MegaMind: a platform for security & privacy extensions for voice assistants
MegaMind: a platform for security & privacy extensions for voice assistants
复制标题
DOI：
10.1145/3458864.3467962
复制
发表时间：
2021-06
期刊：
影响因子：
--
通讯作者：
S. Talebi;A. A. Sani-A.;S. Saroiu;A. Wolman
中科院分区：
文献类型：
--
作者：
S. Talebi;A. A. Sani-A.;S. Saroiu;A. Wolman
语音助手提出了严重的安全性和隐私问题，因为他们在敏感位置（例如，在房屋内）使用始终在麦克风中，并将录音发送到云中进行处理。云转录这些记录并将其解释为用户请求，有时甚至与第三方服务共享这些请求。这些步骤可能会导致意外或恶意的语音数据泄漏以及未经授权的动作（例如购买）。本文介绍了Megamind，这是一个新颖的可扩展平台，可让用户在其语音助手上本地部署安全性和隐私扩展。 Megamind的扩展名在将其发送到云和响应之前，然后将其交付给用户，然后将其插入。 Megamind的编程模型可以轻松编写强大的扩展名，例如一个用于安全对话。此外，Megamind通过提供两个重要的保证，即执行和非干预，可以防止恶意扩展。我们实施Megamind并将其与Amazon Alexa Service SDK集成。我们的评估表明，Megamind在具有足够的计算功率的平台上达到了较小的对话延迟，例如Raspberry Pi 4和基于X86的笔记本电脑。
Voice assistants raise serious security and privacy concerns because they use always-on microphones in sensitive locations (e.g., inside a home) and send audio recordings to the cloud for processing. The cloud transcribes these recordings and interprets them as user requests, and sometimes even shares these requests with third-party services. These steps may result in unintended or malicious voice data leaks and in unauthorized actions, such as a purchase. This paper presents MegaMind, a novel extensible platform that lets a user deploy security and privacy extensions locally on their voice assistant. MegaMind's extensions interpose on requests before sending them to the cloud and on responses before delivering them to the user. MegaMind's programming model enables writing powerful extensions with ease, such as one for secure conversations. Additionally, MegaMind protects against malicious extensions by providing two important guarantees, namely permission enforcement and non-interference. We implement MegaMind and integrate it with Amazon Alexa Service SDK. Our evaluation shows that MegaMind achieves a small conversation latency on platforms with adequate compute power, such as a Raspberry Pi 4 and an x86-based laptop.