People are nomadic; traveling from place to place. As a user travels, he may need access to his digital information, including his data, applications, and settings. A convenient way to supply this access is to have the user carry that digital information in a portable computer such as a laptop or smart phone. As Moore's Law continues to operate, devices such as smart phones can easily perform the computing necessary for a user's work. Unfortunately, the amount of data a human can receive and convey through such devices is limited. To receive more information humans require more screen real estate. To transmit more information humans need rich input devices like mice and full-sized keyboards. To allow users to carry their digital information in a small device while maintaining opportunities for rich input, this research takes the approach of allowing users to carry a small portable device and then annex screens, keyboards, and mice whenever those devices are available in a user's environment. This research pursued the "carry it with you" paradigm first by building an ideal annexing framework which helps maximize the screen real estate while minimizing the resources—RAM, CPU, and wireless radio—consumed on the personal device. The resource consumption is demonstrated through a comparison with existing remote rendering technologies. Next, a privacy-aware framework was added to the annexing framework to help protect the user's sensitive data from damage and theft when he annexes a potentially malicious device. A framework like this has not existed before, and this research shows how the user's sensitive data is protected by this framework. Third, legacy machines and software are allowed to participate in the carry-it-with-you experience by scraping pixels from the user's existing applications and transmitting those pixels to an annexed display. Finally, when a user encounters a display space he does not own, but which he needs to control (e.g. by preventing anyone else from annexing it simultaneously, or by constraining each user to a different section of the display space), rather than forcing the user to learn and use control software supplied by the display, the user can bring his own control software and use it to enforce the user's desired control paradigm. This dissertation shows the carry-it-with-you paradigm is a powerful potential avenue which allows users to confidently use display spaces with varying configurations in an assortment of environments.

Cette thèse souhaite fournir des outils pour qu’un utilisateur puisse contribuer activement à la sécurité de son usage d’un système informatique. Les activités de sensibilités différentes d’un utilisateur nécessitent tout d’abord d’être cloisonnées dans des domaines dédiés, par un contrôle d’accès s’ajustant aux besoins de l’utilisateur. Afin de conserver ce cloisonnement, celui-ci doit être en mesure d’identifier de manière fiable les domaines avec lesquels il interagit, à partir de l’interface de sa machine. Dans une première partie, nous proposons un nouveau mécanisme de cloisonnement qui peut s’adapter de manière transparente aux changements d’activité de l’utilisateur, sans altérer le fonctionnement des contrôles d’accès existants, ni dégrader la sécurité du système. Nous en décrivons une première implémentation, nommée StemJail, basée sur les espaces de noms de Linux. Nous améliorons ce cloisonnement en proposant un nouveau module de sécurité Linux, baptisé Landlock, utilisable sans nécessiter de privilèges. Dans un second temps, nous identifions et modélisons les propriétés de sécurité d’une interface homme-machine (IHM) nécessaires à la compréhension fiable et sûre du système par l’utilisateur. En particulier, il s’agit d’établir un lien entre les entités avec lesquelles l’utilisateur pense communiquer, et celles avec lesquelles il communique vraiment. Cette modélisation permet d’évaluer l’impact de la compromission de certains composants d’IHM et d’aider à l’évaluation d’une architecture donnée. / This thesis aims to provide end users with tools enhancing the security of the system they use. First, user activities of different sensitivities require to be confined in dedicated domains by an access control fitting the user’s needs. Next, in order to maintain this confinement, users must be able to reliably identify the domains they interact with, from their machine’s interface. In the first part, we present a new confinement mechanism that seamlessly adapts to user activity changes, without altering the behavior of existing access controls nor degrading the security of the system. We also describe a first implementation named StemJail, based on Linux namespaces. We improve this confinement tool by creating a new Linux security module named Landlock which can be used without requiring privileges. In a second step, we identify and model the security properties a human-computer interface (HCI) requires for the reliable and secure understanding of the system by the user. Precisely, the goal is to establish a link between the entities with which the users think they communicate, and those with which they actually communicate. This model enables to evaluate the impact of HCI components jeopardization and helps assessing a given architecture.