System and method of securing devices using encryption keys

1. A system for securely distributing a credential for physical devices, comprising:

a security server; and

a physical device, comprising:

a memory module configured to store a share of the credential,

a communication module configured to exchange signals, and

a Multi-Party Computation (MPC) module configured to perform an MPC process with the security server,

wherein the MPC process outputs two shares of the credential,

wherein a first share of the credential is stored in the physical device, and a second share of the credential is stored in the security server,

wherein the physical device does not have access to the entire credential,

wherein the physical device receives a request to authenticate to a third party, and

wherein the security server exchanges information over the internet with the physical device to output a result that enables the authentication process of the third party to authenticate the physical device to the third party without any one of the third party, the physical device and the security server having access to the entire credential.

2. The system of claim 1 , wherein the physical device comprises a wireless gateway.

3. The system of claim 1 , wherein the security server further comprises a memory configured to store a second share of the credential not stored in the physical device, wherein said second share is associated with an identifier of the physical device storing the first share.

4. The system of claim 1 , wherein the security server further comprises a multi-party computation module configured to perform the multi-party computation process with the physical device.

5. The system of claim 1 , further comprising an intermediate unit comprising an internet gateway, said internet gateway enabling the physical device to communicate with the security server over the internet.

6. The system of claim 5 , wherein the communication module of the physical device and the intermediate unit exchange information via a wired communication mechanism.

7. The system of claim 5 , wherein the communication module of the physical device and the intermediate unit exchange information via a short-range wireless communication mechanism.

8. The system of claim 5 , wherein the intermediate unit is an electronic device operated by a user of the physical device.

9. The system of claim 5 , further comprising multiple distinct physical devices configured to execute a multi-party computation process with the security server, wherein the intermediate unit communicates with at least two of the multiple distinct physical devices, and wherein the intermediate unit transfers information from the at least two of the multiple distinct physical devices to the security server via the internet gateway.

10. The system of claim 5 , wherein the intermediate unit comprises a user interface enabling a user to input data into the intermediate unit, said data resulting in initiation of the multi-party computation process.

11. A method for securely distributing a credential uniquely associated with a physical device, comprising:

in a manufacturing phase,

exchanging information between a processing module of the physical device and a security server to cooperatively execute a multi-party computation (MPC) process, wherein the output of the MPC process is two shares of the credential, and

storing one share of the credential in the physical device and another share of the credential in the security server, wherein the other share of the credential is stored in the security server in association with an identifier of the physical device, and wherein the physical device does not have access to the entire credential; and

in a usage phase,

the physical device receiving a request to authenticate to a third party, and

the security server exchanging information over the internet with the physical device to output a result that enables the authentication process of the third party to authenticate the physical device to the third party without any one of the third party, the physical device and the security server having access to the entire credential.

12. The method of claim 11 , further comprising receiving a request to initiate the multi-party computation process, said request comprising an identifier of the physical device, such that the share stored at the security server is used when authenticating or validating the specific physical device.

13. The method of claim 11 , further comprising associating an identifier of the physical device with the second share stored in the security server.

14. The method of claim 11 , further comprising:

storing a message counter in both the physical device and the security server, wherein said message counter represents a usage of the share of the credential stored in the physical device;

adjusting the message counter in both the physical device and the security server upon use of the share versus the third party; and

authenticating the physical device only if the value stored in both the physical device and the security server is equal.

15. The method of claim 11 , further comprising installing the share of the credential in the physical device using a physical communication port.

16. The method of claim 11 , wherein the physical device is an IoT device comprising a sensor, wherein the IoT device wishes to authenticate to the third party to send information collected by the sensor.

17. The method of claim 11 , further comprising frequently refreshing the credential shares using the MPC process while the entire credential does not change.

18. The method of claim 17 , further comprising verifying the same credential version is used in the MPC process using a counter stored in both the physical device and the security server.