Anti-Counterfeit Technologies for Microfluidic “Lab-on-a-Disc” Systems

Non-genuine medical products, including diagnostic devices, have become a lucrative business for fraudsters, causing significant damage to revenues and reputation of companies, as well as posing a significant risk to the health of people and societies. Along a “digital twin” representing centrifugal microfluidic flow control on exemplary “Lab-on-a-Disc” (LoaD) systems, a novel, two-pronged strategy to safeguard miniaturized point-of-care devices by means of secret features and manufacturing challenges is outlined; such “hardware encryption” is flexibly programmed for each chip during production, and deciphered from a secure, local or online database at the time of use. This way, unlicensed copying may be efficiently deterred by an unfavourable economy-of-scale, even in absence of legal prosecution.


Introduction
The globalization of trade and its complex supply chains increasingly attract unlicensed producers into a wide range of markets. In addition to their direct impact to sales, such fraudulent behavior substantially undermines significant efforts and investment into research, intellectual property, production, regulatory approval and marketing. Furthermore, counterfeits typically feature subprime quality, which compromises user experience and trust in their brand, especially when the consumer cannot easily distinguish adulterations from the original.
A particular issue constitutes forgery of health-relevant products such as drugs, medical devices and diagnostics test kits [1][2][3][4], which is the main application area of this work. For these illegitimate items, non-compliance is likely to impose severe or even fatal consequences for patients, also entailing massive grief for their social environment, and huge costs for contingent medical treatments, recovery and companies.
A range of anti-counterfeit technologies have been established that are suitable for different types of products and price regimes. Generally, their incorporation is based on a compromise between various factors, such as the required degree of security, acceptable cost, needs on equipment, infrastructure, time and skill level for implementation on site, operational robustness, and the possibly impaired user experience. If the portion of counterfeits remains rather small, providers might even turn a blind eye on the issue, e.g., as they have a negligible impact on their overall business, or to avoid scaring their customer base with adverse narratives.
Here we assume that counterfeiting is motivated by mere commercial objectives; the core strategy to combat forgery roots in its economic disincentivization by accounting for the full cost structure, involving one-off "fixed" and variable "per device" components. It needs to be considered that the forger can bridge a knowledge-gap by stealing intellectual property, e.g., through reverse engineering, by skipping expensive measures for obtaining regulatory approval, and by parasitically benefiting from the marketing; yet, part of the upfront invest, e.g., in infrastructure, equipment and process development, incur at a similar magnitude for both parties. So, assuming criminal prosecution cannot effectively discourage unlicensed sales, the original provider ought to make illegal copying unprofitable regarding the full balance sheet. In the context of microfluidic systems in the focus of this paper, a dual approach comprising of covert fluidic features and demanding manufacturing quality is pursued to thwart the profitability for the potential fraudster.
Among the common methods to prevent or clearly disclose non-authentic products are optical or electronic labels. Similar to read-only type data storage media like CDs or DVDs for delivering original software (before downloads became the predominant retail channel), labels may contain distinct features, like holograms, that may be techno-economically hard to reproduce; users can thus simply spot counterfeits by eye-balling, or under exposure to certain illumination conditions, e.g., cheap UV lambs, polarized or even ambient light. The identifiers might be attached to the packaging or, even more secure, to the product itself, ideally in a way that they cannot be removed and transferred without visible or functional damage. Similar to bank notes, certain security features might, even literally, be weaved into the fabric, or constitute an integral part of the product.
Label-based anti-counterfeit strategies for protecting goods and supply chains are increasingly discussed in the context of the distributed ledger technology. Akin to common password verification, a public key coming with the product is paired with a unique private key that can be retrieved from a secure online database., e.g., a blockchain [5,6].
Due to the unidirectional and omnipresent nature of the centrifugal field, valving constitutes a pivotal component of such LoaD technologies. To comply with their low complexity and modular operational paradigm, many centrifugal platforms exclusively employ rotationally actuated valving techniques where the spinning-induced centrifugal pressure head on a co-rotating, disc-based liquid volume is opposed by physical barriers, or combined with pressures, e.g., imposed by capillary action or pneumatic mechanisms.
Based on a virtual, "digital-twin" [84-86] approach of such CP-DF valving, this paper elaborates novel anti-counterfeit strategies on a component and system level. After briefly reviewing the underlying physical model, the linkage of rotational flow control with design parameters and experimental tolerances is established. Based on these dependencies, secret features and tight requirements on manufacturing quality efficiently debunk forged products, or disincentivize their market introduction. These elements are either fully integrated into main fluidic network [81] implementing the assay protocol, or as functionally and spatially disjunct entities.
The first section illustrates the overarching techno-economical strategy of combatting counterfeits. Then, relevant, rotationally controlled valving techniques at the heart of the anti-counterfeit function presented here are briefly outlined along the "digital twin" method. The next section describes hidden features programmed during manufacture of the LoaD, considering that individual customization of each device needs to comply with acceptable cost of goods. Followingly, the intimate interplay of demanding manufacturing tolerances with CP-DF valving on the LoaD renders forgery economically highly unrewarding. Then, concepts to unambiguously indicate resultant failure of fraudulent devices to the user, i.e., how to translate a fluidic event into binary information, while avoiding substantially enhancing technical complexity and cost of the system, are surveyed before summarizing and providing an outlook on future work.

General Anti-Counterfeit Strategy
It may well be assumed that, if equipped with sufficient resources and competence, any reasonably conceivable protection of the genuine device can be circumvented to provide equivalent functionality. If, for instance, a powerful secret service intended to fake a device at "any" expense, they would most likely find a way to trick the mechanism. This seems to have been the case when successful tampering of the highly sophisticated sealing of bottles containing (urine) samples from athletes for anti-doping campaigns has been discovered [87]; to the tremendous astonishment of practically all technical experts [87], this "bullet-proof" anti-forgery technology, that stood firm against many multi-stage legal challenges, has terminated many successful careers in Olympic and professional sports, and ripped "clean" competitors from fame and fortune.
Here, mainly commercially motivated anti-counterfeit is addressed, which comes down to an economic competition between the original producer and the forger. Assuming it were to cost in the vicinity of 100 US$ to print an illegitimate 100-US$ bill, the mere lack of an attractive profit margin would discourage offenders, even in practical absence of the risk of criminal prosecution.
On behalf of the business, we look at a typical, yet slightly simplified structure for the cost of goods the point-of-care devices considered here. There are, on the one hand, one-off, upfront expenditures; these categorize into the development of the product technology and its (mass) production process, which might be cut short by the forger, e.g., by reverse engineering. Regarding other one-off expenditure, the fraudster can skip lengthy and expensive regulatory approval and just viciously piggyback on marketing campaigns. Conversely, upfront investment into infrastructure and equipment, and variable costs for making each device might be of similar scale for either party.
So, at the end of the day, given purely economic incentivization, and that (serious) legal prosecution turns out to be inefficient, the original provider has to undermine the income generation of the counterfeiter through properly working devices. These considerations thus lead to the back-of-the envelope calculation profit margin = (retail price) − (upfront invest) (sales number) − (cost of goods) specifying the (pre-tax) income holding for both, the genuine, as well as the unlicensed supplier. In other words, relation (1) reflects that the business case hinges on the ability to leverage favorable economy-of-scale effects. Research-intensive, highly regulated medical products, such as the microfluidic LoaD for point-of-care applications, often involve extraordinarily high initial investments while production numbers may be appreciably lower than for commodity consumer products.
Looking at the constituents of (1), the original supplier thus needs to force the counterfeiter into high advance expense, e.g., by preventing the forger from getting access to relevant know-how on behalf of product function and production technology; also, much larger number of products will compensate for the comparatively negligible marketing and regulatory costs for the copier. Furthermore, a secret, possibly individualized feature may be integrated, which is much cheaper to set at the factory, than, if even technically possible at all, to imitate by inspecting and customizing each product separately. Examples for such covert parameters are the loaded liquid volumes, which is flexibly set by the dispenser, or a pneumatic volume, which is customized by perforation of membranes; these features may only be deciphered through linking a label on the LoaD to an entry stored on a well-secured database.
As an alternative (or complement) to such covert features, counterfeiting might also be fought by demanding high manufacturing precision for assuring proper flow control, which can either not be delivered at all, or not at an economically viable interplay of upfront or variable cost by the counterfeiter. With supremacy of manufacturing technology by the genuine provider, whether on an absolute or techno-economical scale, unlicensed products deliver subprime function. Requiring exceptional quality obviates the need for labels or placing distinct, space-consuming structures on the device.
Both anti-forgery techniques induce malfunction of (an unacceptably large fraction of) counterfeit devices. As regulatory approval often requires incorporation of failure detection, e.g., to avoid false negatives on bioanalytical testing for disease markers in patient samples, the same mechanism might be employed to disguise counterfeits. The concrete implementation of the detection schemes largely depends on the application context, and thus falls outside the scope of the work.

Centrifugo-Pneumatic Dissolvable-Film Siphon Valving
Advanced flow control capabilities underpin the integration of bioanalytical protocols, that are normally automated by liquid handling robotics, on microfluidic chips. For the centrifugal systems considered here, orchestrating sequential assay steps of multiple, simultaneously loaded bioliquids, such as samples, reagents and buffers, requires robust mechanisms to transiently retain liquid during execution of LUOs. As outlined in the introduction, a wide range of active and passive valving concepts has been devised for LoaD platforms over the last three decades.
In this section, a functional model for merely rotationally actuated, centrifugo-pneumatic (CP) dissolvable-film (DF) siphon valves is elaborated; this digital twin then supports the development of novel anti-counterfeit strategies. The same methodology may readily be applied to alternative centrifugal flow control techniques.

Layout and Mechanism
The multi-step loading procedure of a CP-DF siphon valve is portrayed in Figure 1. At first, a liquid volume possessing a density is loaded through its inlet reservoir into a given valve structure Γ located at the radial position .
is metered to match the dead volume of the (tiny) isoradial channel. At this point, an air pocket is pneumatically isolated at a pressure from the ambient pressure , which is commonly near standard pressure = 1013.25 hPa. For the main part of this work, we assume ≈ ≈ ; the impact of possible deviations will be briefly discussed in the context of (10).
Next, the initially loaded liquid volume is topped up to > , thus creating a (contiguous) liquid distribution Λ with a front meniscus at a radial position in the inbound segment of (radial) length , and < in the inlet reservoir. The spreading Λ, and thus also and , are functions of the angular frequency = 2 ⋅ . Below a critical retention rate, i.e., < Ω, the liquid front stays below the crest point of the radially inbound part, i.e., > = − ; the siphon outlet continues to a recess chamber accommodating a DF membrane located at > . This DF transiently seals a vertical via to an outlet, e.g., based in a lower disc layer, leading to a downstream chamber. The high-pass CP-DF siphon valve opens at > Ω * with the release rate Ω * > Ω once a minimum liquid volume has reached, and thus disintegrated the DF.

Critical Frequencies
For a liquid level difference Δ = − , and a mean radial position ̅ = 0.5 ⋅ ( + ) of Λ, a centrifugal pressure head (2) drives the liquid towards the recess until it is balanced by the pneumatic counter pressure with the initial and the actual gas volumes and < , respectively. The compression volume is composed of a main segment , , the inbound section ⋅ of cross section , and the (typically minor) contributions from the dead volumes of the DF chamber and its narrow interconnecting channel segments . Note that for typical values = 1000 kg m , ̅ = 3 cm, Δ = 1 cm, and 2 = 25 Hz ⁄ , the induced pressure head ≈ 74 hPa (2) amounts to only about 1 14 ⁄ of .
At a given spin rate , Λ( ), and hence the radial position of the forward meniscus in the inbound section of the siphon ( ), are derived from the hydrostatic equilibrium + = (4) between the forward and backward pressures → = + (2) and ← = (3), respectively. A retention rate is obtained which depends on radial position , the loaded liquid volume , the liquid density , the ambient pressure , and the valve geometry Γ including the compression ratio ⁄ , with = − ⋅ at = Ω. In the general case, further terms representing the capillary pressure ∝ ⋅ cos Θ⁄ with the channel diameter , the surface tension , and the contact angle Θ between the liquid and the wall may play a role.
(a) Initial loading step of the small isoradial channel of dead volume at = 0.
(b) Retention after loading the liquid volume to Γ at < Ω (c) Liquid release at > Ω after a sufficient volume has arrived in the DF chamber, i.e., = Ω * .
(d) Refined, multi-segmented layout for design optimization during liquid retention ≤ Ω. The retention rate Ω (5) sets the maximum field strength = Δ ⋅ ℛ ⋅ Ω (6) that can be delivered on a medium, e.g., a bioparticle such as a bacterium, cell or exosome, of differential density Δ with respect to the background liquid located at a radial position ℛ, often with ℛ ≈ , during execution of an LUO. The same formula (5) also provides the release rate

Unmasking Counterfeits
The centers of the frequency bands {Ω ± ⋅ ΔΩ} around Ω (5) and Ω * (7) are determined by the target values of , Γ, , , , and (for Ω * ). According to (8), their standard deviations ΔΩ and ΔΩ * , and thus their (approximate) band widths 2 ⋅ ⋅ ΔΩ, are governed by the partial derivatives , evaluated at { }, and the tolerances in the experimental parameters Δ , ΔΓ, Δ , Δ , Δ , and Δ . For reliable operation as characterized by the confidence factor , each LUO in step needs to be executed with inside the (green) corridors Ω * + ⋅ ΔΩ * < < Ω − ⋅ ΔΩ , while the bands {Ω ± ⋅ ΔΩ } ought to be crossed for subsequent release. As it is not advisable to change Γ in mass manufacture, the preferred "programmable" parameters are , for Ω, and also for Ω * , which may flexibly be configured by the reagent dispenser and pick-an-place system at the fab define a robustly working spin protocol ( ). Towards large tolerances {Δ }, e.g., for an on-disc liquid reagent Δ , machining tolerances ΔΓ in the depth and planar directions Δ and Δ , the related standard deviations ΔΩ and ΔΩ * lead to directly adjacent or overlapping bands. Poorly known parameters { , , } and subprime tolerances {Δ , Δ } thus make it extremely difficult for forgers to place a spin protocol ( ) inside the "safe" (green) bands around { } while carrying out {LUO }.
Following formulas (5), (7) and (8), and Figure 2, the spin protocol ( ) can be adapted to stay inside the corridors Ω * + ⋅ ΔΩ * < < Ω − ⋅ ΔΩ outside the zones of uncertainty {Ω ± ⋅ ΔΩ }; this assures, with sufficient confidence quantified by , that the loaded valves remain closed during execution of LUOs, while fully crossing the interstitial "forbidden" zones to prompt consistent valving. The set of {Ω ± ⋅ ΔΩ } thus represents a unique fingerprint for each disc, which is essential to derive a functionally robust spin protocol ( ).
In a certain way, the rotationally actuation of a concurrently loaded network valves on the centrifugal microfluidic platform displays striking analogies the radio communication. For practical reasons like motor power, torque, reliability and safety, the spin rate is confined to an interval restricted between and (Figure 2) on the LoaD, which corresponds to the finite frequency domain designated to a certain type of radio transmission assigned by the proper authorities. These envelopes are shared by non-overlapping bands assigned to each subset for their concurrently released liquids co-rotating on the (finite) disc space, and each station simultaneously broadcasting in the same (limited distal) range of the utilized radio frequencies.
Even if the counterfeiter gets knowledge of { }, the resulting { } in the safe corridors for keeping the liquid at bay while performing the LUOs can be deliberately spaced so tightly that the associated forbidden bands {Ω ± ⋅ ΔΩ } overlap for inferior, i.e., large {Δ }. For achieving such very demanding (machining) tolerances {Δ }, the forger is driven into high upfront cost for tooling and the sophistication of the manufacturing process, which are hard to recover at markedly lower sales numbers (1). Resultant high failure rates can be detected by the instrument, indicated to the user and transmitted to the genuine provider, who may then return a warning on a potential problem with the source of the LoaD cartridges. Both methods, the secrets and the manufacturing challenge, may evidently be combined to enhance protection.

Sensing
Liquid volume metering resides at the core of debunking a forged LoaD device along the previously outlined fluidic anti-counterfeit strategies; a forged device is likely to deliver filling levels that fall outside a given target range. The first anti-counterfeit strategy of disc-engraved secrets works similar to a numerical code on a safe requesting a sufficient number of "digits" for opening; the second method demands challenging manufacturing tolerances. In either case, the majority of counterfeit devices will fail. This section first explains the volume metering function that can be derived from the CP-DF siphon valving described in the context of Figure 1, before covering liquid level detection.

Liquid Volume
CP-DF siphon valves (Figure 1) may also be employed as sensors for checking whether a loaded liquid volume lies within a certain interval < < between upper and lower boundaries and , respectively. Accordingly, an unknown amount is loaded to the inlet of Γ. The volume is probed by setting to the retention and release thresholds Ω and Ω * , respectively, as calculated for . Factoring in the tolerances ΔΩ and ΔΩ * (8), we can determine a volume range ( = Ω * + ⋅ ΔΩ * ) ≤ ≤ ( = Ω − ⋅ ΔΩ) (9) for with the confidence factor ; relation (9) holds in case the valve is behaving "properly", i.e., staying closed for ≤ Ω, and forwarding a minimum liquid volume to reach and thus clear the DF in the outer receiving chamber at ≥ Ω * . A function = ( ), which grows towards decreasing , can be obtained by resolving Ω = Ω( , Γ, , , ) in (5) for ; the uncertainty Δ in determining the initially unknown evidently correlates with the standard deviations {Δ } of the other input parameters { }. For performing this algebraic conversion, the radial product ̅ Δ needs to be expressed by and the geometrical measures of Γ (Figure 1), i.e., the depths, widths, and lengths (or dead volume, cross sections, and axial extension) defining each of its segments.
Similarly, previous work on "logical" flow control [76,80] provides a fluidic method to gauge whether the liquid volume in a given chamber falls within a target range; a maximum of incoming liquid volume defined by the dead volume between the location and the bottom of its chamber in a CP-DF siphon valve (Figure 1) can be assured in absence of outflow at ≥ Ω * . Vice versa, a lower volume boundary can be guaranteed for outflow above the same release rate ≤ Ω * . There are further fluidic configurations providing a digital yes-no answer for indicating the presence a defined amount of liquid in a designated target chamber, mostly based on overflow principles.

Detection
Quantitation of liquid volume often comes down to liquid level detection. This may, for instance, simply be implemented by, potentially microscope assisted, eye-balling and gauging the meniscus position against calibration marks imprinted on the surface of the LoaD. Evidently, an unambiguous, objective binary method is more suitable for displaying such a potentially consequential statement and conveniently to the user, and making it amenable to digital records, statistical evaluation, and transmission to local or remotely stored databases.
Many schemes for liquid level sensing are conceivable, which are overwhelmingly based on the physical characteristics of liquid (water) and air, such as their divergent optical or electrical properties. Ideally, the detection scheme should align with the flow control, manufacturing and low-complexity instrumentation paradigm of the LoaD platform. As an example, optical absorption [88] or total internal reflection (TIR) [89,90] based on the refractive index can be transduced by rather simple, instrument-based transduction concepts.

Disc-Encoded Secrets
Concealed individual properties of the LoaD that are impossible, or at least very cumbersome and costly, to decipher by the forger, while rather easy to flexibly "program" at the factory, give the legitimate manufacturer a leading edge in terms of variable costs (1). These covert and unique signatures of each fluidic device may either be represented by separate structures, thus consuming additional, potentially precious disc real estate, or incorporated into the mainframe layout automating of the assay protocol. Figure 3 illustrates a possible embodiment of disc-specific fluidic secrets for information management which assures their secure storage and retrieval. The instrument scans a distinctive disc identifier that is irreversibly attached the LoaD, e.g., by a permanent sticker, imprint or engraved mark. A decode list, which may be safely stored locally or remotely, e.g., on a blockchain, assigns this public key to the disc-specific set of {Ω } (5) and {Ω * } (7), or the related secret parameters { } to calculate the allowed -corridors slotted between forbidden bands {Ω ± ⋅ ΔΩ } (Figure 2). The required spin protocol ( ) is then forwarded to the controller of the spindle motor. Importantly, the so obtained -zones still have to provide suitable hydrostatic pressure (2) or field strength (6) to properly complete their upstream LUO, e.g., by extending the duty intervals. Figure 3 Setting of disc-specific spin protocol ( ) from parameters { }, or their resultant thresholds {Ω } and {Ω * }, retrieved from password-protected database. Each disc possesses a unique ID, or public key, that is, for example, directly printed or irreversibly bonded with a sticker to its surface. This ID is displayed in a machine-readable fashion, e.g., as QR code, and read out by a scanner. An encrypted database stores a dec-list which either provides relevant manufacturing secrets, e.g., { , , }, or the associated protocol ( ) to the run by the spindle motor. This list may be stored on the instrument, or retrieved from a well-protected database, e.g., a distributed ledger on a blockchain.

Implementation
Amongst the parameters { } that can be tailored along fabrication are , Γ, , and (for Ω * ), while the liquid density is prescribed by the (typically aqueous) sample and assay reagents, and the ambient pressure by the local weather and altitude that may be measured on the spot. However, in particular in mass replication for commercially viable production, e.g., by injection molding, there are significant expenses for tooling and process optimization by new locations and designs Γ [91]. Hence, from an economical perspective, variation of Γ and should be avoided for configuring the concealed fingerprints of a disc in -space.
However, the replication tool may display chambers exhibiting multiple interconnected compartments or outlets whose open state can be set by pick-and-place robotics, e.g., by the location and physico-chemical properties of the sealing films. Hence, for example, amongst the mathematically available options to tune Ω (5) and Ω * (7) with Γ, customization of the compression volume with barriers allows to define , and the radial position of the outermost open outlet in the recess chamber determines for tweaking Ω * .
It has been shown that such fluidically isolating membranes may be removed by various methods, e.g., mechanical perforation at the factory, through (laser) irradiation [92], local heating [93], by a unit on the instrument, or by chemical stimuli [67], e.g., a solvent specific to the formulation of the DF. For an anti-counterfeit system where a distinct label is assigned to each individual disc, the faker would consequently have to, for instance, either physically inspect each membrane from the outside, to provide non-genuine instrument, or to hack the database for bypassing this protection.

Loaded Liquid Volume
The original provider may also freely define the volumes of on-board stored liquid reagents that are loaded, e.g., by a pipetting robot, during disc fabrication. At a given spin rate , the (secret) amount of changes the liquid distribution Λ( , Γ, , , ) with its inner and outer menici at and in the reservoir and inbound channel, respectively, and thus the radial product ̅ Δ in (2). Therefore, the critical spin rates Ω (5) and Ω * (7) directly depend on , so a systematic adjustment of the spin rate protocol ( ) is necessary to assure proper execution of the assay protocol. Vice versa, if is tuned, e.g., through closed loop flow control, to settle the outer meniscus at the crest point of Γ, i.e., at = = − (Figure 1), the position of the rear meniscus in the inlet reservoir also shifts with .  Figure 4a displays how the retention rate Ω (5) of a CP-DF siphon valve that has been geared to retain at Ω 2 ⁄ ≈ 22 Hz, with default parameters, can be manipulated by adjusting the loaded liquid volume . Alternatively, the inlet reservoir might be compartmentalized in a way that the radial product ̅ Δ in (5) stays constant by proper scaling of the cross section , or width (at = const.) of the inlet reservoir, with the same factor as . Figure 5 schematizes a possible embodiment of how the volume of the pneumatic chamber , may be varied at the factory by perforating the membrane(s) which initially seal a vertical via to a lowerlayer connection to an additional volume by , with ∈ {1,2,3,4,5}. These openings may be occluded so that the derived retention and release rates Ω (5) and Ω * (7) cannot be determined by a potential forger. Figure 4b reveals the scaling of Ω (5) with the total volume of the compression chamber . The strength of the covert "key" is determined by the number of independently configurable membranes. Figure 5 Compartmentalization of compression chamber. A subset of membranes may be opened during production to connect the main compression volume , through designated vias to a subset of volumes { , }. In the displayed example, the main compression volume amounts to , + , + , . The state of the membranes may be concealed from inspection, and is only disclosed through a decode list assigning a key coming with each disc, e.g., locally stored or online stored. This manufacturing secret prevents a forger from calculating the critical frequencies rates Ω (5) and Ω * (7) which are needed for proper centrifugal flow control underlying the automation of a bioassay protocol.

Release Volume
A CP-DF siphon valve is opened after the front meniscus has passed the crest point at ( = Ω) = ( Figure 1) and a (minimum) liquid volume has arrived in the outer recess to dissolve the local DF at ≥ Ω * (7). For a given geometry Γ, e.g., inscribed by the tool for injection molding, the offset of the release rate Ω * with respect to Ω (5) may thus be primarily specified by the radial position of the radially outermost opening within a group of membrane-sealed outlets situated in the receiving chamber. (b) Release rate Ω * (7) of an outer chamber of volume capacity = 5 µl that opens after arrival of the liquid volume ⋅ = ⋅ Δ . Therefore, = 0 corresponds to the retention rate Ω (5), and, e.g., = 0.5, as indicated by the vertical gridline, to a designated outlet positioned at half the chamber height.  Figure 6a sketches an exemplary, rectangular shape of the receiving chamber with a cross section where the designated outlet is located at a radial height Δ measured from its floor; this location corresponds to the radially outermost outlet that is either left open, or sealed with a DF membrane in CP-DF siphon valves. For a total dead volume of the receiving chamber, a fraction ⋅ = ⋅ Δ needs to enter the receiving chamber to usher release at ω ≥ Ω * (7). Figure 6b illustrates the change in Ω * as a function of the fractional occupancy of the full volume of the receiving chamber, in this example = 5 µl, needed to arrive for triggering liquid transfer. A potential forger might miss the true Ω * set at the factory by about 1.5 Hz, thus leading to failure of the liquid handling protocol ( ) by missing the operational frequency corridors (Figure 2).

Membrane Properties
The formulation and thickness of the DF membranes impact the time intervals { , } required for their disintegration in a given step . While they can readily be defined by the choice of the membrane during manufacture of the LoaD, these characteristics are very hard to reconstruct a posteriori by a fraudster. With { , } known by the original manufacturer and, e.g., available to the instrumentbased controller of the spindle motor through a mechanism as portrayed in Figure 3, the spin protocol ( ) may easily be adjusted to { , }. For a fraudster, the formulation of the DFs, and thus these timings { , }, are unknown, so ( ) will unavoidably run out of sync over successive steps .
Previous work, e.g., on rotational-pulse actuated centrifugal valving [94], is based on the decrease of the retention rate Ω ( , ) while liquid , ( ) is arriving after release at > Ω * from the previous liquid handling step − 1. So, for instance, if the dissolution Challenging Precision

Tolerances in Manufacturing and Liquid Loading
The disc layout might require challenging precision {Δ }, e.g., regarding manufacturing and volume metering, as subprime quality leads to too narrow, or even overlapping bands {Ω ± ⋅ ΔΩ }, thus causing flaky or even entirely dysfunctional flow control on LoaD systems. This concept takes advantage of the fact that the original product still owns a decisively greater market share to leverage commercially very important economy-of-scale effects (1), which tend to drastically slash or even eliminate the margin for illegal suppliers. This is rooted in the fact that, in the same way as most singleuse microfluidic products, also commercial LoaD systems are predominantly mass manufactured by tool-based polymer mass fabrication techniques, such as injection molding [91].
Making high-quality tools and process development for optimizing mold flow constitute major upfront costs (1). After their establishment, the economic recovery of these "sunk" costs tends to account for the lion share of the cost per chip. This general correlation particularly holds for rather moderate production numbers compared to other consumer markets. The resultant lack of revenue may thus disincentivize counterfeiters.  Figure 7 reveals the dependency of the standard deviation ΔΩ to (exclusive) variation of (a) the manufacturing tolerance, i.e., the spread of the machining depth Δ and width Δ from their target values in Γ, and (b) the standard deviation of the loaded liquid volume Δ from . Hence, subprime quality entails poor precision, such as Δ = Δ ≈ 100 µm or Δ ≈ 10 nl, to alter the ΔΩ/2 in the region 1 Hz obtained for reasonably ambitious tolerances by about a factor of 3. Figure 7c displays a structure that has been computationally optimized [82] with respect to Figure 1 to further amplify ΔΩ (8) in response to tolerances {Δ }. As it would, at the same time, deteriorate the overall reliability of the original product, such a design change of Γ might be better implemented as a distinct, fluidically independent validation structure on the LoaD. (However, this would sacrifice precious disc space needed for larger-scale fluidic integration.) In the spirit of Figure 2, increased standard deviations ΔΩ produce overlapping bands without leaving space for allowed zones where the spin protocol ( ) can safely execute LUOs. Furthermore, for still assuring operational reliability corresponding to, e.g., = 3 (8), the associated width of the forbidden bands expands from 2 ⋅ ⋅ ΔΩ 2 ⁄ ≈ 6 Hz to 18 Hz. Within practical frequency corridor between and (Figure 2), e.g., spanning 40 Hz, the maximum number of consecutive release steps drastically shrinks from 40 6 ⁄ ≈ 6 to 40 18 ⁄ ≈ 2. Overall, subprime tolerances bring about significantly higher failure rates of multi-step liquid handling protocols on LoaD systems.

Reproducible Filling Dynamics
For the sake of simplicity, the basic mechanism of the CP-DF siphon valving depicted in Figure 1 is idealized in various aspects. In particular, it is assumed that the initial pressure ′ within the enclosed gas pocket equals the ambient pressure ≈ ( Figure 1a). However, certain hydrodynamic effects, e.g., induced by air entrapped in the liquid flow, may lead to = (1 + ) ⋅ with a coefficient ≠ 1, thus causing a potentially significant shift in the critical frequency Ω ≠ Ω (5).
For a given geometry Γ, the offset of Ω with respect to its hydrostatic approximation Ω chiefly depends on the rotational frequency , where small speeds best approximate the quasi-static model. On the other hand, tolerances {Δ } in the geometric input parameters { } impact the flow properties, and thus the deviation of from unity. Overall, LoaD devices produced by a counterfeiter at low manufacturing precision will exhibit an increased standard deviation ΔΩ, and therefore widen the forbidden bands {Ω ± ⋅ ΔΩ }, and resulting failure rates, following the same reasoning as for the hydrostatic model.

Concatenation of Effects
The imprecision of manufacturing parameters {Δ }, but also close misses of the secrets encoded by (select) { }, might not necessarily cause complete malfunction of a given CP-DF siphon valve ( Figure  1). Instead, a discrepancy of the assumed from the required actual spin rate curve ( ), owing to the lack of knowledge of the "true" input parameters { }, may lead to a deviation of the transferred volume , − , out of step that represents the inlet volume , of the following valve + 1. According to Figure 4a, a larger deviation from the specified may ensue a sizable shift in the critical spin speeds Ω and Ω * . Even slight deviations in each step thus aggregate along the liquid handling sequence, so that, for example, at a downstream step > , there may not be enough liquid volume entering the receiving chamber to open its DF at = Ω * . The consequential, premature interruption of the assay protocol may then, for instance, be picked up by an instrument-mounted liquid level sensor.

Summary & Outlook Summary
Bioanalytical point-of-care devices are prone to counterfeiting. Based on the comparison of the cost structure composed of one-off and per-chip constituents for the development and (mass) production costs of such devices, two fluidic strategies have been developed to disincentivize forgery, even given that legal prosecution might not be enforceable.
For the first time, the anti-counterfeit mechanisms are integrated with the fabrication and flow control mechanism coordinating the liquid handling sequence of the bioanalytical assay protocol. As a representative use case, rotationally actuated centrifugo-pneumatic dissolvable-film (CP-DF) siphon valves on microfluidic Lab-on-a-Disc system are investigated. Their key performance parameters are the critical frequencies Ω and Ω * for retention of the liquid volume during processing of laboratory unit operations, and for the release for downstream step, respectively.
The first approach exploits hidden features individually encoded on each disc which, for instance, may be disclosed by connecting a unique visible label to a secure local or online data base. These secrets are flexibly configured, e.g., by common pick-and-place systems, during manufacture, without requiring a change in the basic fluidic disc layout, to avoid using a repertoire of costly tools for injection molding. In this work, these confidential features concern the loaded liquid volume, the dead volume of the pneumatic compression chamber and the liquid volume required to open a dissolvable film transiently sealing the outlet.
The other strategy, which might readily be combined with the first, is based on the superior manufacturing precision the genuine manufacturer may possess compared to the illegitimate copier. Larger tolerances broaden the statistical spread of the critical frequencies, which enhance failure rates of the device, especially when provoked by low-tolerance structures, or by accumulation of such deviations over multi-step liquid handling sequences. With the described anti-counterfeit mechanisms, fraud can be unmasked by various types of liquid-level detectors, for instance, rather simple, instrument-mounted optical sensors, which may also be used for closed-loop flow control to support regulatory approval. These anti-counterfeit techniques based on covert features and superior manufacturing may be extended to other microfluidic systems, in particular those based on rotationally controlled centrifugal valving schemes.

Outlook
Once access to suitable facilities and equipment for mass production and characterization of statistically sufficient numbers of LoaD devices are available, which proves to be challenging for most academic organizations, the digital twin the valving mechanism should be experimentally validated. Furthermore, the underlying fluidic model should certainly be appreciably improved, e.g., by the described hydrodynamic effects. Also, the basic valve geometry should be sophisticated, e.g., by optimized, e.g., by rounded and 3-dimensional structures to mitigate the impact of irreproducible priming effects in the spin rate thresholds; note that its current design, which is primarily composed of cuboid segments, was mainly motivated by the capability to express critical frequencies in closedform analytical equations, which are best suited to disclose semi-quantitative trends. For these highly desirable advancements, it is planned to implement participatory research model incentivized by blockchain-based crowdsourcing [95][96][97][98] of researchers, facilities and equipment.

Appendix
The structure Γ, their radial positions and loaded by liquid volumes can be varied across a multidimensional parameter space, e.g., to tune the retention and release rates Ω and Ω * , reliability, integration density, or other key performance indicators. Table A1 provides an overview or generic values for the parameters displayed in Figure 1, which can be used to initiate design optimization according to target metrics.  Table A1 Default geometrical parameters and relationships of basic CP-DF siphon valves (Figure 1). The resulting critical spin rate Ω( , Γ, ) 2 ⁄ ≈ 25 Hz. Minimum lateral dimensions are given by the smallest practical diameter of milling tools (200 µm). As tools for injection molding are often adopted from optical data storage (e.g., CD, DVD, Blu-ray), a central, 1.5-cm diameter hole and a disc radius of 6 cm with thickness around 1.2 mm, fluidic structures Γ may need to stay within the radial interval between = 1.5 cm and R = 5.5 cm, and an upper limit for the depth of about 1 mm, as chosen for the main parts of geometries Γ. For large lateral extensions or small aspect ratios, sagging of the lid, which is often provided by a rather flexible foil, may significantly alter the nominal volume capacity, also in response to the pressure, and might even lead to sticking to the bottom of the cavity.
The default tolerances Δ in the chief input parameters amount to:  Lateral structuring Δ = Δℎ = 20 µm  Vertical structuring Δ = 30 µm  Precision of liquid volume Δ ⁄ = 1%  Ambient pressure Δ = 40 hPa In the digital twin model, different standard deviations {Δ } may easily be plugged into the calculations.