Qirinus: an innovative solution for making cloud architectures secure

Qirinus was launched in November 2021, and is one of the latest deep tech start-ups to emerge from Inria's computer science research. It develops and offers its customers a "single orchestrator": infrastructure management software that can model, deploy and secure an organisation's IT services in a standardised way, while keeping critical components up to date. This proposed innovation is already of interest to major industrial groups in the defence, energy and luxury sectors.

Eddy Caron, researcher at the Laboratoire d’Informatique du Parallélisme (LIP) at ENS Lyon and member of the Inria Avalon team, has been involved in the project since its inception, while Frédéric Vella is the recently-appointed CEO of the start-up.

The adventure actually started about ten years ago: the first bricks of the software were laid in research by Arnaud Lefray who at the time was a doctoral student in the Avalon team. The young researcher's work, conducted under the European project Seed4C, focused on the security of virtualised cloud computing environments (cloud architectures).

“Cloud technologies offer the possibility of building IT infrastructures that deliver different services using scalable and heterogeneous resources. This enables their users to develop architectures that meet various needs (calculation, data storage/exchange, etc.), such as those encountered in the industrial sector" explains Eddy Caron.

Concentrating these activities within a shared infrastructure, with a modular character, has many benefits: it greatly simplifies the development of networks and uses low-cost IT solutions. However, it also poses critical cyber security issues. Indeed, the outsourcing of digital services takes place within constantly changing virtual environments. The rapid growth of these environments makes them attractive, but complex to manage and prone to security breaches, making them a prime target for cyber attacks.

Guaranteeing the security of cloud architectures

“In order to ensure optimal security, you need to have an overall vision of the architecture and the coherence of the different configurations (systems, networks, software, etc.) in the elements of which it is made up," explains Eddy Caron. To meet this need, Qirinus offers a tool for deploying IT applications on a target system, managing the heterogeneity of the solutions used (multi-cloud, multi-application, multi-security solutions, etc.) and ensuring the security of the whole.”

This single orchestrator, based on a model transformation approach, is what is unique about Qirinus: within a highly ergonomic environment, using “drag and drop”, the user designs the desired architecture, then the tool takes care of automatic deployment, guaranteeing the consistency of the IT security rules desired by the user.

“Our technology is of particular interest to IT departments and IT solution providers in large industrial groups, who are looking for automatic operational solutions to minimise the risk of human error while remaining adaptable. The objective is to work within an existing IT environment with specific processes. Large industrial groups have solid expertise in secure cloud deployment. Our approach is sufficiently modular to adapt to their existing processes, while saving them valuable time and providing much greater reliability” explains Frédéric Vella.

With its upstream orchestration principle, independent of the IT solutions used in the end, being adaptable and configurable according to needs, Qirinus offers its potential customers a sovereign solution. “Our tool aims to simplify the very complex tasks that are the responsibility of those in charge of IT solutions in a company, and in no way hinders their autonomy, as it is not intended to replace existing skills, current procedures or security rules,” summarises Eddy Caron. “At Qirinus, we focus on really listening to users: our culture is one of responsiveness and adaptability”, adds Frédéric Vella.

The information systems departments of large industrial groups, experiencing the complexity of deploying distributed architectures under heavy security constraints on a daily basis, are interested in the concept provided by Qirinus as well as the features offered by the tool. The technology is undeniably attractive: Qirinus has just been approved for integration into Dassault Systèmes’ Outscale cloud.

“This is just the beginning” says Frédéric Vella. “At this stage in our development, we now wish to provide potential future customers with proof of the effectiveness and reliability of the security implemented through concrete business cases. We are working together towards this, defining cases of use and evaluation criteria with them, to fully convince them”.

In addition to the technical sovereignty offered to its customers, Qirinus also claims strategic sovereignty over its product. “Qirinus is a company that is “made in France”, born of French research, using or adapting French and European technical solutions” summarises Eddy Caron. “In the context of cybersecurity, the notion of a sovereign cloud is a necessity, especially for sensitive sectors such as certain government departments, like the Délégation Générale pour l'Armement, with which we are in contact.”

Since the beginning of the Qirinus adventure, Inria has shown unfailing support and confidence, emphasise its co-founders, and at many levels (financial support, opening up to an industrial network, legal support, etc.). With this support, the start-up is looking forward to taking the next steps with confidence. “With the results of the proof of concept expected in a few months, which will be decisive for the future, we will specify our business model, start fundraising and recruit scientific teams; 2022 promises to be an exciting year!” concludes Frédéric Vella enthusiastically.