Secure device-bound edge workload receipt

A computing device for processing a secure cloud workload at an edge device, the secure cloud workload having a workload identifier uniquely identifying the secure cloud workload, the secure cloud workload being received from a workload provisioning service including one or more workload provisioning servers, the computing device comprising:

• a network communications interface configured to provide a device identifier uniquely identifying the edge device to the one or more workload provisioning servers, the network communications interface further configured to receive a packaged secure cloud workload from the one or more workload provisioning servers, the packaged secure cloud workload being encrypted by the one or more workload provisioning servers using a unique packaging key generated by the one or more workload provisioning servers based on the device identifier, the workload identifier, and a nonce;
• a unique packaging key generator configured to cryptographically generate the unique packaging key using the device identifier, the workload identifier, and the nonce;
• and
• a workload decryptor configured to decrypt the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device.

One or more tangible processor-readable storage media embodied with instructions for executing on one or more processors and circuits of a computing device a process for processing a secure cloud workload at an edge device, the secure cloud workload having a workload identifier uniquely identifying the secure cloud workload, the secure cloud workload being received from a workload provisioning service including one or more workload provisioning servers, the process comprising:

• providing a device identifier uniquely identifying the edge device to the one or more workload provisioning servers;
• receiving a packaged secure cloud workload from the one or more workload provisioning servers, the packaged secure cloud workload being encrypted by the one or more workload provisioning servers using a unique packaging key generated by the one or more workload provisioning servers based on the device identifier, the workload identifier, and a nonce;
• cryptographically generating, by the edge device, the unique packaging key using the device identifier, the workload identifier, and the nonce;
• and
• decrypting the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device.