The problem addressed in this research is the need for supervisory or system summary displays for the Advanced Tomahawk Weapons Control System (ATWCS). These displays are needed to accurately depict the current system state and weapon status in order to aid strike supervisory personnel in making correct and timely decisions. This research examined the problem in the context of designing a set of graphical displays that extracts information relevant to the strike supervisor from ATWCS and displays it in a manner that allows both rapid and accurate interpretation. The approach used to solve the problem progressed in four distinct phases. The first phase, Requirements Analysis, consisted of gathering system requirements through interviews with U.S. Navy officers who have experience as strike warfare supervisors. In the second phase, an initial design was produced using Century Computing's rapid prototyping tool TAE Plus Workbench(TM). The third phase involved the heuristic and guideline evaluation of the prototype based on accepted user interface design principles and ATWCS user interface requirement specifications. This evaluation produced a second iteration prototype that was used in the final phase, Usability Testing. The prototype was tested by U.S. Navy Officers with Tomahawk strike experience and test results were recorded. Changes were then made to the prototype to correct usability problems discovered by the user testing, yielding a third iteration prototype. The final result of this research is a set of prototype displays, in both paper and TAE Plus Workbench(TM) resource file formats, that will be provided to Naval Command, Control, and Ocean Surveillance Center (NCCOSC) Research, Development, Test and Evaluation Division (NRaD) for consideration during system design and implementation.

Cette thèse souhaite fournir des outils pour qu’un utilisateur puisse contribuer activement à la sécurité de son usage d’un système informatique. Les activités de sensibilités différentes d’un utilisateur nécessitent tout d’abord d’être cloisonnées dans des domaines dédiés, par un contrôle d’accès s’ajustant aux besoins de l’utilisateur. Afin de conserver ce cloisonnement, celui-ci doit être en mesure d’identifier de manière fiable les domaines avec lesquels il interagit, à partir de l’interface de sa machine. Dans une première partie, nous proposons un nouveau mécanisme de cloisonnement qui peut s’adapter de manière transparente aux changements d’activité de l’utilisateur, sans altérer le fonctionnement des contrôles d’accès existants, ni dégrader la sécurité du système. Nous en décrivons une première implémentation, nommée StemJail, basée sur les espaces de noms de Linux. Nous améliorons ce cloisonnement en proposant un nouveau module de sécurité Linux, baptisé Landlock, utilisable sans nécessiter de privilèges. Dans un second temps, nous identifions et modélisons les propriétés de sécurité d’une interface homme-machine (IHM) nécessaires à la compréhension fiable et sûre du système par l’utilisateur. En particulier, il s’agit d’établir un lien entre les entités avec lesquelles l’utilisateur pense communiquer, et celles avec lesquelles il communique vraiment. Cette modélisation permet d’évaluer l’impact de la compromission de certains composants d’IHM et d’aider à l’évaluation d’une architecture donnée. / This thesis aims to provide end users with tools enhancing the security of the system they use. First, user activities of different sensitivities require to be confined in dedicated domains by an access control fitting the user’s needs. Next, in order to maintain this confinement, users must be able to reliably identify the domains they interact with, from their machine’s interface. In the first part, we present a new confinement mechanism that seamlessly adapts to user activity changes, without altering the behavior of existing access controls nor degrading the security of the system. We also describe a first implementation named StemJail, based on Linux namespaces. We improve this confinement tool by creating a new Linux security module named Landlock which can be used without requiring privileges. In a second step, we identify and model the security properties a human-computer interface (HCI) requires for the reliable and secure understanding of the system by the user. Precisely, the goal is to establish a link between the entities with which the users think they communicate, and those with which they actually communicate. This model enables to evaluate the impact of HCI components jeopardization and helps assessing a given architecture.

The AEGIS Cruiser Air-Defense Simulation is a program that models the operations of a Combat Information Center (CIC) team performing the ADC duties in a battle group using Multi-Agent System (MAS) technology implemented in the Java programming language. Set in the Arabian Gulf region, the simulation is a top-view, dynamic, graphics-driven software implementation that provides a picture of the CIC team grappling with a challenging, complex problem. Conceived primarily as a system to assist ships, waterfront training teams, and battle group staffs in ADC training and doctrine formulation, the simulation was designed to gain insight and understanding into the numerous factors (skills, experience, fatigue, aircraft numbers, weather, etc.) that influence the performance of the overall CIC team and watchstanders. The program explores the team's performance under abnormal or high intensity/stress situations by simulating their mental processes, decision-making aspects, communications patterns, and cognitive attributes. Everything in the scenario is logged, which allows for the reconstruction of interesting events (i.e. watchstander mistakes, chain-of-error analysis) for use in post-scenario training as well as the creation of new, more focused themes for actual CIC team scenarios. The simulation also tracks various watchstander and CIC team performance metrics for review by the user. / Lieutenant, United States Navy

L’activité de chantier se caractérise par un mode de production in situ. Dès lors, nombreux sont les dysfonctionnements qui peuvent apparaître. La coordination du chantier repose sur un mélange subtil entre interactions implicites et explicites, où l’organisation prend de multiples configurations (hiérarchique, adhocratique ou transversale), et où la qualité du processus collectif repose sur l’autonomie et le sens des responsabilités de chacun des intervenants. Nous faisons l’hypothèse qu’un tel contexte est largement fondé sur la notion de confiance, car celle-ci a la capacité de réduire la perception du risque et de permettre l’action dans un environnement incertain. En conséquence, nous suggérons un rapprochement entre les outils d’assistance à la coordination et la notion de confiance, et nous proposons une nouvelle approche du pilotage de l’activité collective à partir de la représentation de la confiance. Ce travail de doctorat se structure autour de la notion de « confiance dans le bon déroulement de l’activité ». Notre méthode consiste d’abord en l’identification des divers critères de confiance, consolidés par une étude de terrain. Puis, nous établissons un modèle mathématique destiné à évaluer cette confiance à partir des informations issues d’un contexte de coopération. Sur base de ces éléments, s’en suit la proposition d’un prototype dénommé Bat’iTrust. La navigation au sein de ce prototype est guidée par un tableau de bord centré sur le concept de confiance. Enfin, la validation de cette proposition repose sur des enquêtes et une phase d’expérimentation qui nous ont permis de confronter nos résultats à des sujets expérimentaux représentatifs du domaine / The building construction is an “on-site” production activity. Therefore numerous dysfunctions can appear during the activity. The coordination of building construction depends on a subtle combination between explicit vs. implicit interactions, where organization takes various forms (i.e. hierarchic, adhocratic and transversal). Quality of the collective process is thus largely dependent on autonomy capability and responsibility sharing of each of the involved actors. Our hypothesis is that such a collective context is mainly based on the notion of trust. Indeed trust has the capability to reduce the perception of risk and to enable action in uncertain environments. Consequently, we suggest applying trust notion to the issue of design of cooperation support tools, towards a new vision of collective activity management based on trust representation. This Ph.D. research introduces the notion of “trust in the good progress of the activity”. Our methodology consists firstly in identifying the various trust criterions that we validate through a terrain survey. Secondly we establish a mathematical model aiming at evaluating trust level based on cooperation context information. Then the proposition suggests a prototype tool, called Bat’iTrust. User-navigation inside the prototype is guided by a dashboard view centred on the trust concept. Finally the validation is assessed through both surveys and an experimentation stage. These ones allow us to confront our results to experimenters subjects representative of the construction domain