Secure device-bound edge workload delivery

A computing device for securely deploying, to an edge device, a secure cloud workload with a workload identifier uniquely identifying the secure cloud workload from a workload provisioning service including one or more workload provisioning servers, the computing device comprising:

• a unique packaging key generator configured to receive a device identifier uniquely identifying the edge device and to cryptographically generate a unique packaging key based on the received device identifier, the workload identifier, and a nonce;
• a workload encryptor configured to encrypt the secure cloud workload to generate a packaged secure cloud workload using the cryptographically generated unique packaging key;
• and
• a network communications interface configured to transmit the packaged secure cloud workload to the edge device, the edge device being configured to independently cryptographically generate the unique packaging key using the device identifier, the workload identifier, and the nonce, the edge device being further configured to decrypt the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device.

One or more tangible processor-readable storage media embodied with instructions for executing on one or more processors and circuits of a computing device a process for securely deploying, to an edge device, a secure cloud workload with a workload identifier uniquely identifying the secure cloud workload from a workload provisioning service including one or more workload provisioning servers, the process comprising:

• receiving, at the one or more workload provisioning servers, a device identifier uniquely identifying the edge device;
• cryptographically generating, by the one or more workload provisioning servers, a unique packaging key based on the received device identifier, the workload identifier, and a nonce;
• encrypting, by the one or more workload provisioning servers, the secure cloud workload to generate a packaged secure cloud workload using the cryptographically generated unique packaging key;
• and
• transmitting, from the one or more workload provisioning servers, the packaged secure cloud workload to the edge device, the edge device being configured to independently cryptographically generate the unique packaging key using the device identifier, the workload identifier, and the nonce, the edge device being further configured to decrypt the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device.