We present a method to secure the complete path between a server and the local human user at a network node. This is useful for scenarios like internet banking, electronic signatures, or online voting. Protection of input authenticity and output integrity and authenticity is accomplished by a combination of traditional and novel technologies, e.g., SSL, ActiveX, and DirectX. Our approach does not require administrative privileges to deploy and is hence suitable for consumer applications. Results are based on the implementation of a proof-of-concept application for the Windows platform.
With the advent of networks that span administrative domains, increasing mobility, and even global-area networks, we find ourselves more and more often in situations where we do not know the potential parties accessing our system. Yet, we choose to collaborate with them: For example, we frequently browse unknown Web sites, or invite unknown parties to access our servers. I call a scenario in which parties choose to collaborate that do not necessarily trust each other, or even know each other, an ad-hoc collaboration . This dissertation investigates how we can protect our sensitive resources in the presence of ad-hoc collaboration. In particular, I study three ad-hoc collaboration scenarios and propose novel access control schemes for each of them. In my first system I propose and implement an access control mechanism for distributed Java applications that can span administrative domains. It uses an access control logic to allow servers to reason about the access privileges of unknown clients. My second system presents a simple security model for the personal computer, in which the user's workstation is divided into multiple desktops. Each desktop is sealed off from the others, confining the possibly dangerous results of ad-hoc collaboration. My last system investigates ad-hoc collaboration with hand-held computers. I present a framework that allows developers to write “split applications”: Part of the application runs on a trusted, but computationally limited, small computer, and part of the application runs on an untrusted, but more powerful PC.