Patents are not always a lot of fun but they do turn up a lot of weird potential applications for future technology. This week turned up a patent application posted on January 10 by Amazon that looks like Alexa’s parent company has figured out a new way to detect replay attacks in voice-based authentication systems.
A replay attack is a form of network attack in which valid data transmission is maliciously or fraudulently repeated or delayed — this is also sometimes known as a playback attack or a “man-in-the-middle” attack. You can also think of this kind of attack as replaying messages from a different context into the intended target’s security protocol, which makes the honest participant think they have successfully completed the security protocol exchange.
In the context of Amazon’s patent application, it looks like the company is trying to figure out — or potentially has figured out — a way to protect voice-based systems, such as smart speakers powered by a digital assistant like Alexa, from being spoofed by a replay attack. Here’s part of the patent application that gives an overview of how it works:
“In one embodiment, audio is captured via an audio input device. It is then verified that the audio includes a voice authentication factor spoken by a user. The audio is then compared with stored audio spoken by the user. If it is then determined that an exact copy of the voice authentication factor is in the stored audio, one or more actions may be performed.”
If you dig into the patent application, it looks like Amazon is basing its new protections on something called a “watermark signal,” which is basically a digital copy of the command. When the device hears a current command like, “open the safe,” it can recognize that it was previously presented and confirm that the voice command is a replay of a recording and deny the command.
So far, there is no pushback from security experts to these kinds of patents, which the company often deems “exploratory,” but concerns about biometric authentication technology continue to grow. Last year, the Electronic Frontier Foundation (EFF) raised concerns about another Amazon patent that would enable Alexa to recognize a range of user characteristics, including accent and emotional state as well as ethnicity, gender, age and background noise, which could be used for a wealth of troubling applications ranging from identifying terrorists to immigration enforcement.
