A method for protecting unauthorized access to data, the data collected by sensor nodes within a sensor network and accessible to one or more applications by authorized customers through a service data platform, the service data platform in communication with the sensor network, comprising: 1.1 generating a key-pair associated with a customer including a public encryption key and a private decryption key; 1.2 requesting certification of the public encryption key; 1.3 receiving a certificate representing a certified public encryption key; 1.4 distributing the certificate to the sensor nodes within the sensor network associated with the customer to enable the sensor nodes to encrypt sensor data available at the sensor nodes with the certificate associated with the authorized user prior to being transmitted to the service data platform; 1.5 splitting, using at least one processor of a machine, the private decryption key into multiple shares to decrypt the encrypted data when accessed by an application associated with the authorized customer; 1.6 storing a first share of the multiple shares at the service data platform; 1.7 storing a password encrypted second share of the multiple shares at the service data platform; 1.8 transmitting a third share of the multiple shares to a third-party device for storage; 1.9 in response to a request from the application associated with the authorized customer to access the encrypted data, receiving the encrypted data; 1.10 determining that the private decryption key cannot be reconstructed using the combination of the first share and the password encrypted second share at the service data platform to decrypt the encrypted data; 1.11 accessing the third party share from the third party device; and 1.12 recovering, at the service data platform, the private decryption key using the third share and at least one of the first share and the password encrypted second share of the multiple shares. 1.1 generating a key-pair associated with a customer including a public encryption key and a private decryption key; 1.2 requesting certification of the public encryption key; 1.3 receiving a certificate representing a certified public encryption key; 1.4 distributing the certificate to the sensor nodes within the sensor network associated with the customer to enable the sensor nodes to encrypt sensor data available at the sensor nodes with the certificate associated with the authorized user prior to being transmitted to the service data platform; 1.5 splitting, using at least one processor of a machine, the private decryption key into multiple shares to decrypt the encrypted data when accessed by an application associated with the authorized customer; 1.6 storing a first share of the multiple shares at the service data platform; 1.7 storing a password encrypted second share of the multiple shares at the service data platform; 1.8 transmitting a third share of the multiple shares to a third-party device for storage; 1.9 in response to a request from the application associated with the authorized customer to access the encrypted data, receiving the encrypted data; 1.10 determining that the private decryption key cannot be reconstructed using the combination of the first share and the password encrypted second share at the service data platform to decrypt the encrypted data; 1.11 accessing the third party share from the third party device; and 1.12 recovering, at the service data platform, the private decryption key using the third share and at least one of the first share and the password encrypted second share of the multiple shares.