Voice Skill Squatting Verification via Unique Device Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Always-on IoT devices are vulnerable to skill squatting attacks, where attackers exploit systematic errors to route users to malicious applications without their knowledge, posing a security threat through fraudulent skills that simulate legitimate ones.
Innovation Solution
Implementing a verification mechanism where always-on listening devices retrieve and present unique, non-confidential information to users before operating a skill, allowing users to verify the legitimacy of the skill through known details such as location or transaction information, thereby reducing the chances of skill squatting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If voice-controlled skills are implemented on always-on devices, then user convenience and automation are improved, but security vulnerability to skill squatting attacks increases
Solution Approach 1:
The system performs preliminary verification by presenting unique device information to the user before the skill is executed. This advance check allows the user to confirm the skill's legitimacy before any action is taken, preventing malicious skills from executing without detection.
Solution Approach 2:
The system provides feedback to the user by displaying unique device information that the user can verify. This feedback loop enables the user to confirm whether the invoked skill is legitimate before allowing execution, creating a security checkpoint in the voice-controlled operation flow.
2Reliability
If verification mechanisms are added to confirm skill legitimacy, then security against skill squatting is improved, but device complexity and operation time increase
Solution Approach 1:
The system uses a copy of unique device information (such as device ID, location, or other identifiers) that already exists in the device's memory or can be easily retrieved. Rather than implementing complex cryptographic verification, the system presents this existing information to the user for confirmation, simplifying the verification mechanism while maintaining security.
3Reliability
If unique device information is presented to users for verification, then security against fraudulent skills is improved, but user interaction time and operational efficiency decrease
Solution Approach 1:
The system presents only the necessary unique device information that is sufficient for verification, rather than requiring full authentication sequences. This partial verification approach provides adequate security while minimizing the time burden on users, as users only need to confirm the displayed information matches their expectations.
Data Source
AI summary
Disclosed herein are system, method, and computer program product embodiments for protecting a device from skill squatting by verifying the legitimacy of a skill to a user before operating the skill based on user instructions. Upon receiving an audio signal from a user to operate a skill on a device, the skill can retrieve unique and non-confidential information related to the user or the device, and further present the unique and non-confidential information to the user such that the information is used to verify the legitimacy of the skill. Upon a verification of the legitimacy of the skill, the user can operate the skill by voice or audio instructions.