Panzura LLC, maker of a global cloud file system, is adding native Amazon Web Services Inc. S3 application programming interface compatibility and file-level geofencing to its CloudFS platform in release 8.6, announced today.

The updates aim to enhance data management and protection for organizations managing data within defined geographic zones. They also seek to eliminate data duplication between file and object storage systems by enabling simultaneous access to the same data via Server Message Block, Network File System and S3 protocols.

File-level geofencing allows administrators to enforce geographic access policies for compliance and data sovereignty. Rules such as Europe’s General Data Protection Regulation and China’s Personal Information Protection Law require companies to keep data within their respective countries. Some U.S. government contracts also mandate storage inside a government cloud.

“The way customers solve this today is to put up separate infrastructure and then keep the data in silos,” said Panzura Chief Technology Officer Sundar Kanthadai. “With this functionality, you can now consolidate.”

User permissions are insufficient to satisfy data sovereignty requirements because geofencing policies apply to file operations, not to individual users, Kanthadai said. The feature uses node IP addresses to determine location and enforce policies.

With geofencing, “administrators can make sure what data users get to see or cannot see,” he said. “This is not a replacement for [Active Directory Access Control Lists]. This is location-based and on top of user-based ACLs.”

Administrators can build granular policies based on file types, for a particular folder, share level or entire file system level.” Multiple policies can be created and applied to nodes across regions.

Geofencing is “a significant enhancement over manually managing cloud instances,” said Ken Clipperton, principal researcher at Data Center Intelligence Group LLC. “It’s easy for organizations to end up with mixed bucket of data that can be used in some places and not in others. Having policies based on content is useful.”

S3 from anywhere

The native S3 interface addresses the growing number of organizations that need to combine file and object storage within the same application. File storage uses a hierarchy of files and folders and relies on protocols like NFS or SMB. It is typically used for general-purpose filesharing. Though it’s easy to understand, file storage doesn’t scale well.

Object storage keeps data as objects in a flat address space with unique identifiers and rich metadata. There’s no folder hierarchy and objects are accessed via HTTPS. Object storage can be more difficult for users to navigate but scales far better than file storage.

“We have a lot of customers who have new-age applications that rely on S3 as the back end,” Kanthadai said. “Customers typically have had to copy data into another dataset that can support S3, which is an operational nightmare because now there are two different versions of the data.”

Another workaround is an S3 gateway, but “the authentication and permission model doesn’t work well,” he said. “By combining this, we are making sure that the same sets of users, whether they come in through SMB, NFS, or S3, have the same permission model.”

Kanthadai said customers using S3 gateways can transition easily to native access. “Once you upgrade, you just enable the S3 access,” he said. “Users will have the same credentials and permission model as with SMB.”

Panzura’s storage cloud uses object storage and provides file services on the front end. Kanthadai said the new interface introduces no performance penalty. “This is a very lightweight interface,” he said. “It is on par with or better than what we provide natively in SMB as well.” The HTTPS protocol can support multiple streaming sessions without degraded performance.

Panzura uses a unified namespace to avoid the pitfalls of gateway-based solutions, said Mike Harvey, senior vice president of product. “If you have [internet of things] instruments or even artificial intelligence producing data sets, you would have previously had to do some kind of transformation and copy that data into a file system,” he said. “Getting the namespace together is a big piece.”

CloudFS 8.6 also includes quota management, an audit trail for all the system management operations and support for the open-source Grafana visualization and monitoring tool. It also adds support for Microsoft Corp.’s Entra ID identity and access management service.

DCIG’s Clipperton said Panzura, which was founded in 2008 and relaunched in 2020, has carved out a distinctive position in the market for its distributed file system. “Their endpoints don’t’have to go back to the cloud to coordinate changes from a single point,” he said. “They can send that compressed, encryupted change directly to another end-point rather than waiting for the cloud.”

Image: geralt/Pixabay