Abstract: The present disclosure relates to a method for a cryptographic key rotation in a publish-subscribe system providing a broker service for routing stored encrypted messages to one or more subscribers of the topic to which the routed messages are assigned. The routing comprises decrypting the stored encrypted messages. The cryptographic key rotation comprises a re-encryption of the stored messages using a cryptographic replacement key. The re-encryption is executed by an encryption module of the publish-subscribe system as a background process, while the broker service is continued.

Abstract: Embodiments of the present invention provide methods, computer program products, and systems. For each dataset in the system, embodiments of the present invention can identify at least one stack of hierarchically-dependent system components on which that dataset is dependent, and generate a system graph having nodes interconnected by directed edges. Dependency of each dataset on a stack, and between successive components in each stack, is represented by a directed edge between nodes of the graph. Embodiments of the present invention can then calculate for each dataset, a stack-dependent compliance score as a function of the compliance scores for a set of nodes reached by traversing directed edges in the graph from the node corresponding to that dataset, and generate an alert if the stack-dependent compliance score for a dataset breaches a predetermined risk threshold for that dataset.

Abstract: The present disclosure relates to a method for a cryptographic key rotation in a publish-subscribe system providing a broker service for routing stored encrypted messages to one or more subscribers of the topic to which the routed messages are assigned. The routing comprises decrypting the stored encrypted messages. The cryptographic key rotation comprises a re-encryption of the stored messages using a cryptographic replacement key. The re-encryption is executed by an encryption module of the publish-subscribe system as a background process, while the broker service is continued.