Encryption transition in a database

1. A method for data encryption, comprising:

in response to an indication of an encryption transition, initiating a transition mode in a database system comprising a database of data elements including first and second data elements;

during the transition mode, the database system receiving a first query to retrieve the first data element from the database;

in response to receiving the first query, the database system determining whether the first data element is already encrypted in the database;

in response to a determination during the transition mode that the first data element is already encrypted in the database:

the database system decrypting the first data element that is already encrypted in the database; and

the database system returning the decrypted first data element in a query result of the first query;

during the transition mode, the database system receiving a second query to retrieve the second data element from the database;

in response to receiving the second query, the database system determining whether the second data element is already encrypted in the database;

in response to a determination during the transition mode that the second data element is not already encrypted in the database:

the database system returning the second data element in a query result of the second query without decryption; and

the database system encrypting the second data element in the database; and

in response to a determination that a metric of the database system has reached a defined threshold, changing the database system from the transition mode to an encryption mode that includes performing queries without determining whether data elements in the queries are encrypted in the database.

2. The method of claim 1 , further comprising, during the encryption mode:

the database system receiving a third query to retrieve a third data element from the database;

in response to a receipt of the third query during the encryption mode, the database system decrypting the third data element without a determination as to whether the third data element is encrypted in the database; and

the database system returning the decrypted third data element in a query result of the third query.

3. The method of claim 1 , wherein encrypting the second data element in the database comprises using format-preserving encryption.

4. The method of claim 3 , wherein encrypting the second data element in the database comprises embedding key information in the encrypted second data element.

5. The method of claim 1 , wherein, prior to initiating the transition mode, each data element in the database is not encrypted.

6. The method of claim 1 , wherein, after exiting the transition mode, at least a particular percentage of the data elements in the database are encrypted.

7. An article comprising a non-transitory machine-readable storage medium storing instructions that upon execution cause a processor to:

in response to an indication of an encryption transition, initiate a transition mode in a database storing a plurality of data elements including a first data element;

in response to a receipt during the transition mode of a first query to retrieve the first data element from the database, determine whether the first data element is already encrypted in the database;

responsive to a determination that the first data element is already encrypted in the database:

decrypt the first data element; and

return the decrypted first data element as a query result for the first query;

responsive to a determination that the first data element is not already encrypted in the database:

return the first data element without decryption as the query result for the first query; and

encrypt the first data element in the database; and

responsive to a determination that a database metric has reached a defined threshold, change the database from the transition mode to an encryption mode that includes performing queries without determining whether data elements in the queries are encrypted in the database.

8. The article of claim 7 , wherein, prior to initiating the transition mode, each data element in the database is not encrypted.

9. The article of claim 7 , wherein the first data element is encrypted using format-preserving encryption.

10. The article of claim 9 , wherein, after exiting the transition mode, at least a particular percentage of the data elements in the database are encrypted.

11. The article of claim 7 , wherein the instructions to encrypt the first data element in the database comprise instructions to embed key information in the encrypted first data element.

12. The article of claim 7 , wherein the instructions further cause the processor to, during the encryption mode:

receive a second query to retrieve a second data element from the database;

in response to a receipt of the second query, decrypt the second data element without a determination as to whether the second data element is encrypted in the database; and

return the decrypted second data element in a result of the second query.

13. A computing device comprising:

a hardware processor; and

a machine-readable storage medium storing instructions, the instructions executable by the hardware processor to:

initiate a transition mode in a database comprising a plurality of data elements including a first data element;

responsive to a receipt during the transition mode of a first query to retrieve the first data element from the database, determine whether the first data element is already encrypted in the database;

responsive to a determination that the first data element is already encrypted in the database:

decrypt the first data element; and

return the decrypted first data element to the first query;

responsive to a determination that the first data element is not already encrypted in the database:

return the first data element to the first query without decryption; and

encrypt the first data element in the database; and

responsive to a determination that a metric of the database has reached a defined threshold, change the database from the transition mode to an encryption mode that includes performing queries without determining whether data elements in the queries are encrypted in the database.

14. The computing device of claim 13 , the instructions further executable to, during the encryption mode:

receive a second query to retrieve a second data element from the database;

in response to a receipt of the second query, decrypt the second data element without a determination as to whether the second data element is encrypted in the database; and

return the decrypted second data element in a result of the second query.

15. The computing device of claim 14 , wherein the encrypted first data element comprises embedded information identifying a first encryption key, and the second data element comprises embedded information identifying a second encryption key.

16. The computing device of claim 13 , wherein the first data element is encrypted using format-preserving encryption.

17. The computing device of claim 13 , the instructions further executable to:

in response to a setting of an encryption policy, terminate the transition mode in the database.