A semiconductor memory system and an operating method thereof includes: a one-time-programmable memory device storing at least a customer identification (ID) identifying a customer; a memory device; and a memory controller including a processor, and coupled to the memory device, containing instructions executed by the processor, and suitable for authenticating whether a program is authorized by a controller provider for the customer in a first-level signature authentication, in accordance with a customer image format, authenticating whether the program is authorized by the customer in a second-level signature authentication, in accordance with a program image format, after the first-level signature authentication is passed, when the customer image indicates the second-level signature authentication, wherein the program image format is different than the customer image format, storing the program into the memory device after the first-level signature authentication and second-level signature authentication are passed, and executing the program after the program is authenticated.