Abstract: In a method of controlling the operation of a security module, wherein firmware controlling the operation of the security module (10) is stored in a program memory (40), new firmware may be loaded into the module (10). An authentication key (KA) is encrypted using a key storage key (KSK) stored in a resettable shift register (54) in the security module and the encrypted authentication key is stored in a secure memory (36). A firmware authentication value FAV is calculated, using the authentication key (KA), externally of the security module (10), for the new firmware, and the new firmware, together with FAV is loaded into a data memory (38) in the security module (10). A processor (30) in the security module (10) recalculates the firmware authentication value using the stored authentication key (KA) and compares the recalculated value with the loaded value FAV. If a correct comparison is achieved, the new firmware is transferred into the program memory (40).