% high level design

The results of the performance and virtual infrastructure analysis highlights the possibility to design a solution which allows distributing filtering rules among the whole cloud environment. This gives the opportunity to avoid the exploitation of standard firewalls on which all the rules are concentrated and it represents the the well-known problem of \textit{One Point of Failure} (OPF).

To reach the proposed objectives, several research tasks need to be completed. First, abstract models need to be defined for policy representation and distribution on a cloud infrastructure. They define how the filtering rules, are located in different firewall.

Those models need to be integrated into an orchestration framework, which purpose is to split the policies over the filtering controls already present in a virtual environment.

To design a security infrastructure, working on a cloud data center, different aspects need to be taken into account, starting from the modelling of the physical infrastructure, defining the entities at stake and what are the policies to be enforced. 

Security policies are handled by the \textit{Policy Tool Library}, which is integrated in the framework. It is used to perform operations on those security policies as inter-policy and intra-policy conflict analysis.

Then, an optimization problem has been modeled as a binary programming model. 
This model is represented by a set of propositional equations made of binary variables and a cost function, that should be minimized. 
The optimization model produces two outcomes, the former is the assignment of an ordered list of rules to each filtering point, the latter is a list of unnecessary rules that are notified to the administrator.
Finally a distribution process injects the filtering rules based on the output of the optimization process.

The thesis work is focused on the abstract model design for policy representation and\break distribution on a cloud infrastructure.

The distribution controller and the distribution process is developed by Andrea Della Chiesa, who studied the different filtering technologies. 
His work is related to the definition of distinct commands, one for each system involved, based on the output produced by the optimization model. 
\pagebreak

The framework is composed of several modules:
\begin{itemize}
	\item 
	the policy module, which handles anomalies and conflicts, thus optimizing the security requirements. It removes redundancies and contradicting rules;
	\item
	the optimization process, which is used to determine the security controls to be configured and the best place to assign the rules that enforce the security requirements;
	\item
	the distribution model, which injects the rules into the filtering points.
\end{itemize}

In the following Figure \ref{fig:hight-level-design} it is shown the model representation of the framework.

\hfill
\begin{figure}[H]
	\resizebox{\textwidth}{!}{
		\centering
		
		% Define block styles
		\tikzstyle{limiter} = [ellipse, draw, text width=5em, text badly centered, inner sep=0pt, minimum height=3.5em]
		\tikzstyle{block} = [rectangle, draw, text width=6em, text centered, rounded corners, minimum height=3em]
		\tikzstyle{io} = [trapezium, trapezium left angle=70, trapezium right angle=110, text width=5em, text badly centered, draw=black, fill=blue!30]
		\begin{tikzpicture}[node distance = 2cm, auto, >=Stealth]
		% Place nodes	
		
		\node [block] (opt) {Optimization process};
		\umlnote[x=-3.8,y=3, width=7em]{opt}{Physical model}
		\umlnote[x=0,y=3]{opt}{Entities and policy model}
		\umlnote[x=3.8,y=3]{opt}{Optimization model}
		\node [limiter, left of=opt, node distance = 3.8cm] (policy) {Policy tool library};		
		
		\node [block, below of=opt, node distance = 3cm] (distr-procc) {Distribution process};
		
		\node [limiter, left of=distr-procc, node distance = 3.8cm] (controller) {Distribution controller};
		
		\node [io, right of=distr-procc, node distance = 3.8cm] (out)  {Distribution outcome};
		
		\draw[->] (opt) -- (distr-procc);
		\draw[<->, dashed] (policy) -- node {exploits} (opt);
		\draw[<->, dashed] (controller) -- node {interacts} (distr-procc);
		\draw[->] (distr-procc) -- node {produce} (out);
		
		\end{tikzpicture}
	}
	\caption{Security system high level design.
		\label{fig:hight-level-design}}
\end{figure}
\clearpage