Enhancing Security and Privacy for Voice Assistant Systems

The rapid proliferation of Voice Assistant (VA) devices such as Amazon\u27s Alexa, Google Home, and Apple\u27s Siri has transformed how we interact with technology in our daily lives. These devices provide users with hands-free access to various services, from weather forecasts and news updates to music streaming and home automation. However, the convenience and utility of VA devices come with a trade-off regarding privacy and security. Researchers have noted that voice assistant devices may be vulnerable to attacks by malicious actors, who could take control of the device or use it to access other devices on a user\u27s network. Besides that, leaking the biophysical status of the users from voice signals and being profiled by Voice Service Providers (VSP) are recent concerns as the advances of Deep Learning techniques as well as Natural Language Processing (NLP). This dissertation first presents a solution to enhance the security of VA devices. Our proposed defending system on the VA devices can against both voice replay and injection attacks without any additional devices or any extra user’s effort. Specifically, we use both voice and wireless data to verify the correlation between the user\u27s presence and voice commands, then finally detect the attacks. Secondly, this dissertation proposes an anonymity scheme on VA devices to protecting users’ voice data from being linked to their accounts by the VSP. Our proposed scheme aims to mix the queries from multiple VA users\u27 devices, hiding the source of queries and hiding the relay\u27s real queries. To achieve effective anonymity, the anonymizer is equipped with a proposed privacy-preserving pattern matching scheme, which is run with the help of a semi-trusted server and is used to find the most effective relay for the requester based on their pattern similarity. Lastly, we introduce a framework VPASS, that supports managing personalized privacy requirements for VA systems. Specifically, we propose mechanisms to quantify two key aspects: the amount of information disclosure and the level of privacy sensitivity each voice command has. Our mechanisms employ deep learning techniques for natural language processing and can accurately detect privacy-sensitive commands based on an individual\u27s prior history of VAS interaction. Finally, VPASS generates monthly reports or immediate privacy alerts based on the privacy policies pre-defined by users