I'm out at the GigaOM Structure conference in sunny San Francisco this week, where Gazzang has launched its newest product -- Gazzang zTrustee! My colleagues and I have dedicated the last 6 months to the design, architecture, development and testing of this new product, and I'm thrilled to finally be able to speak freely about it.
Gazzang's original product, zNcrypt is a transparent data encryption solution -- a GPLv2 encrypted filesystem built on top of eCryptfs, adding mandatory access controls and a dynamic policy structure. zNcrypt enables enterprise users to secure data in the cloud, meet compliance regulations, and sleep well at night, ensuring that all information is encrypted before written to the underlying storage.
As of today, Gazzang's newest product,
zTrustee is an
opaque object storage system, ultimately providing a flexible, secure key management solution for data encryption. Any encryption system, at some point, requires access to keys, and those keys should
never be stored on the same system as the encrypted data. While
zTrustee was initially designed to store keys, it can actually be used to
put and
get opaque data objects of any type or size.
Planet Ubuntu readers might recognize a few small-scale ancestors of
zTrustee in other projects that I've authored and talked about here in the past... The encrypted
pbputs and
pbget commands now found in the
pastebinit package are similar, in principle, to
zTrustee's secure put and get commands. But rather than backing uploads with a
pastebin server, we have implemented a powerful, robust, enterprise-ready web service with extensive, flexible policies, redundancy, and fault-tolerance. The
zEscrow utility and service are also similar in some other ways to
zTrustee, except that
zEscrow is intended to share keys with a backup service, while
zTrustee blindly and securely stores opaque objects, releasing only to authenticated, allowed clients per policy.
Planet Ubuntu readers may be pleased to hear that our
zTrustee servers are currently running
Ubuntu 12.04 LTS server, replicated across
multiple cloud providers. The
RESTful web service is built on top of a suite of high quality open source projects, including:
apache2,
python wsgi,
postgresql,
sqlalchemy,
postfix,
sks,
squid,
gnupg, and
openssl (among others).
The
zTrustee client is a lightweight python utility, leveraging
libcurl,
openssl, and
gnupg to send and receive encrypted, signed
JSON blobs, to and from one or more
zTrustee servers. The client utilizes the
zTrustee Python library, which does the hard work, encrypting, decrypting, and processing the messages to and from the
zTrustee server. You'll soon be able to interface with
zTrustee using either the command line interface, or the Python library directly in your Python scripts.
We've turned our current focus onto
Android, while developing a
Java interface to
zTrustee, so that Java programs and Android applications will soon be able to interface with
zTrustee, putting and getting certificates and key material and thereby enabling mobile encryption solutions. Looking a little further out down our road map, we'll also use these Java extensions to support
zTrustee clients on iOS, Mac, and Windows.
While I'm big fan and proponent of
eCryptfs and
zNcrypt, I plainly recognize that there are lots of other ways to encrypt data --
dmcrypt,
TrueCrypt,
FileVault,
BitLocker,
HekaFS, among many others. From one perspective, encrypting and decrypting data is now the
easy part.
Where to store keys, especially in public/private/hybrid cloud environments, is the really
hard part. Many people and organizations have punted on that problem. Well as it happens, I like hard problems, and Gazzang likes market opportunities and for that, we're both proud to promote
zTrustee as a new solution in this space.
This post is intended as a very basic or brief introduction to the concept, and I'll follow this with a series of examples and tutorials as to how you might use the zTrustee client, library, and mobile interfaces.
Cheers,
:-Dustin
