MIT says AWS cloud security infringes chip-fingerprint patents

The story

The Massachusetts Institute of Technology has sued Amazon Web Services over hardware-security technology that turns microscopic manufacturing differences inside a chip into a device-specific cryptographic value. The complaint, filed October 9 in the U.S. District Court for the District of Massachusetts and reported by Reuters on October 12, alleges that AWS infringed U.S. patents 7,681,103 and 7,818,569. The case is Massachusetts Institute of Technology v. Amazon Web Services Inc., number 1:26-cv-14600.

The disputed idea is a physical unclonable function, commonly shortened to PUF. Even chips produced from the same design contain tiny variations in transistor behavior and signal timing. A PUF measures those variations to produce a response that is difficult to reproduce on another device. The resulting value can identify hardware or help derive a cryptographic key without permanently storing the complete secret in ordinary memory, where invasive probing or other attacks might expose it.

The first patent, titled “Reliable generation of a device-specific value,” addresses a practical weakness in that concept: physical measurements can change with temperature, noise and aging. Its abstract describes generating an initial value from fabrication variation, calculating redundancy information, and later using a fresh measurement plus that redundancy to reconstruct the original value. The patent names MIT researchers Srinivas Devadas and Blaise Gassend as inventors and says the work received U.S. Navy support.

The second patent, “Data protection and cryptographic functions using a device-specific value,” covers using a value derived from varying circuit characteristics to access protected information or perform cryptographic operations. Together, the patents describe more than a serial number stamped into a chip. They use the physical behavior of the individual circuit as part of the security mechanism, with supporting techniques intended to make the generated value repeatable enough for authentication and key generation.

MIT alleges that AWS uses PUF technology supplied by electronic-design-automation company Synopsys to create unique cryptographic keys. Reuters reported that Synopsys is not named as a defendant and that MIT seeks unspecified monetary damages. An AWS spokesperson declined to comment on the lawsuit. Those are allegations at the opening of a case: AWS has not yet filed the substantive response visible in the public docket, and the court has made no finding that any product infringes a valid claim.

The timing adds an unusual layer. Google Patents lists the ’103 patent as expired on March 31, 2025 and the ’569 patent as expired on May 24, 2026. Expiration ends the patent holder's ability to exclude later activity under those claims, but it does not automatically erase a claim for infringement alleged to have occurred while a patent was enforceable. U.S. law generally bars recovery for infringement committed more than six years before the complaint, making the accused product timeline and any notice issues potentially important.

That means the lawsuit should not be read as proof that AWS must stop using PUF technology today. MIT is asking for damages, not an announced ban, and must establish a chain of legal and technical propositions: ownership and enforceability, the meaning of disputed claim terms, infringement of every required element, and a compensable period of use. AWS may contest infringement, patent validity, damages or several of those points at once.

MIT has already filed a related lawsuit against Microsoft in Texas over the same two patents. Reuters said that case, brought in May, remains pending. Repeated enforcement against major cloud providers suggests MIT views the patents as covering a commercially significant implementation rather than an isolated device. It also raises the possibility that claim construction or validity rulings in one case could shape strategy in the other, even though each defendant's accused system must be assessed separately.

INNOVOX analysis: the case is a reminder that the cloud's security stack depends on physical inventions as well as software. A service may present key management as an API, while the trust anchor underneath is a circuit exploiting manufacturing randomness. For universities, that creates a long commercialization horizon: research conceived in the early 2000s can become valuable when hyperscale operators deploy hardware-backed identity. For customers, however, the filing changes no product fact by itself and does not establish that AWS copied or owes damages.

What to watch next is the first detailed AWS response and the evidence attached to infringement contentions. The central questions are which Synopsys technology is implemented in AWS infrastructure, when AWS began using it, and whether its method reconstructs and applies device-specific values in the way the asserted claims require. Patent expiration, the six-year damages limit, marking or notice, and any challenge based on earlier PUF research could narrow the case long before a trial. Until then, MIT's filing is a technically specific allegation, not a judgment.

INNOVOX analysis

The dispute tests how foundational university research is monetized after a security primitive becomes part of commercial cloud infrastructure. PUFs replace a stored secret with a value reconstructed from a chip's own physical variation, but MIT must still prove that the accused implementation practices every limitation of an asserted claim. The patents' listed expiration dates make the timing of alleged use and recoverable damages central.

What to watch

Watch for AWS's answer, any challenge to standing, claim construction, invalidity arguments and a detailed damages period. Technical discovery should clarify which Synopsys component AWS uses, when it entered service, how keys are derived, and whether the accused process matches the patents' redundancy and device-specific-value limitations.