Patent Description:
The object of the invention is to provide enhanced secure deploying of a secure workload to an edge device.

In at least one implementation, the disclosed technology provides for packaging a secure cloud workload at a workload provisioning service. A unique device identifier is received from an edge device. The unique identifier is associated with the edge device. A unique packaging key is cryptographically generated based on the received unique device identifier, a unique workload identifier corresponding to a secure cloud workload to be executed on the edge device, and a nonce. The secure cloud workload is encrypted to generate a packaged secure cloud workload using the cryptographically generated unique packaging key. The encrypted secure cloud workload is transmitted to the edge device. The edge device is capable of independently cryptographically generating the unique packaging key using the unique device identifier, the unique workload identifier, and the nonce. The edge device is also capable of decrypting the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device.

When a workload is executed on an edge device instead of in the cloud, the execution of the workload may be faster, partially because an internet connection may not be required. However, it is often less secure to execute a workload on an edge device, because the edge device may be more susceptible to corruption or unauthorized entry. Using a unique packaging key that is separately generated at both a workload provisioning service and at the edge device makes execution of workloads on edge devices more secure.

<FIG> illustrates an example workload provisioning service hardware <NUM> in communication with edge devices <NUM>, <NUM>, and <NUM> through a communications network <NUM>. Generally, the workload provisioning service hardware <NUM> is comprised of one or more workload provisioning servers and includes a datastore <NUM> including workloads for various edge devices, such as the edge devices <NUM>, <NUM>, and <NUM>. A workload may include any discrete task to be performed by an edge device. An edge device may be a device connected to the internet of things (IoT).

The workload provisioning service hardware <NUM> may send workloads to any of the edge devices <NUM>, <NUM>, or <NUM> through the communications network <NUM>. Some workloads may include sensitive, confidential, or otherwise restricted data that may be encrypted before being sent over the communications network <NUM>. The workload provisioning service hardware <NUM> may encrypt and package the workload before sending it to an edge device (i.e., the edge device <NUM>. The workload is encrypted using a unique packaging key unique to the workload and the device. The unique packaging key is generated by the workload provisioning service hardware <NUM>. The encrypted workload is communicated to the edge device <NUM>. The edge device <NUM> separately generates the unique packaging key to decrypt the workload before execution of the workload.

The edge device <NUM> communicates a unique device identifier <NUM> to the workload provisioning service hardware <NUM> using the communications network <NUM>. The edge device <NUM> may communicate the unique device identifier <NUM> in response to a request from the workload provisioning service hardware <NUM> or as part of a request from the edge device <NUM> to the workload provisioning service hardware <NUM>. The unique device identifier <NUM> may be a unique string of characters corresponding to the edge device <NUM>.

The workload provisioning service hardware <NUM> uses the unique device identifier <NUM> along with a unique workload identifier and a nonce to generate the unique packaging key. The unique workload identifier corresponds to the workload. The nonce may be generated by the workload provisioning service hardware <NUM> or may be requested by the workload provisioning service. The workload provisioning service hardware <NUM> uses the unique packaging key to encrypt the secure cloud workload to generate a packaged secure cloud workload <NUM>.

<FIG> illustrates an example workload provisioning service <NUM> delivering an encrypted secure cloud workload <NUM> to an edge device <NUM>. The workload provisioning service <NUM> includes at least a network communications interface <NUM>, a unique packaging key generator <NUM>, a workload encryptor <NUM>, and a datastore <NUM>.

The network communications interface <NUM> receives a unique device identifier <NUM> from the edge device <NUM>. In some implementations, the edge device <NUM> may communicate the unique device identifier <NUM> to the workload provisioning service <NUM> in response to a request from the workload provisioning service <NUM>. In other implementations, the edge device <NUM> may communicate the unique device identifier <NUM> to the workload provisioning service <NUM> as part of a request by the edge device <NUM> for a workload from the workload provisioning service <NUM>.

The unique device identifier <NUM> is communicated to the unique packaging key generator <NUM>. The unique packaging key generator <NUM> generates a unique packaging key corresponding to the secure cloud workload and to the edge device <NUM> using the unique device identifier <NUM>, a unique workload identifier corresponding to the secure cloud workload to be communicated to the edge device <NUM>, and a nonce. The nonce may be generated by a nonce generator located on the workload provisioning service <NUM> on the datastore <NUM> or may be retrieved by the workload provisioning service <NUM> via a communications network.

The generated unique packaging key is used by the workload encryptor <NUM> to encrypt the secure cloud workload to be sent to the edge device <NUM>. The secure cloud workload may be stored on a datastore located on the workload provisioning service <NUM> accessible by the workload encryptor <NUM>, along with other secure cloud workloads for various edge devices. In some implementations, the secure cloud workload may be stored in another location communicatively connected to the workload provisioning service <NUM>.

Along with encrypting the secure cloud workload, the workload encryptor <NUM> may, in some implementations, further package the secure cloud workload for communication to the edge device <NUM>. For example, the workload encryptor <NUM> may, in some implementations, package the nonce for communication with the encrypted secure cloud workload as a single package. The workload encryptor <NUM> then communicates a packaged secure cloud workload <NUM> to the edge device <NUM> by communicating the packaged secure cloud workload <NUM> to the network communications interface <NUM>. The network communications interface <NUM> communicates the packaged secure cloud workload <NUM> to the edge device <NUM> over a communications network.

The edge device <NUM> receives the packaged secure cloud workload <NUM> at a network communications interface <NUM>. The network communications interface <NUM> communicates the packaged secure cloud workload <NUM> to a unique packaging key generator <NUM> on the edge device <NUM>. The unique packaging key generator <NUM> cryptographically generates the unique packaging key using the unique device identifier, the unique workload identifier, and the nonce. The unique workload identifier may be communicated in a package with the packaged secure cloud workload <NUM>. In some implementations, the nonce may also be communicated in the package with the packaged secure cloud workload <NUM>. In other implementations, the nonce may be separately received by the edge device <NUM> from the workload provisioning service <NUM>.

The unique packaging key generator <NUM> communicates the packaged secure cloud workload <NUM> and the generated unique packaging key to a workload decryptor <NUM>. In some implementations, the workload decryptor <NUM> may be a trusted platform module (TPM) or part of a trusted execution environment (TEE) so that the unique packaging key is protected in a secure enclave. The workload decryptor <NUM> uses the generated unique packaging key to decrypt the secure cloud workload. The workload decryptor <NUM> then communicates the secure cloud workload to a workload execution environment <NUM>. When the workload decryptor <NUM> is a TPM, the workload decryptor <NUM> communicates the secure cloud workload to the workload execution environment <NUM> outside of the secure enclave of the TPM.

When the workload decryptor <NUM> is part of a TEE, the workload execution environment <NUM> may be either fully or partially within the secure enclave. In some implementations, the workload execution environment <NUM> may be located partially within the secure enclave of the TEE. When the workload execution environment <NUM> is located partially within the secure enclave of the TEE, portions of the secure cloud workload requiring sensitive information or data may be executed within the secure enclave, while the remainder of the workload may be executed in a less secure portion of the workload execution environment <NUM>.

<FIG> illustrates example operations <NUM> for generating an encrypted secure cloud workload for an edge device at a workload provisioning service. A receiving operation <NUM> receives a unique device identifier from an edge device. The unique device identifier is associated with the edge device. In some implementations, the edge device may send the unique device identifier to the workload provisioning service in response to a request from the workload provisioning service. In other implementations, the edge device may send the unique device identifier to the workload provisioning service as part of a request for a workload from the edge device to the workload provisioning service.

A generating operation <NUM> cryptographically generates a unique packaging key based on the received unique device identifier, a unique workload identifier corresponding to a secure cloud workload to be executed on the edge device, and a nonce. The nonce may be generated by a nonce generator that is part of the workload provisioning service. Alternatively, the workload provisioning service may receive the nonce from a nonce generator through a communications network. The nonce is unique to the generation of the unique packaging key for the secure cloud workload on the edge device. The unique workload identifier corresponds to the secure cloud workload and may, in some implementations, be retrieved from a datastore located on the workload provisioning service. In other implementations, the unique workload identifier may be stored at another location and retrieved by the workload provisioning service via a communications network.

An encrypting operation <NUM> encrypts the secure cloud workload to generate a packaged secure cloud workload using the cryptographically generated unique packaging key. In some implementations, encrypting the secure cloud workload may include further packaging the secure cloud workload for communication to the edge device. For example, in some implementations, the nonce may be packaged for communication with the packaged secure cloud workload as a single package.

A transmitting operation <NUM> transmits the packaged secure cloud workload to the edge device. The edge device is capable of independently cryptographically generating the unique packaging key using the unique device identifier, the unique workload identifier, and the nonce. The edge device is also capable of decrypting the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device. The packaged secure cloud workload is transmitted over a communications network and sent from a network communications interface of the workload provisioning service to a network communications interface of the edge device.

<FIG> illustrates example operations <NUM> for receiving and processing a secure cloud workload received from a workload provisioning service at an edge device. A providing operation <NUM> provides a unique device identifier to a workload provisioning service. The unique device identifier is associated with the edge device. The unique device identifier may be provided to the workload provisioning service in response to a request from the workload provisioning service. The unique device identifier may also be provided to the workload provisioning service as part of a request from the edge device to the workload provisioning service for a particular workload.

A receiving operation <NUM> receives a packaged secure cloud workload from the workload provisioning service. The packaged secure cloud workload is encrypted by the workload provisioning service using a unique packaging key generated by the workload provisioning service based on the unique device identifier, a unique workload identifier, and a nonce. In some implementations, the packaged secure cloud workload may include other information, including the nonce and unique workload identifier.

A generating operation <NUM> cryptographically generates, by the edge device, the unique packaging key using the unique device identifier, the unique workload identifier, and the nonce. The unique workload identifier may be communicated in a package with the packaged secure cloud workload. In some implementations, the nonce may also be communicated in the package with the packaged secure cloud workload. In other implementations, the nonce may be separately received by the edge device from the workload provisioning service.

A decrypting operation <NUM> decrypts the packaged secure cloud workload using the cryptographically generated unique packaging key cryptographically generated by the edge device. The decrypting operation <NUM> may occur at a workload decryptor of the edge device. In some implementations, the workload decryptor may be a trusted platform module (TPM) or part of a trusted execution environment (TEE) so that the unique packaging key is protected in a secure enclave. The workload decryptor uses the generated unique packaging key to decrypt the secure cloud workload.

When the workload decryptor is a TPM, the workload decryptor communicates the secure cloud workload to a workload execution environment outside of the secure enclave of the TPM. When the workload decryptor is part of a TEE, the workload may be executed either wholly or partially within the secure enclave of the TEE.

<FIG> illustrates an example computing device for use in generating an encrypted secure cloud workload. The example computing device <NUM> may be used to generate a packaged secure cloud workload for processing by an edge device. The computing device <NUM> may be a client device, such as a laptop, mobile device, desktop, tablet, or a server/cloud device. The computing device <NUM> includes one or more processor(s) <NUM>, and a memory <NUM>. The memory <NUM> generally includes both volatile memory (e.g., RAM) and non-volatile memory (e.g., flash memory). An operating system <NUM> resides in the memory <NUM> and is executed by the processor(s) <NUM>.

One or more modules or segments, such as a workload provisioning service <NUM> are loaded into the operating system <NUM> on the memory <NUM> and/or storage <NUM> and executed by the processor(s) <NUM>. The modules may include the workload provisioning service <NUM> implemented by a unique packaging key generator <NUM> and a workload encryptor <NUM>. The unique packaging key generator <NUM> cryptographically generates a unique packaging key for encrypting a secure cloud workload. The workload encryptor <NUM> uses the generated unique packaging key to encrypt a secure cloud workload for communication to an edge device. The storage <NUM> may be local to the computing device <NUM> or may be remote and communicatively connected to the computing device <NUM> and may include another server. The storage <NUM> may store resources that are requestable by client devices (not shown).

The computing device <NUM> includes a power supply <NUM>, which is powered by one or more batteries or other power sources and which provides power to other components of the computing device <NUM>. The power supply <NUM> may also be connected to an external power source that overrides or recharges the built-in batteries or other power sources.

The computing device <NUM> may include one or more communication transceivers <NUM> which may be connected to one or more antenna(s) <NUM> to provide network connectivity (e.g., mobile phone network, Wi-Fi®, Bluetooth®) to one or more other servers and/or client devices (e.g., mobile devices, desktop computers, or laptop computers). The computing device <NUM> may further include a network adapter <NUM>, which is a type of communication device. The computing device <NUM> may use the adapter and any other types of communication devices for establishing connections over a wide-area network (WAN) or local-area network (LAN). It should be appreciated that the network connections shown are exemplary and that other communications devices and means for establishing a communications link between the computing device <NUM> and other devices may be used.

The computing device <NUM> may include one or more input devices <NUM> such that a user may enter commands and information (e.g., a keyboard or mouse). These and other input devices may be coupled to the server by one or more interfaces <NUM> such as a serial port interface, parallel port, or universal serial bus (USB). The computing device <NUM> may further include a display <NUM> such as a touch screen display.

The computing device <NUM> may include a variety of tangible processor-readable storage media and intangible processor-readable communication signals. Tangible processor-readable storage can be embodied by any available media that can be accessed by the computing device <NUM> and includes both volatile and nonvolatile storage media, removable and non-removable storage media. Tangible processor-readable storage media excludes intangible communications signals and includes volatile and nonvolatile, removable and non-removable storage media implemented in any method or technology for storage of information such as processor-readable instructions, data structures, program modules or other data. Tangible processor-readable storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CDROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other tangible medium which can be used to store the desired information and which can be accessed by the computing device <NUM>. In contrast to tangible processor-readable storage media, intangible processor-readable communication signals may embody processor-readable instructions, data structures, program modules or other data resident in a modulated data signal, such as a carrier wave or other signal transport mechanism. By way of example, and not limitation, intangible communication signals include signals traveling through wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media.

<FIG> illustrates an example computing device for use in processing an encrypted secure cloud workload. The example computing device <NUM> may be used to process a packaged secure cloud workload received from a workload provisioning service. The computing device <NUM> may be a client device, such as a laptop, mobile device, desktop, tablet, or a server/cloud device. The computing device <NUM> includes one or more processor(s) <NUM>, and a memory <NUM>. The memory <NUM> generally includes both volatile memory (e.g., RAM) and non-volatile memory (e.g., flash memory). An operating system <NUM> resides in the memory <NUM> and is executed by the processor(s) <NUM>.

One or more modules or segments, such as a secure workload processor <NUM> are loaded into the operating system <NUM> on the memory <NUM> and/or storage <NUM> and executed by the processor(s) <NUM>. The modules may include the secure workload processor <NUM> implemented by a unique packaging key generator <NUM>, a workload decryptor <NUM>, and a workload execution environment <NUM>. The storage <NUM> may be local to the computing device <NUM> or may be remote and communicatively connected to the computing device <NUM> and may include another server. The storage <NUM> may store resources that are requestable by client devices (not shown).

An example method of securely deploying, to an edge device, a secure cloud workload with a workload identifier uniquely identifying the secure cloud workload from a workload provisioning service including one or more workload provisioning servers is provided. The method includes receiving, at the one or more workload provisioning servers, a device identifier uniquely identifying the edge device and cryptographically generating, by the one or more workload provisioning servers, a unique packaging key based on the received device identifier, the workload identifier, and a nonce. The method further includes encrypting, by the one or more workload provisioning servers, the secure cloud workload to generate a packaged secure cloud workload using the cryptographically generated unique packaging key. The method also includes transmitting, from the one or more workload provisioning servers, the packaged secure cloud workload to the edge device, the edge device being configured to independently cryptographically generate the unique packaging key using the device identifier, the workload identifier, and the nonce, the edge device being further configured to decrypt the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device.

A method of any previous method is provided, where the nonce is generated by the one or more workload provisioning servers.

A method of any previous method is provided, where the method also includes transmitting the nonce from the one or more workload provisioning servers to the edge device as part of the packaged secure cloud workload.

A method of any previous method is provided, where the method also includes transmitting the nonce from the one or more workload provisioning servers to the edge device separately from the packaged secure cloud workload.

A method of any previous method is provided, where the secure cloud workload is configured to be executed by the edge device.

A method of any previous method is provided, where the secure cloud workload is configured to be executed by the edge device in a trusted execution environment.

A method of any previous method is provided, where the generated unique packaging key is configured to be stored in a trusted platform module and the secure cloud workload is configured to be executed outside of the trusted platform module.

An example system for securely deploying, to an edge device, a secure cloud workload with a workload identifier uniquely identifying the secure cloud workload form a workload provisioning service including one or more workload provisioning servers is provided. The system includes means for receiving, at the one or more workload provisioning servers, a device identifier uniquely identifying the edge device and for cryptographically generating, by the one or more workload provisioning servers, a unique packaging key based on the received device identifier, the workload identifier, and a nonce. The system also includes means for encrypting, by the one or more workload provisioning servers, the secure cloud workload to generate a packaged secure cloud workload using the cryptographically generated unique packaging key. The system also includes means for transmitting, from the one or more workload provisioning servers, the packaged secure cloud workload to the edge device, the edge device being configured to independently cryptographically generate the unique packaging key using the device identifier, the workload identifier, and the nonce, the edge device being further configured to decrypt the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device.

An example system of any previous system is provided, where the nonce is generated by the one or more workload provisioning servers.

An example system of any previous system further includes means for transmitting the nonce form the one or more workload provisioning servers to the edge device as part of the packaged secure cloud workload.

An example system of any previous system further includes means for transmitting the nonce from the one or more workload provisioning servers to the edge device separately from the packaged secure cloud workload.

An example system of any previous system is provided, where the secure cloud workload is configured to be executed by the edge device.

An example system of any previous system is provided, where the secure cloud workload is configured to be executed by the edge device in a trusted execution environment.

An example system of any previous system is provided, where the generated unique packaging key is configured to be stored in a trusted platform module and the secure cloud workload is configured to be executed outside of the trusted platform module.

An example computing device for securely deploying, to an edge device, a secure cloud workload with a workload identifier uniquely identifying the secure cloud workload from a workload provisioning service including one or more workload provisioning servers is provided. The computing device includes a unique packaging key generator configured receive a device identifier uniquely identifying the edge device and to cryptographically generate a unique packaging key based on the received device identifier, the workload identifier, and a nonce. The computing device further includes a workload encryptor configured to encrypt the secure cloud workload to generate a packaged secure cloud workload using the cryptographically generated unique packaging key. The computing device also includes a network communications interface configured to transmit the packaged secure cloud workload to the edge device, the edge device being configured to independently cryptographically generate the unique packaging key using the device identifier, the workload identifier, and the nonce, the edge device being further configured to decrypt the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device.

An example computing system of any previous computing system is provided, where the network communications interface is further configured to transmit the nonce to the edge device.

An example computing system of any previous computing system is provided, where the network communications interface transmits the nonce to the edge device as part of the packaged secure cloud workload.

An example computing system of any previous computing system is provided, where the network communications interface transmits the nonce to the edge device separately from the packaged secure cloud workload.

An example computing system of any previous computing system is provided, where the secure cloud workload is configured to be executed by the edge device.

An example computing system of any previous computing system is provided, where the secure cloud workload is configured to be executed by the edge device is a trusted execution environment.

An example computing system of any previous computing system is provided, where the generated unique packaging key is configured to be stored in a trusted platform module and the secure cloud workload is configured to be executed outside of the trusted platform module.

Example one or more tangible processor-readable storage media are embodied with instructions for executing on one or more processors and circuits of a computing device a process for securely deploying, to an edge device, a secure cloud workload with a workload identifier uniquely identifying the secure cloud workload from a workload provisioning service including one or more workload provisioning servers. The process includes receiving, at the one or more workload provisioning servers, a device identifier uniquely identifying the edge device and cryptographically generating, by the one or more workload provisioning servers, a unique packaging key based on the received device identifier, the workload identifier, and a nonce. The process also includes encrypting, by the one or more workload provisioning servers, the packaged secure cloud workload to the edge device, the edge device being configured to independently cryptographically generate the unique packaging key using the device identifier, the workload identifier, and the nonce. The edge device is further configured to decrypt the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device.

Another example one or more tangible processor-readable storage media are embodied with instructions for executing on one or more processors and circuits of a device a process of any preceding process, further including transmitting the nonce from the one or more workload provisioning servers to the edge device as part of the packaged secure cloud workload.

Another example one or more tangible processor-readable storage media are embodied with instructions for executing on one or more processors and circuits of a device a process of any preceding process, further including transmitting the nonce from the one or more workload provisioning servers to the edge device separately from the packaged secure cloud workload.

Another example one or more tangible processor-readable storage media are embodied with instructions for executing on one or more processors and circuits of a device a process of any preceding process, where the secure cloud workload is configured to be executed by the edge device.

Another example one or more tangible processor-readable storage media are embodied with instructions for executing on one or more processors and circuits of a device a process of any preceding process, where the secure cloud workload is configured to be executed by the edge device in a trusted execution environment.

Another example one or more tangible processor-readable storage media are embodied with instructions for executing on one or more processors and circuits of a device a process of any preceding process, where the generated unique packaging key is configured to be stored in a trusted platform module and the secure cloud workload is configured to be executed outside of the trusted platform module.

Some implementations may comprise an article of manufacture. An article of manufacture may comprise a tangible storage medium to store logic. Examples of a storage medium may include one or more types of computer-readable storage media capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writeable or rewriteable memory, and so forth. Examples of the logic may include various software elements, such as software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, operation segments, methods, procedures, software interfaces, application program interfaces (API), instruction sets, computing code, computer code, code segments, computer code segments, words, values, symbols, or any combination thereof. In one implementation, for example, an article of manufacture may store executable computer program instructions that, when executed by a computer, cause the computer to perform methods and/or operations in accordance with the described embodiments. The executable computer program instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, and the like. The executable computer program instructions may be implemented according to a predefined computer language, manner or syntax, for instructing a computer to perform a certain operation segment. The instructions may be implemented using any suitable high-level, low-level, object-oriented, visual, compiled and/or interpreted programming language.

Claim 1:
A method of securely deploying, to an edge device (<NUM>, <NUM>, <NUM>, <NUM>), a secure cloud workload (<NUM>) with a workload identifier uniquely identifying the secure cloud workload from a workload provisioning service (<NUM>) including one or more workload provisioning servers, the method comprising:
receiving (<NUM>), at the one or more workload provisioning servers, a device identifier (<NUM>, <NUM>) uniquely identifying the edge device;
cryptographically generating (<NUM>), by the one or more workload provisioning servers, a unique packaging key based on the received device identifier, the workload identifier, and a nonce;
encrypting (<NUM>), by the one or more workload provisioning servers, the secure cloud workload to generate a packaged secure cloud workload using the cryptographically generated unique packaging key; and
transmitting (<NUM>), from the one or more workload provisioning servers, the packaged secure cloud workload to the edge device, the edge device being configured to independently cryptographically generate the unique packaging key using the device identifier, the workload identifier, and the nonce, the edge device being further configured to decrypt the packaged secure cloud workload using the generated unique packaging key cryptographically generated by the edge device.