A method to prevent un-authorised clone is to use a dedicated crypto authentication chip. The Atmel ATSHA204A is such a device and it is very cheap (< $0.4) . The creator can program his personal unique keys into the device which can be authenticated in firmware or application software. The firmware or the application program has to be closed source for this to work.
And you will get manufacturing process + BOM a lot more expensive for nothing. If you rely exclusively on this - you have weak spot, as soon as they find way to extract private keys (not only chip, might be in logistics/manufacturing process), you are doomed.
Also i dont like idea adding to product something, that users will pay for, and it is not really useful to anything else than product authenticity verification. I might understand it for something that is critical, like cryptocurrency tokens, but stuff measurement equipment - no.
Most common way - you just need to get to make unique token for each device, preferable linked to ID of MCU or peripherals(and other ID's that are too expensive to change/make same as yours), that are hard to change (like STM32 Unique ID). Keep an eye in each unique part of your manufacturing that you can use for this purpose. Sometimes it is even specific to your manufacturer PCB impedance or trace width
![Smiley :)](https://www.eevblog.com/forum/Smileys/default/smiley.gif)
And keep registry of this parameters, and especially unique ids for manufactured devices.
If you dont trust factory - you can have secondary step in token deployment, for example generating second signature on first use. E.g. you can have second signature for same serial number/initial token.
And you dont need to deploy firmware with full verification of token from first moments, you can do it later. Especially that part which rely on ID of hardware
![Smiley :)](https://www.eevblog.com/forum/Smileys/default/smiley.gif)
First you might just insert unique token and keep it.
Then you add part that will verify it. Most likely they will think "ah this fool trying to defeat us" and will spend resources to decap MCU and copy one of signatures in all their clones.
Most important part - they will invest in that $$$.
Then, you wait best moment and can blacklist it in new firmware/activation. They lost their investment. Most likely they will give up and curse you a bit.
Next bullet - in new firmware release or activation add procedure to verify if token match unique ID's.
If you keep hurting them, no sane person will keep spending money on that and find easier product to clone.