Key rotation on a publish-subscribe system

A computer program product for a cryptographic key rotation in a publish-subscribe system, the computer program product comprising:

• a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor of a computer system of a publish-subscribe system to cause the computer system to perform the cryptographic key rotation, wherein:
• the publish-subscribe system storing a plurality of messages, each store message of the plurality of stored messages being assigned to a topic from a group of topics, each of the stored messages being assigned with a cryptographic key of a group of one or more cryptographic keys and being encrypted with the assigned cryptographic key;
• the publish-subscribe system providing a broker service for routing the stored messages to one or more subscribers of the topics to which the routed messages are assigned, the routing comprising decrypting the message to be routed using the assigned cryptographic key of the respective message and sending the decrypted messages to one or more of the subscribers of the assigned topic;
• and
• the cryptographic key rotation comprising a re-encryption of each message of a first set of one or more first messages of the stored messages, each of the first messages being assigned to a common first topic from the group of topics, being assigned to a first cryptographic key of a first set of one or more first cryptographic keys of the group of cryptographic keys, and being encrypted with the assigned first cryptographic key, the re-encryption being executed by an encryption module of the publish-subscribe system as a background process, while continuing routing first messages from and receiving additional first messages for the common first topic by the broker service;
• the re-encryption comprising:
• adding a second set of one or more second cryptographic keys to the group of cryptographic keys, each of the second cryptographic keys being a replacement key for one of the first cryptographic keys;
• and
• for each of the first messages:
• decrypting the encrypted first message using the first cryptographic key assigned to the respective first messages;
• re-encrypting the decrypted first message using the replacement key for the assigned first cryptographic key;
• assigning the replacement key used to the re-encrypted first message;
• and
• switching from using the encrypted first message and the assigned first cryptographic key for the routing to using the re-encrypted first message and the assigned replacement key.

A computer system for a cryptographic key rotation in a publish-subscribe system, wherein:

• the publish-subscribe system storing a plurality of messages, each stored message of the plurality of stored messages being assigned to a topic from a group of topics, each of the stored messages being assigned with a cryptographic key of a group of one or more cryptographic keys and being encrypted with the assigned cryptographic key;
• the publish-subscribe system providing a broker service for routing the stored messages to one or more subscribers of the topics to which the routed messages are assigned, the routing comprising decrypting the message to be routed using the assigned cryptographic key of the respective message and sending the decrypted messages to one or more of the subscribers of the assigned topic;
• and
• the cryptographic key rotation comprising a re-encryption of each message of a first set of one or more first messages of the stored messages, each of the first messages being assigned to a common first topic from the group of topics, being assigned to a first cryptographic key of a first set of one or more first cryptographic keys of the group of cryptographic keys, and being encrypted with the assigned first cryptographic key, the re-encryption being executed by an encryption module of the publish-subscribe system as a background process, while continuing routing first messages from and receiving additional first messages for the common first topic by the broker service;
• the computer system comprising a processor and a memory storing program instructions executable by the processor, wherein execution of the program instructions by the processor causing the computer system to perform the re-encryption comprising:
• adding a second set of one or more second cryptographic keys to the group of cryptographic keys, each of the second cryptographic keys being a replacement key for one of the first cryptographic keys;
• and
• for each of the first messages:
• decrypting the encrypted first message using the first cryptographic key assigned to the respective first messages;
• re-encrypting the decrypted first message using the replacement key for the assigned first cryptographic key;
• assigning the replacement key used to the re-encrypted first message;
• and
• switching from using the encrypted first message and the assigned first cryptographic key for the routing to using the re-encrypted first message and the assigned replacement key.