Security for IoT home voice assistants

• US 10,887,351 B2
• Filed: 05/02/2018
• Issued: 01/05/2021
• Est. Priority Date: 05/02/2018
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: NortonLifeLock Inc.
• Inventors: Nanda, Susanta K., Sun, Yuqiong, Shintre, Saurabh
• Primary Examiner(s): Jamshidi, Ghodrat
• Application Number:
  US15/969,193
• Publication Number:
  US 20190342339A1
• Time in Patent Office: 979 Days
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 3/167 Audio in a user interface, e.g. using voice commands for navigating, audio feedback
• CPC Class Codes: G10L 2015/223 Execution procedure of a spoken command
• CPC Class Codes: H04L 12/2803 Home automation networks
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

A method for implementing security of Internet of Things (IoT) home voice assistants is described. In one embodiment, a computer-implemented method for implementing a security policy with a voice assistant includes obtaining, by one or more computing devices, encrypted traffic from a voice assistant; identifying, by the one or more computing devices, a user voice command in the encrypted traffic based at least in part on one or more identifiable attributes of the encrypted traffic; determining, by the one or more computing devices, the user voice command triggers at least one security policy; and upon determining the user voice command triggers the at least one security policy, performing, by the one or more computing devices, a security action that implements the at least one security policy. In some cases, the method may include obtaining an audio recording of the user voice command with a microphone built into the router.

Claims

1. A computer-implemented method for implementing a security policy with a voice assistant, the method being performed by one or more computing devices, each comprising one or more processors, the method comprising:

obtaining, by the one or more computing devices, encrypted traffic from the voice assistant;

obtaining, by the one or more computing devices, an audio recording of the user voice command with a microphone built into the one or more computing devices;

generating, by the one or more computing devices, a library of one or more identifiable attributes of the user voice command based at least in part on analysis of the encrypted traffic generated by the voice assistant and at least in part on analysis of the audio recording over a period of time;

identifying, by the one or more computing devices, the user voice command in the encrypted traffic obtained by the one or more computing devices based at least in part on the one or more identifiable attributes of the encrypted traffic;

determining, by the one or more computing devices, the user voice command triggers at least one security policy; and

upon determining the user voice command triggers the at least one security policy, performing, by the one or more computing devices, a security action that implements the at least one security policy.

2. The method of claim 1, wherein a router in communication with a cloud service obtains the encrypted traffic, the router being connected by wire or wirelessly to the voice assistant and being placed between the voice assistant and the cloud service.

3. The method of claim 2, wherein performing the security action comprises:

blocking, at the router, the user voice command received by the voice assistant from reaching the cloud service.

4. The method of claim 2, wherein the router comprises a microphone built into the router.

5. The method of claim 1, wherein identifying the user voice command includes matching at least one of the one or more identifiable attributes of the encrypted traffic with one or more attributes of an analyzed user voice command stored in the library.

6. The method of claim 5, wherein the one or more identifiable attributes of the encrypted traffic comprises at least an interactive data communication pattern between the voice assistant and the cloud service in communication with the voice assistant.

7. The method of claim 5, wherein the one or more identifiable attributes of the encrypted traffic comprises at least a user voice command history.

8. The method of claim 5, wherein the one or more identifiable attributes of the encrypted traffic comprises at least a length of the audio recording associated with the encrypted traffic.

9. The method of claim 1, wherein the security policy comprises:

generating an alert based at least in part on the user voice command;

and sending the alert to a user.

10. The method of claim 9, wherein the security policy comprises:

blocking the user voice command based on a response from the user receiving the alert.

11. The method of claim 1, wherein implementing the policy comprises:

blocking the user voice command when the user voice command is given under a predefined context.

12. The method of claim 11, wherein the predefined context is a time context, a user location context, a device location context, a user identity context, a device type context, a device identification context, or combinations thereof.

13. A computing device configured for implementing a security policy with a voice assistant, comprising:

a processor;

memory in electronic communication with the processor, wherein the memory stores computer executable instructions that when executed by the processor cause the processor to perform the steps of;

obtaining encrypted traffic from a voice assistant;

obtaining an audio recording of the user voice command with a microphone built into the computing device;

generating a library of one or more identifiable attributes of the user voice command based at least in part on analysis of the encrypted traffic generated by the voice assistant and at least in part on analysis of the audio recording over a period of time;

identifying the user voice command in the encrypted traffic obtained by the computing device based at least in part on the one or more identifiable attributes of the encrypted traffic;

determining the user voice command triggers at least one security policy; and

upon determining the user voice command triggers the at least one security policy, performing a security action that implements the at least one security policy.

14. The computing device of claim 13, wherein the computing device is a router in communication with a cloud service.

15. The computing device of claim 14, wherein the instructions executed by the processor cause the processor to perform the steps of:

comparing the audio recording to the encrypted traffic.

16. The computing device of claim 13, wherein the instructions executed by the processor cause the processor to perform the steps of:

determining a subsequent user voice command by comparing at least one attribute stored in the library.

17. The computing device of claim 13, wherein the at least one security policy comprises blocking the user voice command.

18. A non-transitory computer-readable storage medium storing computer executable instructions that when executed by a processor cause the processor to perform the steps of:

obtaining encrypted traffic from a voice assistant;

obtain an audio recording of the user voice command with a microphone built into one or more computing devices associated with the processor;

generating a library of one or more identifiable attributes of the user voice command based at least in part on analysis of the encrypted traffic generated by the voice assistant and at least in part on analysis of the audio recording over a period of time;

identifying a user voice command in the encrypted traffic obtained by the one or more computing devices based at least in part on one or more identifiable attributes of the encrypted traffic;

determining the user voice command triggers at least one security policy; and

upon determining the user voice command triggers the at least one security policy, performing a security action that implements the at least one security policy.