← Back to home

Research

QUESTION 01

How do you make a human truly random?

Every new account needs a random password. Computers have dedicated hardware and software to generate sufficiently random numbers — but this is exactly what humans are worst at. Study after study has shown that the passwords people set themselves follow clear patterns and are far less secure than expected.

Now imagine: what if you could generate a secure password just by holding your phone and performing a few simple gestures? Wouldn’t that be so much easier?

My idea is to design a set of “challenge rules” for the user: following a sequence of carefully crafted audio cues (known as earcons), they perform a few simple taps. Guided jointly by the rules and the sounds, their behavior is perturbed into genuine randomness, yielding a high-entropy password. The user needs no knowledge of cryptography, yet can easily produce a secret that is virtually impossible to guess.

The earcons for different feedback moods — have a listen.
QUESTION 02

How do you securely pair a pacemaker?

Did you know? Today’s cardiac pacemakers — along with insulin pumps and other implantable medical devices — commonly support wireless connections. A doctor thousands of miles away can read a patient’s data and adjust the device’s settings remotely.

Convenient as this is, it brings new security challenges. A pacemaker has no screen and no buttons, and its battery must last for years — often a decade or more — so traditional authentication such as typing a password or scanning a QR code is simply not feasible. If the wireless link is left unprotected, an attacker could gain access to the device: stealing health data at best, or tampering with its settings — even endangering the patient’s life — at worst.

My solution turns a gesture into the key. The patient simply holds a smartphone and performs a few specific motions; the phone and the pacemaker each record the signals those motions produce and derive matching credentials from them. Once the two sides verify the match, a trusted connection is established. No extra hardware, no cryptography knowledge required — patients enjoy the convenience of wireless care while keeping their device and their privacy safe.

Sequence diagram of the pairing protocol between an external device and an implantable medical device
The pairing protocol I designed.
Demonstrating the research prototype to Academician Huai, China’s Minister of Education
Side note: this research was once demonstrated to Academician Huai, China’s Minister of Education, and was well received.

To learn more, see OOBKey, VibKey, FuzzyKey.