Migrating data between databases

1. A method for data migration, comprising:

receiving, at a first database, a migration request corresponding to migrating data for a tenant from the first database to a second database and a third database, wherein the first database stores data at rest using at least a first database-specific encryption key, the second database stores data at rest using a second database-specific encryption key and the third database stores data at rest using a third database-specific encryption key;

generating, in response to receiving the migration request, a common temporary encryption key for the second database and the third database based at least in part on a tenant-specific parameter associated with the tenant;

decrypting the data using the first database-specific encryption key;

re-encrypting the data using the common temporary encryption key;

wrapping the common temporary encryption key with a first public key for the second database and a second public key for the third database;

transmitting, to the second database, the re-encrypted data and the common temporary encryption key wrapped with the first public key; and

transmitting, to the third database, the re-encrypted data and the common temporary encryption key wrapped with the second public key.

2. The method of claim 1 , wherein the migration request further indicates to migrate additional data from the first database to the third database.

3. The method of claim 2 , further comprising:

decrypting the additional data using the first database-specific encryption key;

re-encrypting the additional data using the common temporary encryption key;

wrapping the common temporary encryption key with an additional public key for the third database; and

transmitting, to the third database, the re-encrypted additional data and the common temporary encryption key wrapped with the additional public key in response to the migration request.

4. The method of claim 2 , further comprising:

generating an additional temporary encryption key for migrating the additional data from the first database to the third database;

decrypting the additional data using the first database-specific encryption key;

re-encrypting the additional data using the additional temporary encryption key;

wrapping the additional temporary encryption key with an additional public key for the third database; and

transmitting, to the third database, the re-encrypted additional data and the wrapped additional temporary encryption key in response to the migration request.

5. The method of claim 1 , further comprising:

identifying the second database based at least in part on the migration request; and

determining the public key that corresponds to the second database based at least in part on a database-public key correlation stored in memory of the first database.

6. The method of claim 1 , further comprising:

extracting the data from the first database, wherein the extracting comprises the decrypting the data and deleting the data stored at rest using the first database-specific encryption key at the first database.

7. The method of claim 1 , further comprising:

receiving, at the first database and from the second database, a confirmation message that the data migration is successful; and

deleting the data stored at rest using the first database-specific encryption key at the first database.

8. The method of claim 1 , wherein the migration request corresponds to migrating data for a specific tenant from the first database to the second database.

9. The method of claim 8 , wherein receiving the migration request is based at least in part on an amount of data for the tenant, a geographic location of the first database or the second database, a data storage policy for the first database or the second database, or a combination thereof.

10. An apparatus for data migration, comprising:

a processor,

memory in electronic communication with the processor; and

instructions stored in the memory and executable by the processor to cause the apparatus to:

receive, at a first database, a migration corresponding to migrating data for a tenant from the first database to a second database and a third database, wherein the first database stores data at rest using at least a first database-specific encryption key, the second database stores data at rest using a second database-specific encryption key and the third database stores data at rest using a third database-specific encryption key;

generate, in response to receiving the migration request, a common temporary encryption key for the second database and the third database based at least in part on a tenant-specific parameter associated with the tenant;

decrypt the data using the first database-specific encryption key;

re-encrypt the data using the common temporary encryption key;

wrap the common temporary encryption key with a first public key for the second database and a second public key for the third database;

transmit, to the second database, the re-encrypted data and the common temporary encryption key wrapped with the first public key; and

transmit, to the third database, the re-encrypted data and the common temporary encryption key wrapped with the second public key.

11. The apparatus of claim 10 , wherein the migration request further indicates to migrate additional data from the first database to the third database.

12. The apparatus of claim 11 , wherein the instructions are further executable by the processor to cause the apparatus to:

decrypt the additional data using the first database-specific encryption key;

re-encrypt the additional data using the common temporary encryption key;

wrap the common temporary encryption key with an additional public key for the third database; and

transmit, to the third database, the re-encrypted additional data and the common temporary encryption key wrapped with the additional public key in response to the migration request.

13. The apparatus of claim 11 , wherein the instructions are further executable by the processor to cause the apparatus to:

generate an additional temporary encryption key for migrating the additional data from the first database to the third database;

decrypt the additional data using the first database-specific encryption key;

re-encrypt the additional data using the additional temporary encryption key;

wrap the additional temporary encryption key with an additional public key for the third database; and

transmit, to the third database, the re-encrypted additional data and the wrapped additional temporary encryption key in response to the migration request.

14. The apparatus of claim 10 , wherein the instructions are further executable by the processor to cause the apparatus to:

identify the second database based at least in part on the migration request; and

determine the public key that corresponds to the second database based at least in part on a database-public key correlation stored in memory of the first database.

15. The apparatus of claim 10 , wherein the instructions are further executable by the processor to cause the apparatus to:

extract the data from the first database, wherein the extracting comprises the decrypting the data and deleting the data stored at rest using the first database-specific encryption key at the first database.

16. The apparatus of claim 10 , wherein the instructions are further executable by the processor to cause the apparatus to:

receive, at the first database and from the second database, a confirmation message that the data migration is successful; and

delete the data stored at rest using the first database-specific encryption key at the first database.