Patent ID: 8898477

Claim:
A method of operating a device to securely update the control firmware controlling the device, the method comprising: downloading a firmware update package to a first microcontroller of the device; operating the first microcontroller to: determine a firmware update portion and an encrypted hash portion of the firmware update package wherein the encrypted hash portion is cryptographically signed by a signatory; calculate a hash of the firmware update portion; transmit the calculated hash and the signed and encrypted hash portion to a second microcontroller; operating the second microcontroller to: decrypt the encrypted hash and verifying that the signatory of the encrypted hash portion is an entity entrusted with certifying firmware updates for the device; transmit a message denying permission to install the firmware update to the first microcontroller if the computed hash and the encrypted hash do not match or if the signatory of the encrypted hash was not verified as an authorized signatory for firmware updates; and transmit a message granting permission to install the firmware update to the first microcontroller if the computed hash and the encrypted hash match and if signatory of the encrypted hash was verified as an authorized signatory for firmware updates; and upon receiving a message granting permission to install the firmware update, operating the first microcontroller to update the firmware of the device.