  The complexity of today's supply chain, organised in several tiers and
including many companies located in different countries, makes it challenging
to assess the history and integrity of procured physical parts, and to make
organisations really accountable for their conduct. This enables malicious
practices like counterfeiting and insertion of back doors, which are extremely
dangerous, especially in supply chains of physical parts for industrial control
systems used in critical infrastructures, where a country and human lives can
be put at risk. This paper aims at mitigating these issues by proposing an
approach where procured parts are uniquely identified and tracked along the
chain, across multiple sites, to detect tampering. Our solution is based on
consortium blockchain and smart contract technologies, hence it is
decentralised, highly available and provides strong guarantees on the integrity
of stored data and executed business logic. The unique identification of parts
along the chain is implemented by using physically unclonable functions (PUFs)
as tamper-resistant IDs. We first define the threat model of an adversary
interested in tampering with physical products along the supply chain, then
provide the design of the tracking system that implements the proposed
anti-counterfeiting approach. We present a security analysis of the tracking
system against the designated threat model and a prototype evaluation to show
its technical feasibility and assess its effectiveness in counterfeit
mitigation. Finally, we discuss several key practical aspects concerning our
solution ad its integration with real supply chains.
