A security-token necklace, ear buds or eyeglasses developed at the University of Michigan could eliminate vulnerabilities in voice authentication, or the practice of logging in to a device or service with just your voice.
Talking to electronics has become a popular way to command them. In the new area of the internet of things (IoT), voice assistants connect people to their mobile devices, homes and cars. Through spoken interactions, we place calls, send text messages, check email, get travel directions, control applications and access bank accounts. Barclays Bank is an example of this. They recently began using a technology that uses voice to verify the identity of all call-in customers.
Kang Shin demonstrates VAuth, a wearable voice authentication device. Source: Joseph Xu/Michigan Engineering
Researchers say that sound is an “open channel” that can be easily spoofed by impersonators and hackers.
"Increasingly, voice is being used as a security feature but it actually has huge holes in it," said Kang Shin, the Kevin and Nancy O'Connor Professor of Computer Science and professor of electrical engineering and computer science at U-M. "If a system is using only your voice signature, it can be very dangerous. We believe you have to have a second channel to authenticate the owner of the voice."
The solution Shin and his colleagues have developed is called VAuth and it is a wearable device that can take the form of a necklace, earbuds or a small attachment to eyeglasses. VAuth continuously registers speech-induced vibrations on the user’s body and pairs with the sound of that person’s voice to create a unique and secure signature.
The process of speaking creates vibrations that can be detected on the skin of a person’s face, throat or chest. The system works by leveraging the instantaneous consistency between signals from the accelerometer in the wearable security token and the microphone in the electronic device. You can only use voice authentication with your device when you’re wearing the security token.
The team has built a prototype using an off-the-shelf accelerometer that measures motion and a Bluetooth transmitter that sends the vibration signal to the microphone in the user’s device. They’ve also developed matching algorithms and software for Google Now.
"VAuth is the first serious attempt to secure this service, ensuring that your voice assistant will only listen to your commands instead of others," Shin said. "It delivers physical security, which is difficult to compromise even by sophisticated attackers. Only with this guarantee can the voice assistant be trusted as personal and secure, especially in scenarios such as banking and home safety."
Changing from the existing voice biometric mechanisms requires training from each individual that uses them.
"In addition, VAuth overcomes a key problem of voice biometrics," said Kassem Fawaz, a graduate student at U-M and is now an assistant professor at the University of Wisconsin. "A voice biometric, similar to a fingerprint, is not easy to keep protected. From a few recordings of the user's voice, an attacker can impersonate the user by generating a matching 'voice print.' The users can do little to regain their security as they cannot simply change their voice. On the other hand, when losing VAuth for any reason, the user can simply unpair it to prevent an attacker from using their device."
The team tested VAuth with 18 users and 30 voice commands. It achieved 97 percent detection accuracy and less than a 0.1 percent false positive rate, regardless of its position on the body and user’s language, accent or even mobility. The researchers say it successfully stops various practical attacks, like replay attacks, mangled voice attacks or impersonation attacks.
The researchers also surveyed 952 people to gauge their willingness to wear a security token.
"Seventy percent of them said they are willing to give VAuth a serious try in one of the three configurations we developed—and half of them said they are willing to pay $25 more for the technology," said Huan Feng, who worked on the project as a graduate student.
A paper on this research will be presented on October 19 at the International Conference on Mobile Computing and Networking, MobiCom 2017 in Snowbird, Utah.
