Security and data privacy for lighting sensory networks

A system to cryptographically protect customer data, the system comprising:

• a memory device for storing instructions;
• and
• at least one processor of a machine, which, when executing the instructions, causes the
• system to perform operations comprising:
• collecting sensor data by sensor nodes of a sensor network, the sensor network in communication with a service data platform;
• encrypting the sensor data, at the sensor nodes prior to being transmitted to the service data platform, the sensor data is encrypted using a certified public key associated with a customer key-pair, wherein the sensor data representing the customer data associated with sensitive identification information and the certified public key is stored at the server nodes to enable the sensor nodes to encrypt the sensor data;
• cryptographically signing the sensor data with a device private key associated with the sensor nodes;
• transporting the encrypted sensor data to the service data platform for storage;
• and
• decrypting at the service data platform, using at least one processor of a machine, the encrypted sensor data using at least a private key sharing scheme that reconstructs a private key associated with the customer key-pair using a first share, a password encrypted second share, and a third share, the first share assigned to the service data platform, the password encrypted second share assigned to a customer of the customer key-pair, and the third share is assigned to a trusted third party device, and wherein at least two of the first, second, and third share are sufficient to reconstruct the private key associated with the customer key-par;
• receiving, at the trusted third party device, an authorization for release of the third party share;
• and
• recovering the private key associated with the customer key-pair by reconstructing, at the service data platform, the private key associated with the customer key-pair based on the first share and the received third party share.

A non-transitory machine-readable medium storing instructions that, when executed by at least one processor of a machine, cause the machine to perform operations comprising, at least:

• collecting sensor data by sensor nodes of a sensor network, the sensor network in communication with a service data platform;
• encrypting the sensor data, at the sensor nodes prior to being transmitted to the service data platform, using a certified public key associated with a customer key-pair, wherein:
• the sensor data representing the customer data associated with sensitive identification information, and
• the certified public key is stored at the server nodes to enable the sensor nodes to encrypt the sensor data;
• cryptographically signing the sensor data with a device private key associated with the sensor nodes;
• transporting the encrypted sensor data to the service data platform for storage;
• and
• decrypting at the service data platform, using at least one processor of a machine, the encrypted sensor data using at least a private key sharing scheme that reconstructs a private key associated with the customer key-pair using a first share, a password encrypted second share, and a third share, the first share assigned to the service data platform, the password encrypted second share assigned to a customer of the customer key-pair, and the third share is assigned to a trusted third party device, and wherein at least two of the first, second, and third share are sufficient to reconstruct the private key associated with the customer key-par;
• receiving, at the trusted third party device, an authorization for release of the third party share;
• and
• recovering the private key associated with the customer key-pair by reconstructing, at the service data platform, the private key associated with the customer key-pair based on the first share and the received third party share.