diff --git a/keystore/IKeystoreService.cpp b/keystore/IKeystoreService.cpp
index 9db6696..d1df44e 100644
--- a/keystore/IKeystoreService.cpp
+++ b/keystore/IKeystoreService.cpp
@@ -487,6 +487,26 @@
         }
         return ret;
     }
+
+    virtual int32_t migrate(const String16& name, int32_t targetUid)
+    {
+        Parcel data, reply;
+        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
+        data.writeString16(name);
+        data.writeInt32(targetUid);
+        status_t status = remote()->transact(BnKeystoreService::MIGRATE, data, &reply);
+        if (status != NO_ERROR) {
+            ALOGD("migrate() could not contact remote: %d\n", status);
+            return -1;
+        }
+        int32_t err = reply.readExceptionCode();
+        int32_t ret = reply.readInt32();
+        if (err < 0) {
+            ALOGD("migrate() caught exception %d\n", err);
+            return -1;
+        }
+        return ret;
+    }
 };
 
 IMPLEMENT_META_INTERFACE(KeystoreService, "android.security.keystore");
@@ -738,6 +758,15 @@
             reply->writeInt64(ret);
             return NO_ERROR;
         } break;
+        case MIGRATE: {
+            CHECK_INTERFACE(IKeystoreService, data, reply);
+            String16 name = data.readString16();
+            int32_t targetUid = data.readInt32();
+            int32_t ret = migrate(name, targetUid);
+            reply->writeNoException();
+            reply->writeInt32(ret);
+            return NO_ERROR;
+        } break;
         default:
             return BBinder::onTransact(code, data, reply, flags);
     }
diff --git a/keystore/include/keystore/IKeystoreService.h b/keystore/include/keystore/IKeystoreService.h
index b4560b9..20ba9c5 100644
--- a/keystore/include/keystore/IKeystoreService.h
+++ b/keystore/include/keystore/IKeystoreService.h
@@ -49,6 +49,7 @@
         GRANT = IBinder::FIRST_CALL_TRANSACTION + 17,
         UNGRANT = IBinder::FIRST_CALL_TRANSACTION + 18,
         GETMTIME = IBinder::FIRST_CALL_TRANSACTION + 19,
+        MIGRATE = IBinder::FIRST_CALL_TRANSACTION + 20,
     };
 
     DECLARE_META_INTERFACE(KeystoreService);
@@ -94,6 +95,8 @@
     virtual int32_t ungrant(const String16& name, int32_t granteeUid) = 0;
 
     virtual int64_t getmtime(const String16& name) = 0;
+
+    virtual int32_t migrate(const String16& name, int32_t targetUid) = 0;
 };
 
 // ----------------------------------------------------------------------------
diff --git a/keystore/keystore.cpp b/keystore/keystore.cpp
index 09bcf33..0b26bc8 100644
--- a/keystore/keystore.cpp
+++ b/keystore/keystore.cpp
@@ -136,6 +136,7 @@
     P_SIGN     = 1 << 11,
     P_VERIFY   = 1 << 12,
     P_GRANT    = 1 << 13,
+    P_MIGRATE  = 1 << 14,
 } perm_t;
 
 static struct user_euid {
@@ -1584,6 +1585,51 @@
         return static_cast<int64_t>(s.st_mtime);
     }
 
+    int32_t migrate(const String16& name, int32_t targetUid) {
+        uid_t callingUid = IPCThreadState::self()->getCallingUid();
+        if (!has_permission(callingUid, P_MIGRATE)) {
+            ALOGW("permission denied for %d: migrate", callingUid);
+            return -1L;
+        }
+
+        State state = mKeyStore->getState();
+        if (!isKeystoreUnlocked(state)) {
+            ALOGD("calling migrate in state: %d", state);
+            return state;
+        }
+
+        if (!is_granted_to(callingUid, targetUid)) {
+            ALOGD("migrate not granted: %d -> %d", callingUid, targetUid);
+            return ::PERMISSION_DENIED;
+        }
+
+        String8 source8(name);
+        char source[NAME_MAX];
+
+        encode_key_for_uid(source, callingUid, source8);
+
+        if (access(source, W_OK) == -1) {
+            return (errno != ENOENT) ? ::SYSTEM_ERROR : ::KEY_NOT_FOUND;
+        }
+
+        String8 target8(name);
+        char target[NAME_MAX];
+
+        encode_key_for_uid(target, targetUid, target8);
+
+        // Make sure the target doesn't exist
+        if (access(target, R_OK) == 0 || errno != ENOENT) {
+            ALOGD("migrate target already exists: %s", strerror(errno));
+            return ::SYSTEM_ERROR;
+        }
+
+        if (rename(source, target)) {
+            ALOGD("migrate could not rename: %s", strerror(errno));
+            return ::SYSTEM_ERROR;
+        }
+        return ::NO_ERROR;
+    }
+
 private:
     inline bool isKeystoreUnlocked(State state) {
         switch (state) {