[论文解读] Smart Home Personal Assistants: A Security and Privacy Review

Jide Edu, José M. Such+1 more|arXiv (Cornell University)|Mar 13, 2019

User Authentication and Security Systems参考文献 123被引用 47

一句话总结

本文对 Smart Home Personal Assistants (SPAs) 的安全与隐私问题进行了系统性文献综述， 将攻击向量和对策进行分类，并概述尚待解决的研究挑战。

ABSTRACT

Smart Home Personal Assistants (SPA) are an emerging innovation that is changing the way in which home users interact with the technology. However, there are a number of elements that expose these systems to various risks: i) the open nature of the voice channel they use, ii) the complexity of their architecture, iii) the AI features they rely on, and iv) their use of a wide-range of underlying technologies. This paper presents an in-depth review of the security and privacy issues in SPA, categorizing the most important attack vectors and their countermeasures. Based on this, we discuss open research challenges that can help steer the community to tackle and address current security and privacy issues in SPA. One of our key findings is that even though the attack surface of SPA is conspicuously broad and there has been a significant amount of recent research efforts in this area, research has so far focused on a small part of the attack surface, particularly on issues related to the interaction between the user and the SPA devices. We also point out that further research is needed to tackle issues related to authorization, speech recognition or profiling, to name a few. To the best of our knowledge, this is the first article to conduct such a comprehensive review and characterization of the security and privacy issues and countermeasures of SPA.

研究动机与目标

• 概述 SPA 架构及其安全/隐私影响。
• 对影响 SPAs 的主要攻击及对策进行分类。
• 评估现有防御的局限性并识别当前研究中的空白。
• 提出一个开放挑战的路线图，以指导未来在 SPA 安全与隐私领域的工作。

提出的方法

• 对 SPA 安全与隐私文献应用系统性文献综述（SLR）。
• 在数据库（ACM DL、Web of Science、IEEE Xplore、ScienceDirect）中检索相关术语。
• 通过人工补充检索以确保完整性。
• 纳入描述 SPA 安全/隐私的研究，排除不涉及结果的论文。
• 分析论文的技术、年份、标准、度量和结果。

实验结果

研究问题

• RQ1 RQ1：使用 SPAs 背后的主要安全与隐私问题是什么？
• RQ2 RQ2：已知对 SPAs 的攻击有哪些特征？
• RQ3 RQ3：现有对策的主要局限性是什么，如何改进？
• RQ4 RQ4：为解决 SPA 安全与隐私应对的主要开放挑战是什么？

主要发现

• SPAs 的攻击面很广，但迄今为止的研究仅覆盖其中的一部分。
• 大多数研究关注用户与 SPA 设备之间的交互，而非其他架构组件。
• 本研究提供了对 SPA 安全/隐私问题及对策的首次全面综述与特征描述。
• 本文指出除了用户-设备界面外，在授权、语音识别、画像建立和云/第三方交互方面需要研究。
• 该研究概述了指导未来 SPA 安全与隐私研究的开放挑战。