智能语音设备威胁分析与风险评估技术研究  

Research on Threat Analysis and Risks Assessment for Smart Voice Device

作　　者：周玲 刘惟凡[1,2] 卓圣钧 李乐言 ZHOU Ling;LIU Weifan;ZHUO Shengjun;LI Leyan(No.5 Institute of Electronics,Ministry of Industry and Information Technology,Guangzhou Guangdong 511370,China;Key Laboratory of Intelligent Product Quality Evaluation and Reliability Assurance Technology,Ministry of Industry and Information Technology,Guangzhou Guangdong 511370,China)

机构地区：[1]工业和信息化部电子第五研究所,广东广州511370 [2]智能产品质量评价与可靠性保障技术工业和信息化部重点实验室,广东广州511370

出　　处：《信息安全与通信保密》2024年第11期95-106,共12页Information Security and Communications Privacy

基　　金：国家重点研发计划NQI专项“典型智能产品质量安全风险控制重要技术标准研究”(2022YFF0607100)课题四(2022YFF0607104)。

摘　　要：语音交互技术在智能设备中的应用推动了智能语音设备的开发与应用,也为智能语音设备系统带来了未知安全风险,复杂的产品设计对产品的信息安全评估提出了更高的要求。全面识别产品的风险点,是改进产品设计和编制测试用例的基础。以语音聊天机器人为研究对象,研究由语音聊天机器人设备终端、云服务端系统和移动应用程序组成的智能语音设备系统的风险点,通过威胁建模与风险评估的方法对智能语音设备系统存在的信息安全风险开展分析与评估,并基于评估结果开展规范设计与测试用例编制工作。The application of voice interaction technology in smart devices promotes the development and application of smart voice devices,and also brings unknown security risks to smart voice device systems,and complex product design puts forward higher requirements for product information security assessment.Comprehensively identifying the risk points of product is the basis for improving product design and compiling test cases.This paper takes voice chatbot as the research object and studies the risk points of the smart voice device system consisting of voice chatbot device terminals,cloud server systems and mobile applications,analyzes and evaluates the information security risks existing in the smart voice device system through threat modeling and risk assessment,and carries out the specification design and test case compilation based on the evaluation results.

关 键 词：智能语音设备 信息安全 威胁建模 风险评估 规范设计 

分 类 号：TN912.20[电子电信—通信与信息系统]