A watchdog controller securely interrogates a main system CPU of an application module to determine if the main system CPU and its associated programming software are trustworthy. The watchdog controller and the application module preferably reside within a set top box. The watchdog controller includes a watchdog CPU which generates a digitally signed status request message using a watchdog certificate. The status request message is received by the main system CPU and validated for authenticity. The main system CPU then generates a status response message using a system certificate. The status response message is received by the watchdog processor and validated for authenticity. If the status response message is not valid then the watchdog controller preferably triggers a system reset. After the system is reset, a similar attempt is made to receive a valid status response message from the main system CPU. If the status response message is again not valid, then the watchdog CPU triggers the launching of a retrieval software program. The retrieval software accesses a remote content source to download a trusted version of a software stack used to operate the set top box. The trusted version of the software stack replaces a current version of the software stack stored in memory of the application module.
展开▼
