Identity-based verification of software code layers

An apparatus comprising:

• at least one processing device comprising a processor coupled to a memory;
• the at least one processing device being configured to implement the following steps:
• obtaining, by a current layer of a plurality of layers of software code executing on a security processor of a security sub-system, in connection with a boot of the security sub-system, an identity key of the current layer of software code, wherein the identity key of the current layer of software code is based at least in part on at least one value generated during a provisioning of the security sub-system, wherein the at least one value is based at least in part on a firmware image of at least one layer of the plurality of layers of software code;
• obtaining an encrypted secure boot public key of a next layer of software code;
• decrypting the encrypted secure boot public key of the next layer of software code using the obtained identity key of the current layer of software code;
• verifying the next layer of software code using the decrypted secure boot public key of the next layer of software code;
• and
• initiating execution of the next layer of software code based at least in part on a result of the verifying.

A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:

• obtaining, by a current layer of a plurality of layers of software code executing on a security processor of a security sub-system, in connection with a boot of the security sub-system, an identity key of the current layer of software code, wherein the identity key of the current layer of software code is based at least in part on at least one value generated during a provisioning of the security sub-system, wherein the at least one value is based at least in part on a firmware image of at least one layer of the plurality of layers of software code;
• obtaining an encrypted secure boot public key of a next layer of software code;
• decrypting the encrypted secure boot public key of the next layer of software code using the obtained identity key of the current layer of software code;
• verifying the next layer of software code using the decrypted secure boot public key of the next layer of software code;
• and
• initiating execution of the next layer of software code based at least in part on a result of the verifying.