Zero trust for edge devices

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the one or more network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process that is executable by the processor, the process when executed configured to:
• enroll with a controller that supervises operation of the apparatus;
• send a publication request to a cloud-based messaging service;
• provide, to the cloud-based messaging service, identification information that indicates the controller that supervises operation of the apparatus;
• receive, from the cloud-based messaging service, authorization to publish messages to the cloud-based messaging service, wherein the cloud-based messaging service uses the identification information to confirm an identity of the apparatus with the controller that supervises operation of the apparatus;
• and
• send, after receiving authorization to publish messages to the cloud-based messaging service, a message for publication to the cloud-based messaging service, wherein the message comprises data sourced from an endpoint in the network.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a networking device at an edge of a network to execute a process comprising:

• enrolling, by the networking device at an edge of a network, with a controller that supervises operation of the networking device;
• sending, by the networking device, a publication request to a cloud-based messaging service;
• providing, by the networking device and to the cloud-based messaging service, identification information that indicates the controller that supervises operation of the networking device;
• receiving, at the networking device and from the cloud-based messaging service, authorization to publish messages to the cloud-based messaging service, wherein the cloud-based messaging service uses the identification information to confirm an identity of the networking device with the controller that supervises operation of the networking device;
• and
• sending, by the networking device and after receiving authorization to publish messages to the cloud-based messaging service, a message for publication to the cloud-based messaging service, wherein the message comprises data sourced from an endpoint in the network.