Abstract: One example provides, on a USB input device, a method comprising receiving an unlock request to change a firmware lock state of a controller of the USB input device from a locked state to an unlocked state, determining whether the unlock request is valid or invalid, when the unlock request is valid, updating the firmware lock state from the locked state to the unlocked state and sending a process completion message, when the unlock request is invalid, sending the process completion message without updating the firmware lock state, receiving a firmware update request, determining whether the firmware lock state is in the locked state or the unlocked state, receiving a firmware payload, authenticating data of the firmware payload, and when the firmware lock state is determined to be in the unlocked state and when the data of the firmware payload is authenticated, then installing the firmware payload.