Privacy-by-design and privacy-by-default constraints imposed by GDPR require that proper design decisions are taken on systems which deal with personal data in order to avoid legal actions and minimize risk. This impacts architectural decisions and may thus have consequences on system performances. In this paper we present a methodological approach, together with a new version of our specific tool, to support decision processes in privacy-impacted systems and provide assessor-friendly documentation of decision impact. We show the effectiveness of our approach by means of a simple case in health data management systems.

This paper presents a simulation-based methodology to evaluate the performance of a privacy-compliant edge–blockchain architecture for smart city environments. The proposed model combines edge computing with a private, permissioned blockchain to ensure low-latency processing, secure data management, and verifiable transactions. Using a discrete-event simulation framework, we analyze the behavior of the system under realistic workloads and time-varying traffic conditions. The model captures edge operations, including preprocessing and cryptographic tasks, as well as blockchain validation using Proof of Stake consensus. Several experiments explore saturation thresholds, resource utilization, and latency dynamics, under both synthetic and realistic traffic profiles. Results reveal how architectural bottlenecks shift depending on resource allocation and input rate, and demonstrate the importance of balanced dimensioning between edge and blockchain layers.

The GDPR impacts on the design of information systems which process personal data, because it makes mandatory the adoption of the privacy-by-design and privacy-by-default principles. This compliance must be verified along all the design cycle, so that it must be considered as early as possible in the cycle, when alternatives are not yet detailed in the overall design and just general directions of the projects may be available. A comparison between alternatives should be performed, which can only have a qualitative nature, but which involves numerous factors, so a panel of experts is needed to obtained a reliable result. In this paper we propose a AHP-based evaluation approach to examine privacy-related features of alternative information system architectures in the early phases of the design cycle.

The definition of privacy-related specifications is crucial in the design process of any system which is subject to the GDPR. Privacy-related requirements can be seen as qualitative non-functional requirements which result in additional functional requirements during the specification process. As the application of GDPR is basically assessed by means of risk analysis of data treatments, a quantitative aspect of evaluation is anyway needed: consequently, defining a quantitative approach to privacy-related specifications is desirable, and suitable tools should be identified or provided. While there is some analogy with the field of security and the field of dependability, so that tools might be somehow and to some extent borrowed from those domains, the privacy domain also requires that human factor must be modeled, and external influences on human factors should be modeled as well. In this sense, risk can be evaluated similarly to what can be done in the security field, and this is actually done in the privacy domain by approaches like DPIA, but nudging and deterrence play a different role and are worth some reflections. In this paper we discuss this perspective on privacy-related specification and discuss the use of a tool, Pythia, which is not related to the risk analysis domain but can be profitably used, in our opinion, to define privacy policies as complementary to privacy-aware systems design cycles and to assess their impact. We present an improved analysis of a model from our previous research to show that this point of view on privacy-aware systems design is peculiar and should be considered in the design processes.

Cloud platforms offer not only the capacity to facilitate effective and scalable services for third-party applications and business solutions, but also present an opportunity to implement intricate disaster recovery strategies. For instance, a Chief Technical Officer may opt to maintain operations on private systems in order to effectively manage costs, privacy, and security, while simultaneously leveraging the cloud as an autonomous and immediate disaster recovery support. This can be achieved by building a secondary leg of the IT system that functions as an online cold or hot spare, manages workload peaks, or handles a portion of the workload under normal conditions. To assess the effectiveness and cost-effectiveness of such solutions, appropriate models are essential to examine the trade-offs and explore the parameter space of possible alternatives. This paper presents a modeling approach for the design and evaluation of cloud-based recovery setups.

Authorship Attribution (AA) is currently applied in several applications, among which fraud detection and anti-plagiarism checks: this task can leverage stylometry and Natural Language Processing techniques. In this work, we explored some strategies to enhance the performance of an AA task for the automatic detection of false and misleading information (e.g., fake news). We set up a text classification model for AA based on stylometry exploiting recurrent deep neural networks and implemented two learning tasks trained on the same collection of fake and real news, comparing their performances: one is based on Federated Learning architecture, the other on a centralized architecture. The goal was to discriminate potential fake information from true ones when the fake news comes from heterogeneous sources, with different styles. Preliminary experiments show that a distributed approach significantly improves recall with respect to the centralized model. As expected, precision was lower in the distributed model. This aspect, coupled with the statistical heterogeneity of data, represents some open issues that will be further investigated in future work.

Modern networking is moving towards exploitation of autonomic features into networks to reduce management effort and compensate the increasing complexity of network infrastructures, e.g. in large computing facilities such the data centers that support cloud services delivery. Autonomicity provides the possibility of reacting to anomalies in network traffic by recognizing them and applying administrator defined reactions without the need for human intervention, obtaining a quicker response and easier adaptation to network dynamics, and letting administrators focus on general system-wide policies, rather than on each component of the infrastructure. The process of defining proper policies may benefit from adopting model-based design cycles, to get an estimation of their effects. In this paper we propose a model-based analysis approach of a simple autonomic router, using Stochastic Petri Nets, to evaluate the behavior of given policies designed to react to traffic workloads. The approach allows a detailed analysis of the dynamics of the policy and is suitable to be used in the preliminary phases of the design cycle for a Software Defined Networks compliant router control plane.