% result and conclusion

\section{Conclusion}

The development of this thesis has required big commitment to achieve the goals, which are outlined in the Chapter~\ref{chap:goals}.
Nevertheless it was satisfactory to overcome the hard challenges faced and to get the results of this work, how they were reached is really rewarding.

The first phase was spent to improve in-depth theoretical notions, by reading literature and papers, about networks, virtualization and security policies, which give lots of information and useful knowledge.

A second phase was used to study and to model all the components that take some roles in a cloud environment using the XML schemas. This is a meta-language for the definition of markup languages and this allows to define object models and controls them through the description of constraints. Moreover the Java language supports XML language providing JAXB framework, which offers marshal and unmarshal functions between files and Java classes.

The design and the implementation of a security system, for the rule orchestration, makes this thesis practical, besides it deals with theoretical aspects due to the Research approach.
This framework allows to express all the work done during the process of studying the technologies used, analyzing and understanding how they work with the purpose to build a system that is able to manage and to run in symbiosis with them.

The hard challenge of this work was to define the ``optimal distribution model'', which means to formulate a set of propositional equations, made of boolean variables. A set of soft and hard constraints that has to be satisfied was established, in such way the model described the optimal rules allocation of a distributed firewall. The optimal model is a the MaxSMT problem, which is \textit{NP-complete} problem. For this reason the \textit{z3 Opt. Prover} project was integrated and exploited to solve the model in a limited amount of time. 

The effectiveness and the validation of the optimization model has been proved by the\break implementation of
performance tests. 
They show great improvements in terms of latency\break reduction, larger bandwidth and CPU consumption. Several JUnit tests were developed to\break validate the REST APIs and the interaction with the framework.

The testing phase highlights that the goal defined at the beginning have been successfully achieved. 
The tests have highlighted the fact that the distribution can take advantage by the\break resources already present in the cloud infrastructure, like the built-in filtering modules of OpenStack, instead of instantiating new ones. 
This saves hardware resources and improves performances.

Moreover, the integration with the policy tool library produces excellent results and it gives additional power to the system, not only from a security point of view, but also under the\break management perspective.
\pagebreak

From this thesis work it comes out that the same networking flexibility can be reached also for security controls, without losing in performance if compared to physical appliances. Moreover, the automation of security and management operations get to better usage of resources and to an increase of the security level provided.

\section{Future work}

In the previous Chapter~\ref{chap:infra_analysis} and Chapter~\ref{chap:solution_design} the definition of the cloud infrastructure and the\break technologies used characterizes how the traffic flows and what are the filtering points and how they could be used.

The system is designed in different modules, each one is designed to be independent from the other ones and it is implemented in different levels. This opens towards the possibility to be extended or to be modified for future works.

\subsection{VIM and lightweight virtualization}

This thesis work is focused on OpenStack~\cite{openstack} toolkit as test-bed on which all the performance analysis are performed. This leads to characterize all the choices done during the design and implementation of the system, because the cloud environment available has a pre-defined structure in terms of communication, packet forwarding and virtual instances of switches and machines. Moreover all the efforts are spent on the Virtual Machines without the possibility to explore different virtualization techniques.

In particular it will be interesting to explore other types of Virtual Infrastructure Managers (VIMs) as Kubernetes, which does not present a fixed internal virtual network implementation, which can change based on the project chosen.

The picture depicted below (Figure~\ref{fig:polyCube}) shows a Kubernetes project for network\break implementation and it is clear that the communication is different compared to the one\break implemented by OpenStack in Section~\ref{sec:cloud_infrastructure}.

\hfill
\begin{figure}[ht]
	\centerline{\includegraphics[width=\textwidth]
		{pcn_k8s_architecture}}
	\caption{PolyCube network implementation of Kubernetes~\cite{polycube}.
		\label{fig:polyCube}}
\end{figure}

In addition OpenStack provides only Virtual Machines instances, unlike others VIM that runs lightweight virtualization as containers and dockers. These last two techniques are already supported in the physical model given in input to the system. The additional work is to study how the packets flow into the virtual network, to find all the new filtering points and to analyse them under a performance point of view.
\clearpage

\subsection{Different metric analysis}

The Section~\ref{sec:performance_analysis} exposes all the analysis performed on the cloud infrastructure to design a model of performance and optimization. Nowadays, with the increasing of real-time applications, the main metric, on which all the efforts will be spent, is the \textit{delay}, because the Round Trip Time is critical in a networking and security field.
On the other side in the last decade media applications spreads and the traffic load grows on network device. For these reasons also others metric as the \textit{bandwidth} and the \textit{CPU consumption} were taken into account.

Obviously the goal of this work was not to exploit all the metrics that could be optimized in a datacenter, but the efforts fell on the most relevant.

Future works may compute performance analysis on the \textit{RAM consumption}, or in general on any \textit{Hardware Device consumption} that, in this work, has not been evaluated.

Additional works could be done using specific forwarding hardware integrated into the NICs of the physical machines, this could improve the performance and so the previous evaluation will change.

\subsection{New hard and soft constrains}

The optimal distribution model defined in the Section~\ref{sec:optimal_model} presents a list of hard constraints that must be achieved to make the model \textit{satisfiable}, such as to minimize the number of rules. This hard constraint could be relaxed and it will be transformed into a soft constraint. In this way more than one instance of the same rule could be injected in different filtering points, which make a sub-optimal performance situation but it improves the security.

Physical and virtual network devices has a limited amount of resources, for this reason a ``maximum number of rules'' hard constraint is added for each filtering point, also this limitation could be relaxed as a soft constraint.
Filtering devices are great resource consumption equipment, in terms of CPU cycles, RAM and electrical power that may be wanted to be limited. 
Future works could focus on the relation between the number of rules and the derived hardware consumption, this leads to add new constraints as resource limitation requirements that will be translated into maximum number of rules that a specific filtering point could be performed.
