System and method for secure firmware update of a secure token having a flash memory controller and a smart card

A device having the capability to securely update the control firmware controlling the device, comprising:

• a first microcontroller;
• a memory module connected to the first microcontroller;
• a second microcontroller connected to the first microcontroller;
• wherein the first microcontroller is controlled by a firmware including instructions to:
• download a firmware update package to a first microcontroller of the device;
• determine a firmware update portion and an encrypted hash portion of the firmware update package wherein the encrypted hash portion is cryptographically signed by a signatory;
• calculate a hash of the firmware update portion;
• transmit the calculated hash and the signed and encrypted hash portion to a second microcontroller;
• wherein the second microcontroller is controlled by firmware to cause the second microcontroller to:
• decrypt the encrypted hash and verifying that the signatory of the firmware update package is an entity entrusted with certifying firmware updates for the device;
• transmit a message denying permission to install the firmware update if the computed hash and the encrypted hash do not match or if signatory of the encrypted hash was not verified as an authorized signatory for firmware updates;
• and
• transmit a message granting permission to install the firmware update if the computed hash and the encrypted hash match and if signatory of the encrypted hash was verified as an authorized signatory for firmware updates;
• and
• wherein the first microcontroller further is controlled by firmware to update the firmware of the device if the second microcontroller has granted permission to install the firmware update.

A method for coordinating a firmware update to a flash memory device between a first entity and a second entity such that the first entity creates the firmware update and the second entity authorizes the firmware update, the method comprising:

• operating the first entity to create a firmware update package;
• transmitting the firmware update package from the first entity to the second entity;
• operating the second entity to cryptographially sign the firmware update package;
• downloading a firmware update package to a first microcontroller of the flash memory device;
• operating the first microcontroller to:
• determine a firmware update portion and an encrypted hash portion of the firmware update package wherein the encrypted hash portion is cryptographically signed by a signatory;
• calculate a hash of the firmware update portion;
• transmit the calculated hash and the signed and encrypted hash portion to a second microcontroller of the flash memory device;
• operating the second microcontroller to:
• decrypt the encrypted hash and verifying that the signatory of the encrypted hash portion corresponds to the second entity;
• transmit a message denying permission to install the firmware update to the first microcontroller if the computed hash and the encrypted hash do not match or if the signatory of the encrypted hash was not verified as the second entity;
• and
• transmit a message granting permission to install the firmware update to the first microcontroller if the computed hash and the encrypted hash match and if signatory of the encrypted hash was verified as signed by the second entity;
• and
• upon receiving a message granting permission to install the firmware update, operating the first microcontroller to update the firmware of the device.