Smart Home Personal Assistants: A Security and Privacy Review

TL;DR

This paper provides the first comprehensive review of security and privacy challenges in Smart Home Personal Assistants, highlighting attack vectors, existing research focus, and open challenges for future work.

Contribution

It offers a detailed categorization of security and privacy issues in SPA and identifies gaps in current research, especially in areas like authorization and profiling.

Findings

Research has mainly focused on user-device interaction issues.

The attack surface of SPA is broad and under-explored.

Further research is needed on authorization and speech recognition challenges.

Abstract

Smart Home Personal Assistants (SPA) are an emerging innovation that is changing the way in which home users interact with the technology. However, there are a number of elements that expose these systems to various risks: i) the open nature of the voice channel they use, ii) the complexity of their architecture, iii) the AI features they rely on, and iv) their use of a wide-range of underlying technologies. This paper presents an in-depth review of the security and privacy issues in SPA, categorizing the most important attack vectors and their countermeasures. Based on this, we discuss open research challenges that can help steer the community to tackle and address current security and privacy issues in SPA. One of our key findings is that even though the attack surface of SPA is conspicuously broad and there has been a significant amount of recent research efforts in this area, research has so far focused on a small part of the attack surface, particularly on issues related to the interaction between the user and the SPA devices. We also point out that further research is needed to tackle issues related to authorization, speech recognition or profiling, to name a few. To the best of our knowledge, this is the first article to conduct such a comprehensive review and characterization of the security and privacy issues and countermeasures of SPA.