diff --git a/nova/db/sqlalchemy/api_migrations/migrate_repo/versions/014_keypairs.py b/nova/db/sqlalchemy/api_migrations/migrate_repo/versions/014_keypairs.py
new file mode 100644
index 000000000..62fce7d09
--- /dev/null
+++ b/nova/db/sqlalchemy/api_migrations/migrate_repo/versions/014_keypairs.py
@@ -0,0 +1,48 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from migrate import UniqueConstraint
+from sqlalchemy import Column
+from sqlalchemy import DateTime
+from sqlalchemy import Enum
+from sqlalchemy import Integer
+from sqlalchemy import MetaData
+from sqlalchemy import String
+from sqlalchemy import Table
+from sqlalchemy import Text
+
+from nova.objects import keypair
+
+
+def upgrade(migrate_engine):
+    meta = MetaData()
+    meta.bind = migrate_engine
+
+    enum = Enum('ssh', 'x509', metadata=meta, name='keypair_types')
+    enum.create(checkfirst=True)
+
+    keypairs = Table('key_pairs', meta,
+        Column('created_at', DateTime),
+        Column('updated_at', DateTime),
+        Column('id', Integer, primary_key=True, nullable=False),
+        Column('name', String(255), nullable=False),
+        Column('user_id', String(255), nullable=False),
+        Column('fingerprint', String(255)),
+        Column('public_key', Text()),
+        Column('type', enum, nullable=False,
+               server_default=keypair.KEYPAIR_TYPE_SSH),
+        UniqueConstraint('user_id', 'name',
+                         name="uniq_key_pairs0user_id0name"),
+        mysql_engine='InnoDB',
+        mysql_charset='utf8'
+    )
+    keypairs.create(checkfirst=True)
diff --git a/nova/db/sqlalchemy/api_models.py b/nova/db/sqlalchemy/api_models.py
index 49856c5cf..a46dd4272 100644
--- a/nova/db/sqlalchemy/api_models.py
+++ b/nova/db/sqlalchemy/api_models.py
@@ -200,3 +200,22 @@ class BuildRequest(API_BASE):
     key_name = Column(String(255))
     locked_by = Column(Enum('owner', 'admin'))
     instance = Column(Text)
+
+
+class KeyPair(API_BASE):
+    """Represents a public key pair for ssh / WinRM."""
+    __tablename__ = 'key_pairs'
+    __table_args__ = (
+        schema.UniqueConstraint("user_id", "name",
+                                name="uniq_key_pairs0user_id0name"),
+    )
+    id = Column(Integer, primary_key=True, nullable=False)
+
+    name = Column(String(255), nullable=False)
+
+    user_id = Column(String(255), nullable=False)
+
+    fingerprint = Column(String(255))
+    public_key = Column(Text())
+    type = Column(Enum('ssh', 'x509', name='keypair_types'),
+                  nullable=False, server_default='ssh')