I. Description of Sirris
Sirris is a private non-profit collective research centre founded in 1949 by Agoria, the multi-sector federation for the Belgian technology industry. Sirris has about 2500 member companies, which range from small and medium-sized businesses to multinational companies (>95% SMEs), active in the sectors of Materials, Metal Products, Automobile, ICT & Mechatronics, Industrial Automation. Its mission is to improve the competitiveness of its member companies through technology and innovation. The ICT and Software Engineering group of Sirris has set up several different industry- driven research programs through which it has acquired extensive knowledge in various areas related to Cloud Computing, Service Oriented Architecture (SOA), SaaS and software engineering, etc.
II. Key persons in the project
Prof. Dr Philippe Thiran coordinates the Cloud computing research theme in the ICT and Software Engineering group of Sirris. He is also a professor of computer science at the Faculty of Computer Science of the University of Namur. His interests cover distributed information and software technologies like Web technologies, SOA and SaaS (Cloud computing) and ICT applications for smart cities (smart mobility and urban planning). He has been involved in several European and national R&D projects as well as standardization bodies (W3C, IEEE and OASIS). He has co-authored more than 80 scientific papers and co‐organized more than 10 international conferences (including IEEE Service Congress and MobiWIS). Philippe Thiran holds a Master in Geography (University of Louvain and University of Rennes II), a Master and a PhD in Computer Science (University of Namur). He was a professor of computer science at the HEC Business School of the University of Liege, at the University of Lyon I and at the Eindhoven University of Technology. Since 2005, Philippe Thiran has been a professor at the University of Namur.
Mr. Bojan Spasic (Project Leader Software Security). Bojan Spasić joined Sirris in 2016 as Project Leader for Software Security, and has focussed on security engineering of software-driven systems, helping companies understand information security and apply best practices and technology in their product development and daily operations. Prior to joining Sirris, Bojan spent 15 years at AVL, the world’s largest independent automotive engineering company, assuming leading roles in development of large-scale industrial cyber-physical systems for automation of engine and powertrain testing. Bojan studied physics and holds a MSc in Information Systems Management.
Dr. Annanda Rath is senior software security expert at Sirris and his main research area is data and software security, especially access and usage in IoT and privacy sensitive domains. Before joining Sirris, he worked for University of Namur for 8 years as researcher for different European projects such as FP7-P5 and FEDER-IDEES. From 2006 to 2010, he worked for Institute of Technology of Cambodia as researcher and head of department. He has a PhD (computer science) from University of Namur, master’s degree (computer science) from Indian Institute of Technology, Bombay and computer science engineering degree from Institute of Technology of Cambodia.
Dr Nicolás Gonzalez-Deleito is project leader in the Sirris ICT and Software Engineering group, where he focuses on helping companies build new products and services out of the data they manipulate or have access to, and where he contributes to several industrial European and regional R&D projects in this area. He also coordinated VariBru, a project supported by the Innoviris ICT Impulse program. Nicolas holds a PhD degree (2005) in Computer Science from the Universite Libre de Bruxelles, where he worked as a post–‐doctoral teaching assistant in the QualSec group. His research focused then on reducing trust requirements in fair exchange (i.e. e-commerce) protocols.
III. Contributions to the project
Contributions. Sirris contributes to the WP 3, WP 4, WP 5, WP 6 and WP7. However, the main contributions of Sirris are in WP4 and WP 7. In WP 4, Sirris contributes significantly to the definition of general secure architecture for cloud-based applications and the definition of cloud security patterns to be used as the best practice and guidelines for building secure and privacy-aware cloud-based applications. Concerning the secure architecture, we went further beyond defining the architecture, we built a AWS cloud-based application prototype based on our defined secure architecture. For security pattern in cloud, we defined different patterns related to security issues in cloud and also built a detailed documentation for cloud security pattern, which can be found here.
In WP 7, Sirris contributes to the overall management and coordination of the project, ensuring an efficient administration and coordination of all project activities, focused on the objectives of the project.
- Contribution 1: Secure architecture for cloud-based application. This contribution concentrates on the design of the reference architecture for secure Cloud SaaS. We consider all possible security aspects in our design, such as communication security, data security (data in transit and at rest), system security, cyber-attacks and software management. A thorough study of the security requirements in Cloud SaaS have also been conducted and used as the inputs for the design of the Cloud secure architecture. This architecture can be used as the reference to support the development Cloud SaaS application. The detailed document concerning the design of secure reference architecture for Cloud SaaS can be found at the deliverables or in here.
- Contribution 2: A prototype of cloud-based application in AWS. This contribution focuses on the proof-of-concept relating to the contribution 1. The contribution 1 dedicates to the design of the cloud-based reference architecture for SaaS application while contribution 2 is about the building of the SaaS application prototype based on the reference architecture defined in contribution 1. We developed a AWS SaaS Web application that provides the information about the scaleup technology companies in Europe. The maximum security requirements identified in the reference architecture are implemented in this prototype. More details about the prototype, one can find in the deliverables or in here.
- Contribution 3: Cloud-based security patterns. This contribution is about the security pattern for cloud-based application. The ultimate goal is to provide a complete list of security patterns applied to Cloud SaaS application. The patterns cover four important areas of cloud security including system security, communication security, data security and privacy. Different security patterns in Cloud have been defined and classified into different categories in accordance with property. Both the pattern definition methodology and pattern classification method are in here. In addition to that, we look at the security patterns in Amazon Web Service (AWS) and map our defined patterns to the solutions provided in AWS. More details about the mapping can be found here.
- Contribution 4: Secure architecture for IoT Cloud-based applications. This contribution dedicates to the study and design of the security architecture for IoT Cloud-based application. A heavy focus is on providing a secure environment for data communicated between Cloud and devices. Other security aspects, such as data security (data in transit and at rest), system security, cyber-attacks and software management at device level are also considered in the design. The detailed document concerning the design of secure reference architecture for IoT Cloud-based application can be found at the deliverables or in here.