Secure Edge Workload Delivery via Device-Bound Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Executing workloads on edge devices can be less secure than in the cloud, as edge devices are more susceptible to corruption or unauthorized access.
Innovation Solution
A unique packaging key is cryptographically generated based on a device identifier, a workload identifier, and a nonce, both at a workload provisioning service and independently by the edge device, to encrypt and decrypt a secure cloud workload.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If workload is executed on edge device, then execution speed improves and cloud connection dependency is reduced, but security level deteriorates
Solution Approach 1:
The system segments the security architecture by separating key generation (performed independently by both cloud service and edge device using identical algorithms) from workload execution (on edge device). This segmentation allows the edge device to operate autonomously with locally-generated keys while maintaining cryptographic compatibility with cloud-based provisioning, thus achieving fast local execution without sacrificing security.
Solution Approach 2:
The edge device performs self-service by independently generating its own packaging keys using the same cryptographic algorithms as the cloud service, without requiring continuous cloud connection or key distribution. This self-service capability enables the edge device to securely execute workloads autonomously, resolving the contradiction between execution speed and security by making the device self-sufficient in security operations.
2Reliability
If unique packaging key is cryptographically generated based on device identifier, workload identifier, and nonce, then security against unauthorized access improves, but computational complexity increases
Solution Approach 1:
The system employs universal cryptographic algorithms that serve multiple functions: generating unique packaging keys, ensuring security against unauthorized access, and enabling independent key generation at both cloud and edge locations. By using standardized algorithms like SHA-256 or AES that can be implemented efficiently across different platforms, the system achieves high security without proportionally increasing device complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosed technology provides for packaging a secure cloud workload at a workload provisioning service. A unique device identifier is received from an edge device. The unique identifier is associated with the edge device. A unique packaging key is cryptographically generated based on the received unique device identifier, a unique workload identifier corresponding to a secure cloud workload to be executed on the edge device, and a nonce. The secure cloud workload is encrypted to generate a packaged secure cloud workload using the cryptographically generated unique packaging key. The encrypted secure cloud workload is transmitted to the edge device. The edge device is capable of independently cryptographically generating the unique packaging key using the unique device identifier, the unique workload identifier, and the nonce. The edge device is also capable of decrypting the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device.