A THREAT MODEL FOR VOICE-BASED APPLICATIONS

Аннотация

INTRODUCTION server part of the system for processing. Based on In general, voice-based applications can be the input, the server generates an appropriate described as in Figure 1. According to it, initially, response and can return it to the client or perform the command (signal) given by the user is entered an action in the access control system (for example, into the client part of the system on the user's side. grant permission). A cloud service can optionally This subsystem converts the received voice be implemented in this architecture and can store command into an audio signal and sends it to the information or perform a service. Response Service Service command response response Voice Audio Service command signal request USER Client side Server sid e CLOUD Figure 1. Voice-based application architecture Threat modeling identifies potential threats to the – attempt to enter the system using a fake ID - system and assesses the risk level of the identified spoofing; threat. This allows you to properly apply security – data corruption in the network - tampering; settings to a system before starting it. There are several threat modeling tools available, and in – failure of the user to admit that he has practice, the STRIDE methodology and tool offered performed an action - repudiation; by Microsoft are widely used. – unwanted influence and loss of privacy of This methodology allows to classify threats personal data - disclosure of information according to the following factors [1]: (Information disclosure); https://www.theamericanjournals.com/index.php/tajet 37 THE USA JOURNALS THE AMERICAN JOURNAL OF ENGINEERING AND TECHNOLOGY (ISSN – 2689-0984) VOLUME 06 ISSUE05 – attack against system usability - denial of section, the DREAD model was used to rank and service (DoS); prioritize threats according to their severity level [2]. Using the DREAD model, the severity of a threat – the attempt of users to increase the level of can be determined by numerical values (0 (low, privileges by using vulnerabilities - Elevation of difficult), 5 (medium) and 10 (high, easy)) for each privileges. of the five categories described below. Table 1 is DREAD provided by Microsoft is mainly used to used to calculate the final rating. determine the level of risk posed by threats. In this Table 1. Correlation between threat rating and values Threat rating Total cost High 8-10 Medium 4-7 Lower 0-3 The description of all 5 factors of the DREAD model One of the first steps in threat modeling is to is given below [2]: identify existing threats using automated systems. Microsoft Threat Modeling Tool v.7.3.31026.3 was – Damage Potential measures the level of used for this task. For this, it is first necessary to damage that can be caused by a threat. This is design a DFD (Data Flow Diagram) view of the considered a worst-case scenario if an attacker can extended form of the system architecture exploit the vulnerability and damage the entire presented in Figure 1 in a software tool [4]. A system and data. typical DFD representation for voice-based – Reproducibility measures how easily an applications is shown in Figure 2 [3]. In this case, attack or threat can be repeated. the command spoken by the user is delivered as an – Exploitability - an indicator that determines audio signal through the microphone to the client how much effort is required to launch an attack. It part of the system. The client part of the application is considered the worst case if someone can attack. plays an important role and sends information to the server part of the system and based on the – The level of affected users (Affected Users) response received from it to the IoT controller. In determines how many people will be affected if an addition, the user sends a message through the attack is launched. It's usually a measure of what speaker about the insults. In turn, the server side of percentage of users are affected. the application can use cloud services or data – Threat detection complexity storage systems to run its activities. An IoT (Discoverability) - an indicator that shows how controller can perform a security action (for easily a threat can be detected. If the attack is easily example, opening a door) by controlling multiple detectable, then the value is 10. IoT devices. https://www.theamericanjournals.com/index.php/tajet 38 THE USA JOURNALS THE AMERICAN JOURNAL OF ENGINEERING AND TECHNOLOGY (ISSN – 2689-0984) VOLUME 06 ISSUE05 Figure 2. DFD for audio-based applications. A red rectangle represents a voice-based system device. application to the server part of the voice-based ANALYSIS OF THREATS. application: Based on the above DFD, the following were 1.1. Forgery. If no authentication mechanism is predetermined for the implementation of the established between the server side and the client threat analysis for the system: side of a voice-based application, a spoofing attack – it is assumed that a physical attack will not is possible. In other words