% use case definition

The definition of use-cases provides support to the main purpose of the thesis and offers a simple way to understand what is the problem and how the solution is developed.

The Section~\ref{subsec:cloud_computing} presents different deployment models in which a cloud environment could be instantiated and, between them, \textit{private} and \textit{public} cloud are the most popular and used in modern infrastructures. 

\begin{figure}[H]
	\centerline{\includegraphics[width=0.9\textwidth]
		{usecase1.png}}
	\caption{ISP and enterprises communication with logical security filtering points.
		\label{fig:isp}}
\end{figure}

The following use-cases are examined in a business context.

\begin{itemize}
	\item 
	Private cloud, it is the first way to deploy a cloud infrastructure and that means a company has its own data center used only by themselves.
	In an organization there are many internal departures that concern disparate aspects and they deal with distinct security issues. For these reasons it is fair that each departures have different security requirements and security policies to be enforced. 
	
	It is understandable that different policies means distinct filtering rules, which could be also conflicting with each other, despite they are policies of the same company.
	
	The main security requirements are enforced by the company policy and those rules are meant to protect the own company from the external attacks, but some departures could have sensibilities information to be protected or are essential for the company.
	
	So it is important to provide a way to protect those departments from internal attacks or to avoid that a weakness, of some lowest security department policy, is exploited to start an exterior attack.
	
	In a traditional security infrastructure the enterprise will enforce its security with one or few physical appliances, which presumably will be overloaded and they will represent a single point of failure. In case of any cyber attack, the possibility to exploit different filtering points allows to put several levels of protection implementing the so called \textit{defence in depth}.
	
	\item
	Public cloud, it is nowadays the most chosen way to approach cloud computing and there are a lot of companies that make this solution their own main business. The context presented is different from the previous one, because there is a company in charge to deploy and to manage the cloud infrastructure which provides services to other enterprises, which are independent from each other.
	
	This is the most complex situation in which is prone to have a lot of different uncorrelated policies and the number of conflicts between them is expected to be higher than the first use-case.
	The cloud provider company needs to enforce a basic security policy from the external world, because if it applies too strict conditions the risks to block some useful service or communication of the guest enterprises it is further high.
	
	Otherwise each guest entity has strict security policy to protect themselves from the other companies in the data center, but also from the external attacks. For these reasons they need to have the possibility to enforce they own rules.
	
	The implementation of a traditional security infrastructure is impossible, because machines of different enterprises could be hosted on the same physical server or in the same slice of network. How can the protection be provided? How many policy conflicts will come out?
	The optimal distribution will provide a simple solution to those problems, through the correct rule allocation, only on the filtering points which require those rules.
\end{itemize}
