits. One of the leading recommendations for customers to spot fakes is inspection of the packaging. The automobile parts supply chain relies heavily on packaging to establish part authenticity. Figure 2 shows an example of authentic and counterfeit packaging, where color and print errors reveal the counterfeit part. ⁷ A true counterfeit, as opposed to a generic replacement, copies the appearance, dimensions, color, and logos of an authentic part down to the packaging. Counterfeiters often fail at reproducing packaging that is hard to duplicate. However, they are continuously enhancing their techniques to replicate intricate packaging on a larger scale.

Another leading strategy to avoid automotive counterfeit components is to encourage customers to purchase from a legitimate source. A recent arrest of automotive parts suppliers in the U.S. for selling counterfeit auto replacement parts demonstrates that packaging and validity of supplier are ineffective with the increasing sophistication of counterfeiters.

Automakers, Original Equipment Manufacturers (OEM), and suppliers play integral roles within the automotive supply chain, wherein each entity bears a significant responsibility to prevent counterfeits. Recently, these companies have stepped up their efforts to combat counterfeit parts. For example, many have issued counterfeit warnings, initiated lawsuits against counterfeiters, embarked on counterfeit education campaigns, and become members of anti-counterfeiting organizations like Automotive Anti-Counterfeiting Council (A2C2) ⁶ . For example, BMW and Honda both issued counterfeit product alerts and guidance on how to spot fakes. BMW also tracks the sources of fakes from customers, which include Amazon, eBay, other online vendors, and retail stores.

A Google search of “Gates timing counterfeit” yields websites sponsored by Gates Corporation in their effort to ensure a secure supply chain. Unfortunately, counterfeit timing belts have entered the automobile parts supply chain. One feature available through the website is authentication via a serial number. Unfortunately, the serial number is printed on the opaque package, so the contents are not easily verified.

The current anti-counterfeiting strategies in the automotive supply chain are insufficient. Multi-pronged anti-counterfeiting efforts and methods are needed as counterfeiting becomes more sophisticated. Physical, cyber-physical, and technical anti-counterfeiting techniques and processes must be implemented in conjunction with legal measures to secure the automotive supply chain.

The supply chain is vulnerable in the absence of anti-counterfeiting technology. A recent lawsuit revealed a problem with Kona coffee, coffee grown in Hawaii (Bruce Corker et al. v. Costco Wholesale Corp. et al., 2:19-CV-00290-RSL (Western District of Washington at Seattle, 25 June 2021). The annual Kona coffee bean production in Hawaii was 2.7 million pounds, yet annual retail sales exceeded 20 million pounds. Farmers in the Kona region of Hawaii sued more than 20 retailers for selling counterfeit coffee after lab testing revealed that beans being sold were not from Kona. While the lawsuit reimburses the farmers, it is not at all clear if the underlying problem is solved.

The Kona coffee lawsuit illustrates the cost to legitimate companies incur from counterfeiting. In the automotive supply chain, manufacturers lose approximately $2 billion annually to counterfeit tires and batteries. Virtually any automotive part can be counterfeited, as shown in Figure 1. The automotive supply chain also includes the aftermarket and spare parts, where the prevalence of counterfeit parts is increasing. Figure 3 shows mission critical parts, one of which is counterfeit. ⁸ Chemical analysis would show the authentic part to have a metal-ceramic pad whilst counterfeit brake pads has been found with cellulose/resin composites and to have extremely poor braking performance. We note the absence of any authentication mechanism on the part.

Current supply chain risk management standards require tests and inspections to determine component authenticity. ⁹ Inspection to verify part identity requires technologies to facilitate authentication. The United States National Institute of Standards and Technology (NIST) refers to technologies that verify identity of authentic hardware and software in digital environments as a “trust anchor.” The NIST mission statement is “To promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.” In April 2022, the NIST center, the National Cybersecurity Center of Excellence (NCCoE) published the report NIST.IR 8419 “Blockchain and Related Technologies…”. ¹⁰ The industry case studies listed in the report span a range of points of view, ranging from food, aerospace and traditional manufacturing to digital signatures and embedded trust anchors, collectively called cyber-physical trust anchors. The authors participated in the NIST NCCoE working group discussions and believe the report represents a valid snapshot of many manufacturing supply chains today. Other topics of concern included identity, traceability, linking physical objects to data and records, interoperability, metrics, and standards. In the following sections, we discuss the cyber-physical trust anchor implementation in our work, identify the key parameters linking it to automotive systems developing our model, and describe security features.

Many organizations address counterfeiting with legal measures and physical anti-counterfeiting techniques. For example, in the United States, the Secret Service investigates financial crimes, and currency includes a number of features to authenticate it with inspection. The US $100 currency, shown in Figure 4, has at least twelve physical trust anchors—paper, printing, ink, ribbon—and each bill has a unique serial number ¹¹ . It is believed the serial number is tracked throughout the banking system. Hence, low-quality counterfeit bills are detected by flaws in the physical trust anchors and high-quality counterfeits, the “superbills”, are detected by mismatch of the serial number.

The $100 currency anti-counterfeiting techniques can be transferred to the digital world. The serial number and composite of features in currency can be transformed into unique digital identifiers, constituting a digital trust anchor. An effective mechanism for linking unique digital identifiers to cyber records is hashing. A cryptographic hash is limited to perceptibly different items, and a perceptual hash uses features that are similar under small change. The similarity between perceptual hashes is quantified by computing distance between the hashes.

We use hashes for generating different two types of fingerprints for authenticity. A cryptographic hash enables bit-by-bit authenticity using content based verification. However, a cryptographic hash bares no correlation in the hash space to the input space; this makes them exceedingly powerful at detecting identical images but not similar ones. A perceptual hash, on the other hand, proves verification of the image by generating a comparable fingerprint representation of the image. One perceptual hash of an image will be closer in distance to a similar image that a non similar image. Perceptual hashes are also insensitive to different codecs and updates to the media metadata.

Cyber-physical trust anchors can use a variety numerical structures for linking physical attributes of an object with a secure database. For the purpose of this discussion, we label the serial number as a “cryptographic hash” and the ink, print details, etc., as a “perceptual hashes”. Then, each hash has its own definition of distance. The distance for a cryptographic hash is either zero or one, i.e., a perfect match or not. The Euclidean distance in a perceptual hash is a positive real number, i.e., a small positive number for a near perfect match or larger for poor match.

In a truth table of possibilities, an amateur’s counterfeit $100 currency is detectable based on large perceptual hash distance, i.e., many print errors and flaws, and a cryptographic hash distance of zero, the counterfeited serial number is not contained in the database at the US. Federal Reserve. A superbill will have a small perceptual hash distance—it looks authentic—yet the cryptographic hash distance is zero, the counterfeited serial number is not contained in the database at the US. Federal Reserve, so long as the database is not compromised.

A cyber-physical trust anchor is a component of the broader identification, authentication, authorization, and accounting framework for access controls. The lack of end-to-end access control solutions has been an ongoing concern in conventional automotive supply chain security. Although IoT transformed the supply chain with efficiency in tracking, prediction, and automation, challenges exist in connectivity, sensor selection and costs, battery life, and security.

The potential for cyber attacks on vehicles, infrastructure, and autonomous networks has already yielded some protective actions: situation reviews (Chen et al., 2022; Sharma and Gillanders, 2022), policy recommendations (Girdhar et al., 2022; Khan et al., 2022; Kukkala et al., 2022; Benyahya et al., 2023), honey-pots (Panda et al., 2022; Anastasiadis et al., 2023; Baldo et al., 2023), and attack detection (Chen et al., 2021; Zelle et al., 2022; Zhang et al., 2023). This activity demonstrates a high level of concern for the cybersecurity of vehicles, infrastructure, and autonomous vehicles.

We note the interest of the economic sector in the discussions on cyber security in the automotive industry. Authors at the Lloyds Banking Group (London UK) have recently published a literature review, noting gaps in the technology and proposed standards (Fernandez de Arroyabe et al., 2022). The technology and standards gaps are visually presented in a system dynamics model (Khan et al., 2022). In a 2021 review article on future research directions for secure supply, blockchain is described as a promising candidate (Cheung et al., 2021). A 2022 article on zero trust architecture (Rose et al., 2020) gives a more detailed analysis of the role of blockchain for access control (Syed et al., 2022). One issue is privacy, and a strategy is proposed for employing blockchain for security objectives while maintaining private product information and business relationships (Zhang et al., 2022).

Part traceability in automotive supply chains is predicated on certainty that the part is genuine from factory to customer. In this work, parts are authenticated at point of reading the cyber-physical trust anchor, and establishing provenance. When a part is created, the cyber-physical trust anchor is registered in a secure database with auditing capabilities. The audit logs must be resistant to attackers hiding their actions.

Blockchain is an ideal technology for auditing and tracking due to immutable logs. Each block contains the cryptographic hash of the previous block, timestamp, and transaction data. Since a cryptographic hash function is used for linking two nodes (i.e., each event is appended to the cryptographic hash of the preceding event), the integrity of events is ensured.

The authentication process can be automated with capture and encoding of data and signals, and readout with sensors. For example, GS1 global standards for streamlining traceability include Two-Dimensional (2D) barcodes, Quick Response (QR) codes, and radio-frequency identification (RFID) (GS1, 2021). Past research has examined RFID for authentication and tracking of patients in healthcare settings (Wamba and Chatfield, 2009; Mabad et al., 2021). Within this Journal, there are a few very popular embedded sensors, with RFID tags being one of the leading examples (Elgazzar et al., 2022; Lin et al., 2022; Lv, 2022). For a proof-of-concept, we use an non-RFID solution—QR codes, mass, and moisture content—in a use case with tracking Toks coffee, Sec. 3.4. Then, we explore non-RFID solutions such as acoustic signatures, as described in Sec. 4.2, for vehicle applications.

In the next section, we briefly discuss results from a nearly 2-year long application of blockchain to provide a secure supply chain.

In January 2021, small farmers in the Tacaná Natural Reserve ¹² —a distinct biosphere around the Tacaná Volcano in Chiapas, Mexico, on the border with Guatemala—started using a secure supply chain developed by Dr. Ian Taylor, chief technical officer of SIMBA Chain and his colleagues. The problem solved was an inefficient, and sometimes unfair, supply chain. With blockchain and a very simple physical trust anchor—mass and moisture content—the outcome has been a secure supply chain from individual farmers to more than 200 Toks Restaurants across Mexico. Figure 5 shows the different tiers in the supply chain. A bag of coffee (about 100 kg) is delivered from a farm to the cooperative. The cooperative uses an app on a tablet to register the bag of coffee, measuring the weight and humidity amongst other attributes, and then the farmer digitally signs to hand off in return for payment. A QR code for the bag is generated and registered on the blockchain. The bag of coffee then is sent to the desheller (also registered on chain) and when it returns, the new weight and humidity are measured. The new weight will be roughly 70 kg but each bag is different. Also, the bean’s moisture content for each bag will vary. These new measurements are recorded on chain and associated with the QR code. This coupling of the physical attributes with a QR code makes counterfeiting extremely challenging. A counterfeiter cannot simply copy the QR code onto a fake bag of deshelled coffee because it would be very unlikely that the weight and moisture content would match. This simple scheme therefore provides sufficient authenticity and, based on a 4-fold increase in income to the farmer, is a robust anti-counterfeit mechanism.

For the restaurant customers, the secure supply chain ensures the coffee is sustainably sourced. The supply chain has become more efficient, and the return to the farmer increased from $50/bag to $200/bag. ¹³

The on-going cost is paper labeling, measurement of weight and moisture content of the coffee beans, a cell phone app, and a blockchain-secured database. These costs are minimal, and barely more than normal product tracking, yet the combination of simple trust anchors linked to a blockchain has a massive, favorable impact on the supply chain. Blockchain in batches distributed across many areas is cheaper than using RFID. Just the cost of a single passive RFID tag can be 50 cents per tag. Blockchain is particularly cost effective when implemented in a private blockchain, as it is in this model. Is the model of a simple trust anchor with blockchain transferable to automobile parts?

Many automobile parts have serial numbers or batch numbers. The $100 currency has a serial number and fingerprint features. The coffee bean bag has a QR code and logged mass and moisture content. Is a trust anchor possible for installed automobile parts, parts not directly connected to the vehicle communication bus? Will this trust anchor have a uniqueness somewhere between currency print features and coffee bean bag mass and moisture content? The search space and procedure are.

1. A unique physical property of the potentially counterfeited part;

Automobiles today have a number of embedded devices, sensors, and features. Many of the features are supported by embedded software and electronic control units (ECUs). Luxury cars like Mercedes Benz and Lexus can have over 100 ECUs ¹⁴ Other examples of embedded devices and systems in automobiles are ignition systems, antilock braking systems, and airbag control units. The integration of these embedded devices and sensors enable an embedded Internet of Things (IoT) for vehicles.

An efficient implementation of counterfeit part detection will benefit from leveraging the IoT structure associated with connected and autonomous vehicles. In return, autonomous vehicles containing only authentic parts are judged to be more reliable participants in the network. Sensors, data capture and storage mechanisms, and wireless communications can help in tracking automotive parts with proper authentication and security features.

One of the authors of this paper is a chemist and would like to point out the availability of sensors covering a wide range of chemical and material properties. The scientific instruction supply company Vernier Science Education has a website showing sensors for pH, optical spectroscopy, magnetic field, radiation, gas chromatography, polarimetry, moisture, salinity, acoustics and more. ¹⁵ This is not a commercial recommendation for this vendor, but is given for the purpose of illustration. These sensors, with corresponding controllers, can increase the range of physical properties measured by embedded sensors. For example, acoustical sensors can be used to track physical items. In ecology, distributed networks of acoustical sensors are used to track and identify insects and bats (Phung et al., 2017; Gallacher et al., 2021). The data processing has characteristics of the Shazam app, with Fourier transforms of short time windows and classification operations (Swierczek, 2005; Phung et al., 2017).

With regard to IoT sensors, automobile repair parts can be separated into those parts connected to the vehicle computer network—ECM, airbags, information panel, and door locks—and those parts isolated from the computer network—brake pads, windscreen, and tires. The former can be authenticated by established methods of embedded digital codes which are queried by the vehicle’s computer system. The latter, parts isolated from the computer network, are more challenging and are the subject of this paper. In the next section, we will explore the adaptation of the coffee bean model onto detection of counterfeit tires based on an acoustical signature.

In March 2022, Bridgestone Corporation was awarded US patent 1,288,628 B2 with an abstract describing a digital tag mounted in a tire and the validation procedure (Yamada et al., 2022). An earlier patent described the physical mounting of an RFID tag in a tire, but with less detail on the validation procedure (Bracq and Lauragais, 2020). Bridgestone has announced implementation of RFID tags for Gran Touring race car tires. ¹⁶ Let us look at the Bridgestone patent from the point of view of the $100 currency trust anchors and the coffee bean supply chain. What are the strengths and weaknesses of the Bridgestone patent?

“An information presentation system includes an information presentation apparatus, a transmitter attached to a tire and configured to transmit tire ID information for identifying the tire, and a database configured to store tire ID information of tires which are genuine products, and the information presentation apparatus includes a reader configured to perform near field communication with the transmitter, to acquire the tire ID information transmitted by the transmitter, and a controller configured to cause an information presenter to present information indicating that the tire identified with the tire ID information is a genuine product in a case where the tire ID information is stored in the database, and/or cause the information presenter to present information indicating that the tire identified with the tire ID information is a counterfeit product in a case where the tire ID information is not stored in the database.” (Yamada et al., 2022).

For the purpose of this discussion, we will assume the Bridgestone patent describes.

• A full-featured RFID tag with secure authentication,

First, we note the impressive capabilities of passive RFID tags (Landaluce et al., 2020), security (Good and Benaissa, 2013), and the further development of features such as privacy (Ding et al., 2022). In addition to the RFID, tires have a identifying production number that gives manufacture, location, week, and year of production. ¹⁷ The tire identification number (TIN) is not as unique as a serial number, but instead identifies a batch of tires. The TIN is plainly visible on the tire sidewall. The patent also mentions using photography of the tread pattern to match against the RFID. In summary, the Bridgestone patent describes an effective process to establish tire authenticity in the shop.

However, an authentic tire in the shop does not mean an authentic tire is installed on the vehicle. For comparison, as a bank accepts $100 currency, authenticity is checked by the bank at the time of acceptance of the currency. As the coffee bean bags proceed along the supply chain from farmer to the restaurant, the acceptance of the bag is checked by the recipient along the supply chain. We note that a transaction order which schedules authentication before transfer of ownership allows fraud.

Another issue is vehicle owner privacy. After the RFID has served its purpose for the supply chain security, how is owner privacy enabled? Can bad actors track people through the tires on their vehicles?

We propose connecting physical properties of the tire, installed on the vehicle, with a blockchain-secured database. From the sensors listed in Section 3.6, an acoustic sensor is a logical first choice. Then as described for the coffee bean supply chain in Section 3.4, the cryptographic hash is generated from the tire identification number and the perceptual hash is generated from the acoustic signature of the tire. The calculation of part authenticity is based on the distance of the new perceptual hash versus the reference perceptual hash.

The term acoustic signature is used to describe a combination of acoustic emissions of sound emitters, such as those of ships, submarines, aircraft, machinery, animals, and music which can be used for identification, condition, behavior, and physical location. For music, the popular Shazam application readily identifies music from just a few seconds of audio data. Similarly, the acoustic signature of a tire, as shown in Figure 6, is rich in detail with the potential of generating a fingerprint with sufficient uniqueness to meet part authentication needs.The acoustic features that one looks for include acoustical power at well-spaced frequencies, as shown in Figure 6. Another useful characteristic is the ability to modulate the signal; in the case of tire noise, modulation is possible with a defined acceleration-deceleration profile. The combination of resolvable frequencies and their response to external modulation creates a signal pattern than can be converted into a perceptual hash. In an N-dimensional hash space, the objective are hashes from new tires of the same batch that are clustered and well separated from hashes derived from tires of either a different batch or counterfeit.

A draft validation app, akin to the Toks Coffee Tracking app shown in Figure 5, is outlined in Figure 7. The table shows the physical item, its characteristic features, and the logging of the cyber-physical trust anchor with blockchain.

Relative to the Bridgestone patent, the use of an acoustical signature has the capital equipment cost of additional microphones in the vehicle; noise isolation in the vehicle will likely prevent the microphone in the steering wheel from measuring tire noise with sufficient fidelity. On the other hand, the authenticity is established for the installed tire, not just the tire in the shop. Because the perceptual hash is a one-way function, the acoustical noise signature cannot be regenerated from a captured hash. Roadside microphones cannot use the perceptual hash to identify a vehicle. Thus, the owner privacy is preserved.

When do you allow the cloud to know where your car is? While advances in technology enhance safety and convenience, the technology also generates a significant amount of sensitive or personal vehicle data, such as location (Good and Benaissa, 2013; Zhang et al., 2022) With respect to privacy, a non-connected car currently allows location to be known under two conditions. One involves utilizing devices that are distinct from the automobile. Another requires historical information linking a VIN to location, such as maintenance records or CARFAX reports. In connected and autonomous networks, GPS and other sensors collect real-time location data, which can be compromised if connectivity includes cloud based applications (i.e., infotainment). Automated counterfeit detection systems in vehicles require privacy considerations. We incorporate hashing as a means to preserve privacy in connected and autonomous vehicle networks.

A proposed architecture is shown in Figure 8. A key component of the TIN/acoustics cyber-physical trust anchor architecture is tire-to-vehicle authentication via an acoustical cyber-physical trust anchor. The on-vehicle authentication reduces a potential attack vector in which the customer is shown an authentic tire in the salesroom, but the mechanic, working out-of-sight of the customer, installs a counterfeit tire.