There’s really nothing like a cross-country flight from San Francisco to Austin in late June to really shake up your senses. We departed under cool 55-degree temperatures only to arrive back home to a balmy 101. I imagine this is how a piece of firewood must feel as it’s pulled from a cool, dry resting place and tossed into a blazing furnace.

But that’s life on the road, I guess. Or at least it was last week, when Gazzang hit the GigaOm Structure Conference in San Francisco to launch zTrustee.

Below are a few thoughts from last week, along with a tremendous analyst write up on our just announced universal key management solution.

• We heard and participated in a number of good discussions on cloud security at Structure. It’s great to see this topic continue to be dissected and debated. I think everyone can agree there’s no single solution to cloud security, especially when you factor in escalating compliance mandates, international data privacy regulations and the rapid adoption of big data as a service.

• We believe the right approach is to adopt layers of security with encryption and key management at the core. Here’s a photo of me being interviewed on the subject ---à

• It was great to connect with new GigaOm Pro analyst, Davi Ottenheimer. Kudos to GigaOm on bringing him into the fold. We spent a good 90 minutes with Davi on Wednesday, talking security for big data and demoing zTrustee. We look forward to seeing GigaOm take on a greater security focus in the future.

• Speaking of zTrustee, 451Research recently published a detailed look at the market for a universal key and opaque object manager. Since the early days of Gazzang, we’ve been carrying the torch for key management as a service. Our customers would tell us that “encryption is great, but real data security only comes with proper key management. ” So we made sure our zNcrypt key storage system provided maximum protection for Gazzang cryptographic keys.

Over time, we saw the opportunity to take what we learned from our KSS and expand its capabilities to manage keys from all encryption utilities as well as tokens, certificates and other bits of important IT DNA. So begat zTrustee, and the solution is hitting the market at just the right time. As Steve Coplan from 451Resarch notes:

“The outcome of hybridization is that there is more need to maintain trust across domains and insulate proprietary data running on third-party services from unauthorized access. This all adds up to greater likelihood of cryptographic keys and security materials floating around. In this initial iteration, Gazzang is providing an operational fix to a clear problem.”

• Finally, a quick travel tip for folks tired of overspending on hotels. Book through HomeAway. We found an awesome four-bedroom townhouse in Pacific Heights, about two miles from the conference. Just check out the patio and zen garden. You can’t find this at the Staybridge Suites. At around 4:30pm on Tuesday, Dustin Kirkland and I took an 8.5-mile jog to the Golden Gate and back.

Had we run that distance in Austin, I’m fairly certain my feet would have melted.

I'm out at the GigaOM Structure conference in sunny San Francisco this week, where Gazzang has launched its newest product -- Gazzang zTrustee! My colleagues and I have dedicated the last 6 months to the design, architecture, development and testing of this new product, and I'm thrilled to finally be able to speak freely about it.

Gazzang's original product, zNcrypt is a transparent data encryption solution -- a GPLv2 encrypted filesystem built on top of eCryptfs, adding mandatory access controls and a dynamic policy structure. zNcrypt enables enterprise users to secure data in the cloud, meet compliance regulations, and sleep well at night, ensuring that all information is encrypted before written to the underlying storage.

As of today, Gazzang's newest product, zTrustee is an opaque object storage system, ultimately providing a flexible, secure key management solution for data encryption. Any encryption system, at some point, requires access to keys, and those keys should never be stored on the same system as the encrypted data. While zTrustee was initially designed to store keys, it can actually be used to put and get opaque data objects of any type or size.

Planet Ubuntu readers might recognize a few small-scale ancestors of zTrustee in other projects that I've authored and talked about here in the past... The encrypted pbputs and pbget commands now found in the pastebinit package are similar, in principle, to zTrustee's secure put and get commands. But rather than backing uploads with a pastebin server, we have implemented a powerful, robust, enterprise-ready web service with extensive, flexible policies, redundancy, and fault-tolerance. The zEscrow utility and service are also similar in some other ways to zTrustee, except that zEscrow is intended to share keys with a backup service, while zTrustee blindly and securely stores opaque objects, releasing only to authenticated, allowed clients per policy.

Planet Ubuntu readers may be pleased to hear that our zTrustee servers are currently running Ubuntu 12.04 LTS server, replicated across multiple cloud providers. The RESTful web service is built on top of a suite of high quality open source projects, including: apache2, python wsgi, postgresql, sqlalchemy, postfix, sks, squid, gnupg, and openssl (among others).

The zTrustee client is a lightweight python utility, leveraging libcurl, openssl, and gnupg to send and receive encrypted, signed JSON blobs, to and from one or more zTrustee servers. The client utilizes the zTrustee Python library, which does the hard work, encrypting, decrypting, and processing the messages to and from the zTrustee server. You'll soon be able to interface with zTrustee using either the command line interface, or the Python library directly in your Python scripts.

We've turned our current focus onto Android, while developing a Java interface to zTrustee, so that Java programs and Android applications will soon be able to interface with zTrustee, putting and getting certificates and key material and thereby enabling mobile encryption solutions. Looking a little further out down our road map, we'll also use these Java extensions to support zTrustee clients on iOS, Mac, and Windows.

While I'm big fan and proponent of eCryptfs and zNcrypt, I plainly recognize that there are lots of other ways to encrypt data -- dmcrypt, TrueCrypt, FileVault, BitLocker, HekaFS, among many others. From one perspective, encrypting and decrypting data is now the easy part. Where to store keys, especially in public/private/hybrid cloud environments, is the really hard part. Many people and organizations have punted on that problem. Well as it happens, I like hard problems, and Gazzang likes market opportunities and for that, we're both proud to promote zTrustee as a new solution in this space.

This post is intended as a very basic or brief introduction to the concept, and I'll follow this with a series of examples and tutorials as to how you might use the zTrustee client, library, and mobile interfaces.

Cheers,
:-Dustin