% goals definition

The previous Section~\ref{subsec:SDN} and Section~\ref{subsec:NFV} show how Software Defined Networking (SDN) and Network Function Virtualization (NFV) have changed the network management and the\break underlying infrastructure. Network Providers have begun to take advantage of those technologies for their features, such as flexibility and availability, to provide services where and when they are needed, to obtain redundancy and load balancing which brings to better services.

The management cost of the network infrastructure decreases using the combination of both technologies, which carry features such as flexibility and resiliency. Those paradigms have some limitations, though, for instance, they do not guarantee any performance.

Management of security controls still suffer the lack of dynamicity. This is due to manual operations and device configurations that the network administrator has to face every time a change happens in the cloud infrastructure. 
What happens if something changes in the network topology? 
Does a security policy follow the migration of a machine from a subnet to another one?

The main goal of this thesis is to extend elasticity and easy management exploited in the networking also to security controls. The aim of the project is to develop a framework which gets support to the security administrator during the policy definition and the infrastructure management.

In the workflow entailed by the tool, high-level security requirements are specified by the security administrator. However, the actual device configuration is automatically performed by the tool, hence avoiding human errors and misconfigurations.
Any topology change triggers an automatic reconfiguration of all filtering controls, which are building blocks of firewall, with rules that enforce the desired security requirements.

To reach the proposed objectives, several research tasks need to be completed. 
First,\break abstract models need to be defined (Chapter~\ref{chap:solution_design}) for policy representation and distribution on a cloud infrastructure. 
They define how the filtering rules are located in different firewall.
The optimization problem has been modeled as a binary programming model, which, starting from the traffic pattern analysis, understands what are the filtering points crossed by specific packets. 
The model allows the choice of the filtering control to be configured to achieve the better performance, minimized delay and maximized bandwidth.

Those models need to be integrated into an orchestration framework (Chapter~\ref{chap:implementation}), whose purpose is to split the policies over the filtering controls already present in a virtual environment.
This approach should help administrator to avoid complex device configurations and to reduce the overall costs avoiding new devices with filtering capabilities.

Security controls are critical devices from the performance point of view. The resource\break consumption such as CPU usage and memory occupation, could be bottleneck when these controls are implemented in software. Performance degradation is often associated to large rule sets. For this reason, optimization models may help in reducing the resource utilization and to get better performance.

The effectiveness and the validation of the optimization model has been proved by the\break implementation of performance tests (Chapter~\ref{chap:testing}).

The test's results and the final considerations are presented in the last Chapter~\ref{chap:conclusion}, which\break describes the goals achieved and what are the possible future developments that may be\break undertaken.

%sec:optimal_model
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%The previous Section~\ref{sec:firewall} and Section~\ref{sec:NSP} explain how the policy management and the security devices are critical, regarding the anomalies and misconfiguration, that introduces security leakages, and also under the performance point of view. In the mean time NFV technologies presented in Section~\ref{subsec:NFV} have all the potential to be the future leaders of how the services will be deployed.

%The main aim of this thesis work is mix up both the two aspects just mentioned, to design and to implement a security system that is able to choose the better filtering points, in a cloud environment, where the rules will be enforced to maximise the overall performance.\newline
%This system is developed to take advantage of the cloud architecture and its the technologies and use them to create a distribution model. The purpose is to replace an equivalent firewall, with all the policies and the rules applied in a single point, with a distributed firewall among the nodes of the data center infrastructure. 

%The approach followed is what we called \textit{SECaaS} (Security-as-a-Service) in the Section~\ref{subsec:SECaaS}, that means create a cloud service which could be offered by an Cloud Service Providers (CSPs) to their clients. Nowadays this paradigm is frequently used by the network providers that have to face customers without a proper infrastructure to deal with their security issues and needs.
%This problems leads to the CSPs to provides Security services that has beneficial, in economic and performance therms, for both the sides, because the providers have a new pay-per-use service that exploits their infrastructure and the clients have the possibility to archive a good security level, with a limited cost.

%Moreover the ``as-a-Service'' approach allows the providers to have lower costs to supply this service, that are explained in the chapter \ref{chap:background}, and they have the possibility to configure and update, in a dynamic way, the security system, delivering a more stable service. For this reason the client has no responsibilities that concerns the security, but it has just to deal with the business account.
