CAREER: Secure Voice-Controlled Platforms

语音控制技术利用自然语言处理（NLP）技术，通过语音用户界面（VUI）实现免提交互，被广泛部署在众多物联网平台中，如亚马逊Alexa、b谷歌Home和汽车语音助手。除了内置功能之外，语音控制设备还通过其供应商（如亚马逊和b谷歌）培育的生态系统得到了增强。在这样的生态系统中，第三方开发人员可以构建新的功能，为最终用户提供额外的服务，例如，订餐、管理银行账户和锁门。这些系统已经被部署到世界各地的家庭中，并被数千万用户使用。然而，它们可能带来新的安全和隐私风险，其影响迄今尚未得到充分理解。这项工作的重点是解决语音控制平台中的安全和隐私问题。该项目定义了我们如何在使用语音界面时保护用户，并在保护物联网基础设施和加强国家安全方面取得关键进展。结合综合教育和推广工作，这项工作为设计具有强大安全性和隐私性的物联网平台提供了技术基础。由于缺乏有效的手段对开放和噪声信道中涉及的各方进行认证和授权，因此保护语音用户界面从根本上来说是一项挑战。该项目的重点是通过嘈杂、开放和低带宽的语音通道，帮助用户避免意外的敏感行为，从而保护用户。这项工作主要围绕三个重点进行：(1)设计基于聊天机器人的高效测试框架，该框架结合语义理解和安全领域知识生成输入，并理解输出，以确定语音应用程序在安装期间的意外敏感行为；(2)设计基于上下文的运行时意外语音命令完整性检查和检测；(3)设计可用界面，与用户沟通前两次推力中识别的风险。这些探索最终形成了作为语音控制平台一部分的安全模块的设计选项，以及针对物联网平台的更广泛的安全和隐私建议。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Voice control technologies, which utilize natural language processing (NLP) techniques to enable handsfree interactions through Voice User Interface (VUI), are widely deployed in a plethora of IoT platforms, such as Amazon Alexa, Google Home, and automotive voice assistants. In addition to the built-in functionalities, voice-controlled devices are enhanced by an ecosystem fostered by their providers, such as Amazon and Google. In such an ecosystem, third-party developers can build new functions to offer additional services to the end-users for example, order food, manage bank accounts, and lock doors. These systems have already been deployed to households around the world and utilized by tens of millions of users. However, they could bring in new security and privacy risks, whose implications are not adequately understood so far. This work focuses on addressing the security and privacy issues in voice-controlled platforms. The project defines how we secure users while using voice interfaces and make key progress towards securing the IoT infrastructure and enhancing national security. Combined with integrated education and outreach efforts, this work provides a technical foundation for designing IoT platforms with strong security and privacy properties. Protecting Voice User Interfaces is fundamentally challenging, owing to the lack of effective means to authenticate and authorize the parties involved in the open and noisy channel. The project focuses on protecting users by helping them avoid unexpected sensitive behaviors through the noisy, open, and low-bandwidth voice channel. The work is organized around three main thrusts: (1) the design of a chatbot-based effective and efficient testing framework that combines semantic understanding and security domain knowledge to generate inputs, and understands outputs for determining unexpected sensitive behaviors in the voice apps during installation time, (2) the design of context-based integrity check and detection for unexpected voice command at runtime, and (3) the design of usable interfaces to communicate with users about the risks identified in the first two thrusts. These explorations culminate in the design options for a security module as part of a voice-controlled platform, and broader security and privacy recommendations for IoT platforms.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.