Generating data migration plan for in-place encryption of data

A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by at least one computing device to cause the at least one computing device to perform at least:

• receiving, from a user, a request to generate a migration plan for performing in-place encryption of data within a database, wherein the migration plan indicates periods of time in which portions of the data are to be encrypted;
• determining a set of constraints for performing the in-place encryption;
• generating the migration plan based at least in part on the set of constraints, wherein the generating comprises:
• determining a set of available time windows in which the in-place encryption can be performed and assigning one or more of the portions of the data to at least a subset of the available time windows;
• and
• performing the in-place encryption of the data in accordance with the migration plan such that a single copy of each of the portions is maintained during the in-place encryption, wherein the single copy comprises one of (i) a plaintext copy of data corresponding to said portion, and (ii) an encrypted copy of data corresponding to said portion.

A system comprising:

• a memory;
• and
• at least one processor operably coupled to the memory and configured for:
• receiving, from a user, a request to generate a migration plan for performing in-place encryption of data within a database, wherein the migration plan indicates periods of time in which portions of the data are to be encrypted;
• determining a set of constraints for performing the in-place encryption;
• generating the migration plan based at least in part on the set of constraints, wherein the generating comprises:
• determining a set of available time windows in which the in-place encryption can be performed and assigning one or more of the portions of the data to at least a subset of the available time windows;
• and
• performing the in-place encryption of the data in accordance with the migration plan such that a single copy of each of the portions is maintained during the in-place encryption, wherein the single copy comprises one of (i) a plaintext copy of data corresponding to said portion, and (ii) an encrypted copy of data corresponding to said portion.

A computer-implemented method, comprising:

• receiving, from a user, a request to generate a migration plan for performing in-place encryption of data within a database, wherein the migration plan indicates periods of time in which portions of the data are to be encrypted;
• determining a set of constraints for performing the in-place encryption, wherein at least one of the constraints specifies that related columns of the database are to be encrypted together;
• generating the migration plan based at least in part on the set of constraints;
• and
• performing the in-place encryption of the data in accordance with the migration plan such that a single copy of each of the portions is maintained during the in-place encryption, wherein the single copy comprises one of (i) a plaintext copy of data corresponding to said portion and (ii) an encrypted copy of data corresponding to said portion;
• wherein the method is carried out by at least one computing device.