Smart Home Personal Assistants: A Security and Privacy Review

Abstract

Smart Home Personal Assistants (SPA) are an emerging innovation that is changing the way in which home users interact with the technology. However, there are a number of elements that expose these systems to various risks: i) the open nature of the voice channel they use, ii) the complexity of their architecture, iii) the AI features they rely on, and iv) their use of a wide-range of underlying technologies. This paper presents an in-depth review of the security and privacy issues in SPA, categorizing the most important attack vectors and their countermeasures. Based on this, we discuss open research challenges that can help steer the community to tackle and address current security and privacy issues in SPA. One of our key findings is that even though the attack surface of SPA is conspicuously broad and there has been a significant amount of recent research efforts in this area, research has so far focused on a small part of the attack surface, particularly on issues related to the interaction between the user and the SPA devices. We also point out that further research is needed to tackle issues related to authorization, speech recognition or profiling, to name a few. To the best of our knowledge, this is the first article to conduct such a comprehensive review and characterization of the security and privacy issues and countermeasures of SPA.

arXiv commentAccepted for publication in ACM Computing Surveys

References in corpus (16)

• Intriguing properties of neural networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• DolphinAtack: Inaudible Voice Commands
• User Perceptions of Smart Home IoT Privacy
• A Smart Home is No Castle: Privacy Vulnerabilities of Encrypted IoT Traffic
• Towards the Science of Security and Privacy in Machine Learning
• Comparing Speech and Keyboard Text Entry for Short Messages in Two Languages on Touchscreen Phones
• Keeping the Smart Home Private with Smart(er) IoT Traffic Shaping
• Resolving Multi-party Privacy Conflicts in Social Media
• Privacy Policy Negotiation in Social Media
• The Insecurity of Home Digital Voice Assistants -- Amazon Alexa as a Case Study
• The Security of Smart Buildings: a Systematic Literature Review
• Implicit Contextual Integrity in Online Social Networks
• Intelligent Virtual Assistant knows Your Life
• Contextual Slot Carryover for Disparate Schemas
• Anomalous keys in Tor relays

Cited by in corpus (9)

• Evaluating Privacy, Security, and Trust Perceptions in Conversational AI: A Systematic Review
• Healthcare Voice AI Assistants: Factors Influencing Trust and Intention to Use
• A Survey of User Perspectives on Security and Privacy in a Home Networking Environment
• A Systematic Review of Ethical Concerns with Voice Assistants
• Legal Obligation and Ethical Best Practice: Towards Meaningful Verbal Consent for Voice Assistants
• When It's Not Worth the Paper It's Written On: A Provocation on the Certification of Skills in the Alexa and Google Assistant Ecosystems
• SkillVet: Automated Traceability Analysis of Amazon Alexa Skills
• Collaborative filtering to capture AI user's preferences as norms
• Automating Internet of Things Network Traffic Collection with Robotic Arm Interactions