WearID: Wearable-Assisted Low-Effort Authentication to Voice Assistants using Cross-Domain Speech Similarity

TL;DR

WearID enhances voice assistant security by using wearable devices to verify voice commands through cross-domain speech similarity, reducing impersonation and replay attack risks.

Contribution

This paper introduces WearID, a novel system leveraging wearable motion sensors to authenticate voice commands via cross-domain analysis, improving security against acoustic attacks.

Findings

WearID effectively detects impersonation and replay attacks.

The system achieves high accuracy in verifying legitimate users.

WearID is compatible with off-the-shelf wearable devices.

Abstract

Due to the open nature of voice input, voice assistant (VA) systems (e.g., Google Home and Amazon Alexa) are under a high risk of sensitive information leakage (e.g., personal schedules and shopping accounts). Though the existing VA systems may employ voice features to identify users, they are still vulnerable to various acoustic attacks (e.g., impersonation, replay and hidden command attacks). In this work, we focus on the security issues of the emerging VA systems and aim to protect the users' highly sensitive information from these attacks. Towards this end, we propose a system, WearID, which uses an off-the-shelf wearable device (e.g., a smartwatch or bracelet) as a secure token to verify the user's voice commands to the VA system. In particular, WearID exploits the readily available motion sensors from most wearables to describe the command sound in vibration domain and check the received command sound across two domains (i.e., wearable's motion sensor vs. VA device's microphone) to ensure the sound is from the legitimate user.