MIT Sues Amazon Web Services Over Chip Fingerprint Patents

The Massachusetts Institute of Technology sued Amazon Web Services on October 9, 2026 over two chip-security patents. The 30-page complaint for patent infringement says AWS uses physical unclonable function tech, sold by Synopsys, to make cryptographic keys from tiny flaws in silicon.

Synopsys is not a defendant. Google Patents already lists both grants as expired. MIT wants money for past use, counted back six years, not a new running royalty.

A Boston Complaint Aimed at AWS

The case is Massachusetts Institute of Technology v. Amazon Web Services, Inc., No. 1:26-cv-14600, in the U.S. District Court for the District of Massachusetts. MIT demanded a jury. The docket lists Judge Myong J. Joun. A summons issued on October 13, 2026.

Joshua C. Krumholz, Jacob K. Baron, and Ji Mao of Holland and Knight signed for MIT. Amazon is named as a Delaware company based at 410 Terry Ave. North in Seattle. MIT is at 77 Massachusetts Avenue in Cambridge.

Venue rests on an AWS office at 27 Melcher Street in Boston, held since at least March 31, 2025, and on Boston network edge sites. MIT quotes Amazon’s own pages saying Amazon CloudFront, Amazon Route 53, AWS Firewall Manager, AWS Shield, and AWS WAF run through those edge sites. That is how MIT puts the fight in Massachusetts. It is not, on the face of the complaint, a claim that those five products are the PUF.

The asserted grants are U.S. Patent Nos. 7,681,103 and 7,818,569. MIT owns them and says it can sue for past infringement. The prayer asks for a judgment of infringement, damages under 35 U.S.C. § 284, and an accounting from six years before the filing. An AWS spokesperson declined to comment after the complaint became public.

Synopsys Sells the Accused SRAM PUF

The product MIT maps onto both patents is SRAM PUF, a way to pull a secret out of ordinary on-chip memory when it powers up. Each SRAM cell settles into a 0 or a 1. The pattern is messy enough, chip to chip, to serve as a fingerprint. Software then turns that pattern into a key and does not have to park the key in long-term storage.

Intrinsic ID, a 2008 spinout from Philips Research, built that product line. MIT’s complaint says Intrinsic ID’s SRAM PUF was in more than 600 million devices by 2023, and that Synopsys later claimed the same IP had been deployed in over a billion devices. On March 20, 2024, Synopsys completed the acquisition of Intrinsic ID. Deal terms were not disclosed. Synopsys said they were not material to its financials.

In our increasingly connected world, chip designers are integrating PUF technology in their SoCs for many applications, including identification and the creation of a product ID for track and trace.

Joachim Kunkel, general manager of the Solutions Group, Synopsys, March 20, 2024

Kunkel also said Synopsys would expand research in the Netherlands and set up a PUF center in Eindhoven. Synopsys still sells SRAM PUF as silicon IP and as software, including kits aimed at devices that join Amazon, Microsoft, and Google clouds. MIT says it knows of no other SRAM PUF on the market besides the Synopsys and Intrinsic ID line.

That is the company MIT did not sue. The university went after the cloud operator that, it says, uses the IP. Synopsys declined to comment on the AWS case.

The Patent Clock Ran Out Before the Filing

Srinivas Devadas, the Webster Professor of Electrical Engineering and Computer Science at MIT and a faculty member since 1988, published “Silicon Physical Random Functions” in November 2002 with co-authors. The complaint calls that paper the first PUF on a computer chip and says it has been cited over 1,300 times. MIT says the first PUF chip still sits outside Devadas’s office.

The two grants share a specification. They grew from a priority date of April 16, 2002. Inventors on both are Devadas and Blaise Gassend. MIT is the assignee. Claim 1 of the ’103 patent is a method for repeatedly generating an unpredictable device-specific value, using redundancy information so a noisy second reading can recreate the first. The ’569 patent covers making a cryptographic key from that kind of value and using it on data in the same chip, without storing the key in non-volatile memory.

THE TWO GRANTS MIT ASSERTED

Google Patents marks both records “Expired – Lifetime” and flags those dates as assumptions, not a court finding. If the listing holds, MIT sued AWS after both terms had already closed. U.S. law still lets a patent owner seek money for infringement during the term, with a six-year cap on how far back damages can run. From an October 9, 2026 filing, that window opens on October 9, 2020 and closes when each grant died.

That is why the prayer reads as a back bill. There is no live patent left, on this listing, to support an injunction or a fresh royalty on new servers.

Microsoft Faced the Same Two Grants in May

MIT filed a parallel suit against Microsoft on May 15, 2026 in the Eastern District of Texas, No. 2:26-cv-00400, before Judge Rodney Gilstrap. Counsel there included McKool Smith and Holland and Knight. The patents are the same two grants. The accused stack there includes Azure Sphere and Project Cerberus, Microsoft’s hardware root-of-trust work for servers, and MIT also pointed to the Caliptra open-source silicon root of trust, with Synopsys and Intrinsic ID as the PUF supplier.

May 15 sat nine days before the May 24, 2026 date Google Patents lists for the ’569 patent. The ’103 patent, on that same listing, had already ended on March 31, 2025. The Texas case was still pending when MIT sued AWS.

The two complaints follow one template. Each says SRAM PUF from Synopsys practices the claims. Each says MIT reviewed other PUF products and found they infringe too, so a swap of suppliers would not save the defendant. Each names Synopsys as the source of the accused IP and then leaves Synopsys off the caption.

What the Complaint Ties to AWS

MIT’s theory that Amazon itself practices SRAM PUF in the cloud is thinner than the vendor story that fills most of the complaint. The university says Amazon uses the tech “on information and belief” in data centers and edge sites in Massachusetts. The concrete exhibits are not Graviton boards or Nitro cards. They are an IoT module, a 2017 software pitch, and a partner badge.

THE AWS LINKS MIT PUT ON THE PAGE

• FreeRTOS on NXP: Amazon FreeRTOS is supported on the NXP LPC54018 IoT module, and MIT says that microcontroller line includes an SRAM PUF feature used as a device-side root of trust.
• NXP and Synopsys: MIT treats NXP’s public status as a Synopsys customer and partner as support that the PUF on that module is the Intrinsic ID design.
• Spartan Cloud, 2017: Intrinsic ID pitched Spartan Cloud as embedded security software so IoT devices could set up trust with major clouds, including Amazon.
• Advanced Tier partner: After that pitch, Amazon named Intrinsic ID an Advanced Tier Technology Partner in the AWS Partner Network, and the announcement said Intrinsic ID “delivers unclonable device identities, meeting critical requirement for AWS.”

Those facts show SRAM PUF sitting at the edge of Amazon’s IoT world. They do not, by themselves, prove the same IP is inside every AWS server that terminates CloudFront or Shield. A reader of the complaint can see the gap. So can a trial judge. University patent cases against cloud companies often stall on a few claim words, and on whether the accused boxes actually run the method as claimed. This filing will live or die on that mapping, not on the press language about silicon fingerprints.

MIT also says that if Amazon uses some other PUF with error correction, it still hits the ’103 patent, because MIT reviewed those products too. That sentence is how the university keeps the case alive even if AWS points away from Synopsys.

Intel and Xilinx Already Took Licenses

MIT is not walking into court as a stranger to the industry. The complaint says companies that have taken a license to the asserted patents include Intel, a major chip maker, and Xilinx, which sold PUF products of its own. Those licenses are MIT’s proof that the grants had a market price before this suit.

The same section is harder on Intrinsic ID. MIT says that since the patents issued, Intrinsic ID knew about them “and in fact claimed in the past without basis that it was entitled to either ownership or licensing rights in the Asserted Patents.” That allegation is MIT’s. Intrinsic ID is not in the case to answer it. Synopsys, which now owns that business, is not in the case either.

The result is a split market. Chip firms that took a license paid MIT. The SRAM PUF vendor that MIT says practiced the claims, then sold into clouds, is a witness and a supplier, not a defendant. AWS and Microsoft, the buyers with the large U.S. footprints and the six-year damages clocks, are the ones on the caption.

Devadas also has other PUF patents assigned to Verayo and to Intrinsic ID, outside this pair. The AWS complaint is only about the two MIT-owned grants. It does not ask the court to sort the rest of that family.

A $1 Billion Chip Deal, Then a Summons

On September 30, 2026, nine days before MIT filed in Boston, Synopsys announced a multi-year $1 billion-plus IP agreement with Amazon. The companies described it as a shift toward application-optimized silicon IP on a license-plus-royalty model, with Amazon as the lead customer. The release named Amazon’s Nitro chips for cloud security, network, and storage, Graviton for general-purpose computing, and Trainium for AI training and inference. It also said the firms have worked together more than 15 years, and that Synopsys would lean on Amazon EC2 and Amazon Bedrock for its own tools.

Peter DeSantis, Amazon’s senior vice president for foundational AI, custom silicon, and quantum computing, said purpose-built chips deliver better performance at lower cost because they are designed for what customers need. Sassine Ghazi, Synopsys president and CEO, called Amazon the lead customer for the next phase of Synopsys IP. That deal is custom-silicon IP and design software. It is not, in the text of the release, a SRAM PUF license, and it does not settle MIT’s claims.

FROM LAB CHIP TO TWO CLOUD DOCKETS

1. April 16, 2002: Priority date for both asserted patents.
2. November 2002: Devadas and co-authors publish “Silicon Physical Random Functions.”
3. March 16, 2010: U.S. Patent No. 7,681,103 issues to MIT.
4. October 19, 2010: U.S. Patent No. 7,818,569 issues to MIT.
5. 2017: Intrinsic ID announces Spartan Cloud for IoT trust with major clouds, including Amazon, and later becomes an AWS Advanced Tier partner.
6. March 20, 2024: Synopsys completes its purchase of Intrinsic ID.
7. March 31, 2025: Google Patents lists the ’103 patent as expired.
8. May 15, 2026: MIT sues Microsoft in Texas on the same two grants.
9. May 24, 2026: Google Patents lists the ’569 patent as expired.
10. September 30, 2026: Synopsys and Amazon announce the $1 billion-plus silicon IP deal.
11. October 9, 2026: MIT sues AWS in Massachusetts.
12. October 13, 2026: The Massachusetts court issues a summons.

AWS now has to answer a university that already licensed Intel and Xilinx, that already sued Microsoft, and that is asking a Boston jury to price years of SRAM PUF use after the grants, on the public record, have died. Synopsys still sells the fingerprints. It is not on the docket.

Disclaimer: This article is news reporting and analysis of a pending civil case. It is informational only and is not legal advice, a prediction of how the court will rule, or a view on the validity of any patent claim. Readers who need advice about patent rights, cloud contracts, or chip IP licenses should consult a qualified patent attorney or intellectual property counsel before acting. Figures, docket events, and patent-term listings reflect the court papers and patent records cited here as of the dates on those records and may change as the cases move.