Geo-fencing aware separation of compute infrastructure built within a geographically located storage device

A mechanism is provided for enabling separation of compute infrastructure built within a geographically located storage device. A determination is made as to whether a compute request originates from a geographical location that is the same as a geographical location of the geographically located storage device. Responsive to the compute request originating from a geographical location different from the geographical location of the geographically located storage device, a determination is made as to whether the compute request complies with governing requirements that govern the geographically located storage device. Responsive to the compute request complying with the requirements that govern the geographically located storage device, a determination is made as to whether the compute request is for data retrieval only. Responsive to the compute request being for data retrieval only, the requested data is gathered from data storage of the geographically located storage device and sent to a requesting client.

BACKGROUND

The present application relates generally to an improved data processing apparatus and method and more specifically to mechanisms for geo-fencing aware compute infrastructure.

In today's global system of interconnected computer networks, Information Technology (IT) has become hugely dependent on data and ensuring each entities compliance, auditing, and security in terms of data placement, maintenance, separation in compute analysis, and the like, with respect to the entity's respective origin or location as well as any laws that govern the infrastructure at that location within a geographically distributed object storage namespace.

Traditionally, object storage is used for backup, archival, data mining, searching, search, analytics, and the like. This unstructured or raw data resides in the data storage for a much longer tenure of period when compared with traditional compute infrastructures.FIG. 1depicts an example of a traditional object storage architecture. Traditional object storage architecture100comprises two geographically diverse infrastructures102and112that are accessible by client devices120and122via load balancer124. Each of infrastructures102and112further comprise two node groups. The first node groups104and114comprise proxy nodes104a-104nand114a-114nthat are used for distributed load handling/request handling from client devices120and122into the storage namespace. The second node groups106and116, i.e. the storage namespace, comprises storage nodes106a-106nand116a-116nthat are responsible for writing to the disks or storage subsystems and, in this illustrative architecture, purely serves as a storage unit repository. However, in order to analyze or extract any meaningful information from raw data retrieved from the storage nodes106a-106nand116a-116nin second node groups106and116, the data must be sent back to client120and122or to an additional client126or compute node128for analysis.

With the evolution of embedded compute infrastructures with built-in object storage architecture, computation utilizing the data stored in these compute infrastructures is offloaded to storage units instead of using a traditional client device for computation purposes.FIG. 2depicts an example of an embedded compute engine in an object storage architecture. As with the architecture shown inFIG. 1, embedded compute engine object storage architecture200ofFIG. 2comprises two geographically diverse infrastructures202and212that are accessible by client devices220and222via load balancer224. Each of infrastructures202and212further comprise two node groups. The first node groups204and214comprise proxy nodes204a-204nand214a-214nthat are used for distributed load handling/request handling from client devices220and222into the storage namespace. The second node groups206and216, i.e. the storage namespace, comprises storage nodes206a-206nand216a-216nthat are responsible for writing to the disks or storage subsystems.

However, in addition to the common infrastructure, embedded compute engine object storage architecture200also comprises software engines208and218as shown within second node groups206and216, respectively. In an alternative embodiment, software engines208and218may reside within first node groups204and214. Utilizing software engines208and218, any computation or analysis required by client device220or222may be implemented by software engine208or218. However, a user of client devices220and222has to frame computation algorithm to perform the computation or analysis and has to deploy or pass the computation algorithm to software engine208or218at the time of the original request. Then software engine208or218sends the results of the computation back to the requesting user of client device220or222. Therefore, embedded compute engine object storage architecture200differs from the traditional object storage architecture100ofFIG. 1in that, embedded compute engine object storage architecture200does not require any additional client or compute node to perform computation or analysis of the data. That is, second node groups206and216act as compute nodes and return any results back to the user.

However, with the embedded compute engine object storage architecture ofFIG. 2, a scenario may exist where in a storage namespace is shared by two countries having different laws, policies, or the like, and where the data residing in the storage namespace is governed according to the respective countries laws, policies, and or the like where the storage namespace resides. While the two countries may have a treaty indicating a sharing of the data residing in the storage namespace for a combined project, such a treaty would prohibit any computational algorithms from being executed by a software engine at the same geographical location associated with the storage namespace. That is, only the data may be utilized by both the countries and any country accessing the storage namespace outside of the namespace's geographic location may not perform any analysis or computation utilizing computational algorithms using the software engine at the same geographical location associated with the storage namespace.

In this scenario, there exists a problem in terms of having separation in compute infrastructure, i.e. storage nodes itself are acting as compute infrastructure, as there exists no way to govern the compute algorithm owned by a country to be limited only to that particular country but not be deployed on to the shared compute infrastructure embedded in the object storage. Therefore, such offloading of computation to storage units results in a security concern, where computation analysis algorithms may not be secured in order to adhere with respective policies and/or laws associated with the countries where the geographically diverse infrastructures in which the software engines reside. Instead, the computation analysis algorithms are shared with various countries utilizing the same storage unit/namespace, which prevents compute resource separation between different countries sharing the same storage unit/namespace.

SUMMARY

In one illustrative embodiment, a method, in a data processing system, is provided for enabling separation of compute infrastructure built within a geographically located storage device. The illustrative embodiment determines whether a compute request originates from a geographical location that is the same as a geographical location of the geographically located storage device. The illustrative embodiment determines whether the compute request complies with governing requirements that govern the geographically located storage device in response to the compute request originating from a geographical location different from the geographical location of the geographically located storage device. The illustrative embodiment determines whether the compute request is for data retrieval only in response to the compute request complying with the requirements that govern the geographically located storage device. The illustrative embodiment gathers the requested data from a data storage of the geographically located storage device in response to the compute request being for data retrieval only. The illustrative embodiment sends the retrieved data to a requesting client.

Thus, the illustrative embodiment allows a compute request for data only to be processed so long as the governing requirements associated with the geographically located storage device indicate the compute request is compliant. That is, in the illustrative embodiment, the governing requirements are at least one of policies implemented for the geographical location of the geographically located storage device, laws of a country where the geographically located storage device resides, or agreements between the country where the geographically located storage device resides and at least one other country. Therefore, if the compute request complies with the policies, laws, and/or agreements, the request for data only is processed.

Additionally, the illustrative embodiment determines whether the compute request is for data and computation offloading in response to the compute request failing to be for data retrieval only. The illustrative embodiment gathers the requested data from the data storage of the geographically located storage device in response to the compute request being for data and computation offloading. The illustrative embodiment sends the retrieved data and a computational algorithm included with the compute request to a computation device separate from the geographically located storage device. In the illustrative embodiment, the computation device separate from the geographically located storage device is at least one of the requesting client, another identified client, or a computation node. Again, the illustrative embodiment allows a compute request for data and computation offloading to be processed so long as the governing requirements associated with the geographically located storage device indicates the compute request is compliant. Therefore, if the compute request complies with the policies, laws, and/or agreements, the request for data only is processed.

The illustrative embodiment determines whether the compute request is for data and computation offloading in response to the compute request failing to be for data retrieval only. The illustrative embodiment recognizes that the compute request is for analysis or computation utilizing the embedded computational infrastructure of the geographically located storage device in response to the compute request failing to be for data and computation offloading. The illustrative embodiment gathers the requested data from the data storage of the geographically located storage device. The illustrative embodiment performs requested analysis or computation identified in the compute request utilizing an included computation algorithm and the embedded computational infrastructure of the geographically located storage device. The illustrative embodiment sends results of the analysis or the computation to the requesting client. Again, the illustrative embodiment allows a compute request for analysis or computation utilizing the embedded computational infrastructure of the geographically located storage device to be processed so long as the governing requirements associated with the geographically located storage device indicates the compute request is compliant. Therefore, if the compute request complies with the policies, laws, and/or agreements, the request for data only is processed.

The illustrative embodiment determines whether the governing requirements indicate that, for non-geographically originating compute requests, any trace of the analysis or computation performed on the geographically located storage device is to be removed. The illustrative embodiment removes any residue of the compute request, performs computations, and results of the computation existing on the geographically located storage device in response to the governing requirements indicating that any trace of the analysis or computation performed on the geographically located storage device is to be removed. Therefore, the illustrative embodiment provides protection of the geographically located storage device based on the policies, laws, and/or agreements of the governing requirements such that the computation algorithm is not visible to the other geographic users, that results of the computation are hidden from all logs, and audits the storage node so that any residue of the request, the computations, or results of the computation are deleted from the storage node once the results are sent back to the requesting entity.

In the illustrative embodiment, the compute request is received and passed by the illustrative embodiment determining whether the incoming compute request is an authorized access to the geographically located storage device by comparing metadata associated with the compute request against a set of verified authorization information and passing the compute request to the geo-fencing policy implementation module in response to authenticating the compute request.

In the illustrative embodiment, the metadata associated with the compute request is at least one of geographical location (country of origin), company or enterprise, client device, or user identification.

DETAILED DESCRIPTION

The illustrative embodiments provide a geo-fencing aware compute mechanism that enables separation of compute infrastructure built within a storage unit that helps govern computing algorithms that extract a particular set of information from a large set of raw data on a storage node owned by a country, such that such computing algorithms to extract such information may only be executed according to the policies, laws, agreements, or the like, which may referred to as governing requirements hereafter, associated with that particular country. The geo-fencing aware compute mechanism also provides hardened security through maintenance, access limitations, or the like, of the compute algorithm and common object storage compute layers as per the governing requirements as noted by administrators or business requirements.

For example, in one embodiment, if a request bearing a computation algorithm that requires data, objects, metadata, attributes, or the like, originates from a particular geographic location and is served by the storage node located or designated for that respective location, the geo-fencing aware compute mechanism allows the computation to be offloaded to the storage unit and provides the results of the computation to the user. In another embodiment, if a request bearing a computation algorithm requires data, objects, metadata, attributes, or the like, originates from a particular geographical location and requires shared data of a storage nodes located in another location or governed by a different policy, the geo-fencing aware compute mechanism discards the computation request and responds with an error indicating that the computational algorithm is incapable of being executed due to the governing requirements and/or that insufficient permissions exist to use the embedded compute infrastructure of the storage node. In yet another embodiment, if the embedded compute infrastructure owned by the multiple countries but governed by the geographical policies of a particular country not responsible for the request share their respective compute infrastructure but not the compute algorithms, the geo-fencing aware compute mechanism allows the computation request and, thus, the computational algorithm to be executed by the software engine and compute infrastructure of the storage node bearing the data, objects, metadata, attributes, or the like. However, the geo-fencing aware compute mechanism sets the software engine and compute infrastructure of the storage node such that the computation algorithm is not visible to the other geographic users, that results of the computation are hidden from all logs, and audits the storage node so that any residue of the request, the computations, or results of the computation are deleted from the storage node once the results are sent back to the requesting entity.

FIG. 3depicts a pictorial representation of an example distributed data processing system in which aspects of the illustrative embodiments may be implemented. Distributed data processing system300may include a network of computers in which aspects of the illustrative embodiments may be implemented. The distributed data processing system300contains at least one network302, which is the medium used to provide communication links between various devices and computers connected together within distributed data processing system300. The network302may include connections, such as wire, wireless communication links, or fiber optic cables.

In the depicted example, server304and server306are connected to network302along with storage unit308and storage unit309. In addition, clients310,312, and314are also connected to network302. These clients310,312, and314may be, for example, personal computers, network computers, or the like. In the depicted example, server304provides data, such as boot files, operating system images, and applications to the clients310,312, and314. Clients310,312, and314are clients to server304in the depicted example. Distributed data processing system300may include additional servers, clients, and other devices not shown.

FIG. 4is a block diagram of an example data processing system in which aspects of the illustrative embodiments may be implemented. Data processing system400is an example of a computer, such as server304, storage unit308, and client310inFIG. 3, in which computer usable code or instructions implementing the processes for illustrative embodiments of the present invention may be located.

In the depicted example, data processing system400employs a hub architecture including north bridge and memory controller hub (NB/MCH)402and south bridge and input/output (I/O) controller hub (SB/ICH)404. Processing unit406, main memory408, and graphics processor410are connected to NB/MCH402. Graphics processor410may be connected to NB/MCH402through an accelerated graphics port (AGP).

In the depicted example, local area network (LAN) adapter412connects to SB/ICH404. Audio adapter416, keyboard and mouse adapter420, modem422, read only memory (ROM)424, hard disk drive (HDD)426, CD-ROM drive430, universal serial bus (USB) ports and other communication ports432, and PCI/PCIe devices434connect to SB/ICH404through bus438and bus440. PCI/PCIe devices may include, for example, Ethernet adapters, add-in cards, and PC cards for notebook computers. PCI uses a card bus controller, while PCIe does not. ROM424may be, for example, a flash basic input/output system (BIOS).

An operating system runs on processing unit406. The operating system coordinates and provides control of various components within the data processing system400inFIG. 4. As a client, the operating system may be a commercially available operating system such as Microsoft® Windows 7®. An object-oriented programming system, such as the Java™ programming system, may run in conjunction with the operating system and provides calls to the operating system from Java™ programs or applications executing on data processing system400.

As a server, data processing system400may be, for example, an IBM eServer™ System P® computer system, Power™ processor based computer system, or the like, running the Advanced Interactive Executive (AIX®) operating system or the LINUX® operating system. Data processing system400may be a symmetric multiprocessor (SMP) system including a plurality of processors in processing unit406. Alternatively, a single processor system may be employed.

Instructions for the operating system, the object-oriented programming system, and applications or programs are located on storage devices, such as HDD426, and may be loaded into main memory408for execution by processing unit406. The processes for illustrative embodiments of the present invention may be performed by processing unit406using computer usable program code, which may be located in a memory such as, for example, main memory408, ROM424, or in one or more peripheral devices426and430, for example.

A bus system, such as bus438or bus440as shown inFIG. 4, may be comprised of one or more buses. Of course, the bus system may be implemented using any type of communication fabric or architecture that provides for a transfer of data between different components or devices attached to the fabric or architecture. A communication unit, such as modem422or network adapter412ofFIG. 4, may include one or more devices used to transmit and receive data. A memory may be, for example, main memory408, ROM424, or a cache such as found in NB/MCH402inFIG. 4.

FIG. 5depicts a functional block diagram of a geo-fencing aware compute mechanism that enables separation of compute infrastructure built within a storage unit in accordance with one illustrative embodiment. Geographically located storage device500is an example of a storage unit, such as storage unit308inFIG. 3. Geographically located storage device500comprises geo-fencing aware compute mechanism502and data storage504. Geo-fencing aware compute mechanism502, which enables separation of compute infrastructure built within a storage unit, comprises request receiving module506, geo-fencing policy implementation module508, computation implementation module510, trace removal module512, and data retrieval/response module514. In operation, request receiving module506receives a compute request from a user. In accordance with the illustrative embodiments, the compute request may originate from any client device that has access to geographically located storage device500. However, since geographically located storage device500is a storage device that is shared by two or more countries under a prearranged agreement, request receiving module506performs an initial check of each incoming compute request as to an authorized access to geographically located storage device500. In performing this check, request receiving module506compares metadata associated with the compute request that indicates geographical location (country of origin), company or enterprise, client device, user identification, or any other authorization information against already verified authorization information518in data structure516to ensure only those individuals who are to have access to geographically located storage device500have their compute requests processed in geographically located storage device500. Therefore, if request receiving module506fails to authorize the incoming compute request, request receiving module506rejects the compute request and sends an error to the requesting user indicating insufficient permissions to use geographically located storage device500. However, if request receiving module506authorizes the incoming compute request, request receiving module506passes the compute request to geo-fencing policy implementation module508.

Upon receiving the compute request, geo-fencing policy implementation module508determines whether the geographical location information associated with the compute request is the same as the geographical location of geographically located storage device500. If the compute request originates from a geographical location that is the same as the geographical location of geographically located storage device500, then, if the compute request is for data only, geo-fencing policy implementation module508forwards the compute request to data retrieval/response module514. Data retrieval/response module514gathers the requested data from data storage504and responds to the compute request with the requested data. If the compute request is for data and computation offloading, geo-fencing policy implementation module508forwards the compute request and the computational algorithm to data retrieval/response module514. Data retrieval/response module514gathers the requested data from data storage504and responds/forwards the compute request with the requested data and the computational algorithm to the requesting client or to another identified client or computation node for analysis or computation. If the compute request is for analysis or computation utilizing embedded computational infrastructure/resources522of geographically located storage device500, geo-fencing policy implementation module508forwards the compute request and the computational algorithm to computation implementation module510. Computation implementation module510gathers the requested data from data storage504, performs the requested analysis and/or computation utilizing the included computation algorithm and embedded computational infrastructure/resources522of geographically located storage device500, and responds with the results of the analysis and/or computation to the user via data retrieval/response module514.

If the compute request originates from a geographical location that differs from the geographical location of geographically located storage device500, then geo-fencing policy implementation module508determines whether the compute request complies with the governing requirements520stored in data structure516that govern geographically located storage device500. The governing requirements520may indicate that a compute request originating from a geographical location that is the same as the geographical location of geographically located storage device500is able to access data on geographically located storage device500, obtain data from geographically located storage device500and offload the data and an included computer algorithm to another client or computation node for analysis or computation, and perform analysis or computation of the data utilizing embedded computational infrastructure/resources522of geographically located storage device500. However, for a compute request originating from a geographical location that is different from the geographical location of geographically located storage device500, the governing requirements520may indicate the user is only able to access data on geographically located storage device500, the user may obtain data from geographically located storage device500and offload the data and an included computer algorithm to another client or computation node for analysis or computation the user may access data, or the user may perform analysis or computation of the data utilizing embedded computational infrastructure/resources522of geographically located storage device500, which may include removing all traces of the computation and any results of the computation from geographically located storage device500.

Therefore, if the compute request is for data only and the governing requirements520indicate that data sharing is permissible, geo-fencing policy implementation module508forwards the compute request to data retrieval/response module514. Data retrieval/response module514gathers the requested data from data storage504and responds to the compute request with the requested data. If the compute request is for data only and governing requirements520indicate that data sharing is impermissible, geo-fencing policy implementation module508rejects the compute request and sends an error to the requesting user indicating insufficient permissions to use geographically located storage device500via data retrieval/response module514.

If the compute request is for data and computation offloading and governing requirements520indicate that data sharing and computation offloading is permissible, geo-fencing policy implementation module508forwards the compute request and the computational algorithm to data retrieval/response module514. Data retrieval/response module514gathers the requested data from data storage504and responds/forwards the compute request with the requested data and the computational algorithm to the requesting client or to another identified client or computation node for analysis or computation. If the compute request is for data and computation offloading and governing requirements520indicate that data sharing and computation offloading is impermissible, geo-fencing policy implementation module508rejects the compute request and sends an error to the requesting user indicating insufficient permissions to use geographically located storage device500via data retrieval/response module514.

If the compute request is for analysis or computation utilizing embedded computational infrastructure/resources522of geographically located storage device500and governing requirements520indicate that embedded computation is permissible, geo-fencing policy implementation module508forwards the compute request and the computational algorithm to computation implementation module510. Computation implementation module510gathers the requested data from data storage504, performs the requested analysis and/or computation utilizing the included computation algorithm and embedded computational infrastructure/resources522of geographically located storage device500, and responds with the results of the analysis and/or computation to the user via data retrieval/response module514. If the compute request is for analysis or computation utilizing embedded computational infrastructure/resources522of geographically located storage device500and governing requirements520indicate that embedded computation is impermissible, geo-fencing policy implementation module508rejects the compute request and sends an error to the requesting user indicating insufficient permissions to use geographically located storage device500via data retrieval/response module514.

As an additional component of performing embedded computation, governing requirements520may also indicate that for non-geographically originating compute requests, any trace of the analysis or computation performed on geographically located storage device500is removed such that the computation algorithm is not visible to the other geographic users, that results of the computation are hidden from all logs, and audits the storage node. That is, trace removal module512executes so that any residue of the compute request, the computations, or results of the computation exist on geographically located storage device500after the results are sent back to the requesting entity.

FIGS. 6A, 6B, and 6Cdepict the operation of enabling separation of compute infrastructure built within a geographically located storage device in accordance with an illustrative embodiment. As the operation begins, a request receiving module of a geo-fencing aware compute mechanism executed by a processor of a geographically located storage device receives a compute request from a user (step602). In accordance with the illustrative embodiments, the compute request may originate from any client device that has access to the geographically located storage device. However, since the geographically located storage device is a storage device that is shared by two or more countries under a prearranged agreement, the request receiving module determines whether the incoming compute request is an authorized access to the geographically located storage device (step604). In performing this check, the request receiving module compares metadata associated with the compute request that indicates geographical location (country of origin), company or enterprise, client device, user identification, or any other authorization information against a set of verified authorization information in data structure associated with the geo-fencing aware compute mechanism to ensure only those individuals who are to have access to the geographically located storage device have their compute requests processed by the geographically located storage device.

If at step604the request receiving module fails to authorize the incoming compute request, the request receiving module rejects the compute request and sends an error to the requesting user indicating insufficient permissions to use the geographically located storage device (step606), with the operation terminating thereafter. If at step604the request receiving module authorizes the incoming compute request, the request receiving module passes the compute request to a geo-fencing policy implementation module of the geo-fencing aware compute mechanism (step608). Upon receiving the compute request, the geo-fencing policy implementation module determines whether the geographical location information associated with the compute request is the same as the geographical location of the geographically located storage device (step610). If at step610the geo-fencing policy implementation module determines that the compute request originates from a geographical location that is the same as the geographical location of the geographically located storage device, then the geo-fencing policy implementation module determines whether the compute request is for data only (step612). If at step612the geo-fencing policy implementation module determines that the compute request is for data only, the geo-fencing policy implementation module forwards the compute request to a data retrieval/response module in the geo-fencing aware compute mechanism (step614). The data retrieval/response module gathers the requested data from the data storage of the geographically located storage device (step616) and responds to the compute request with the requested data (step618), with the operation terminating thereafter.

If at step612the geo-fencing policy implementation module determines that the compute request is not for data only, then the geo-fencing policy implementation module determines whether the compute request is for data and computation offloading (step620). If at step620the geo-fencing policy implementation module determines that the compute request is for data and computation offloading, the geo-fencing policy implementation module forwards the compute request and the computational algorithm to the data retrieval/response module (step622). The data retrieval/response module gathers the requested data from the data storage (step624) and responds/forwards the compute request with the requested data and the computational algorithm to the requesting client or to another identified client or computation node for analysis or computation (step626), with the operation terminating thereafter.

If at step620the geo-fencing policy implementation module determines that the compute request is not for data and computation offloading but rather for analysis or computation utilizing embedded computational infrastructure/resources of the geographically located storage device, the geo-fencing policy implementation module forwards the compute request and the computational algorithm to a computation implementation module in the geo-fencing aware compute mechanism (step628). The computation implementation module gathers the requested data from the data storage (step630), performs the requested analysis and/or computation utilizing the included computation algorithm and the embedded computational infrastructure/resources of the geographically located storage device (step632), and responds with the results of the analysis and/or computation to the user via the data retrieval/response module (step633), with the operation terminating thereafter.

If at step610the geo-fencing policy implementation module determines that the compute request originates from a geographical location that is different from the geographical location of the geographically located storage device, then the geo-fencing policy implementation module determines whether the compute request complies with the governing requirements (i.e. policies, laws, agreements, or the like) that govern the geographically located storage device (step634). As is illustrated above, the governing requirements may indicate that a compute request originating from a geographical location that is the same as the geographical location of the geographically located storage device is able to access data on the geographically located storage device, obtain data from the geographically located storage device and offload the data and an included computer algorithm to another client or computation node for analysis or computation, and perform analysis or computation of the data utilizing the embedded computational infrastructure/resources of the geographically located storage device.

However, for a compute request originating from a geographical location that is the different from the geographical location of the geographically located storage device, the governing requirements may indicate the user is only able to access data on the geographically located storage device, the user may obtain data from the geographically located storage device and offload the data and an included computer algorithm to another client or computation node for analysis or computation the user may access data, or the user may perform analysis or computation of the data utilizing the embedded computational infrastructure/resources of the geographically located storage device, which may include removing all traces of the computation and any results of the computation from the geographically located storage device.

If at step634the compute request fails to comply with the governing requirements and thus, is impermissible, the geo-fencing policy implementation module rejects the compute request and sends an error to the requesting user indicating insufficient permissions to use the geographically located storage device via the data retrieval/response module (step636), with the operation terminating thereafter.

If at step634the compute request complies with the governing requirements is permissible, the geo-fencing policy implementation module determines whether the compute request is for data only (step638). If at step638the geo-fencing policy implementation module determines that the compute request is for data only and the governing requirements indicate that data sharing is permissible, the geo-fencing policy implementation module forwards the compute request to a data retrieval/response module in the geo-fencing aware compute mechanism (step640). The data retrieval/response module gathers the requested data from the data storage of the geographically located storage device (step642) and responds to the compute request with the requested data (step644), with the operation terminating thereafter.

If at step638the geo-fencing policy implementation module determines that the compute request is not for data only, then the geo-fencing policy implementation module determines whether the compute request is for data and computation offloading (step646). If at step646the geo-fencing policy implementation module determines that the compute request is for data and computation offloading and the governing requirements indicate that data sharing and computation offloading is permissible, the geo-fencing policy implementation module forwards the compute request and the computational algorithm to the data retrieval/response module (step648). The data retrieval/response module gathers the requested data from the data storage (step650) and responds/forwards the compute request with the requested data and the computational algorithm to the requesting client or to another identified client or computation node for analysis or computation (step652), with the operation terminating thereafter.

If at step646the geo-fencing policy implementation module determines that the compute request is not for data and computation offloading but rather for analysis or computation utilizing the embedded computational infrastructure/resources of the geographically located storage device and the governing requirements indicate that embedded computation is permissible, the geo-fencing policy implementation module forwards the compute request and the computational algorithm to a computation implementation module in the geo-fencing aware compute mechanism (step654). The computation implementation module gathers the requested data from the data storage (step656), performs the requested analysis and/or computation utilizing the included computation algorithm and the embedded computational infrastructure/resources of the geographically located storage device (step658), and responds with the results of the analysis and/or computation to the user via the data retrieval/response module (step660).

From step660, the geo-fencing policy implementation module determines whether the governing requirements indicate that, for non-geographically originating compute requests, any trace of the analysis or computation performed on the geographically located storage device is to be removed (step662) such that the computation algorithm is not visible to the other geographic users, that results of the computation are hidden from all logs, and audits the storage node. If at step662, the geo-fencing policy implementation module fails to identify that all trace of the analysis or computation performed on the geographically located storage device is to be removed, the operation terminates. However, if at step662the geo-fencing policy implementation module identifies that all trace of the analysis or computation performed on the geographically located storage device is to be removed, the geo-fencing policy implementation module instructs a trace removal module in the geo-fencing aware compute mechanism to remove any residue of the compute request, the computations, and results of the computation exist on the geographically located storage device (step664), with the operation terminating thereafter.

Thus, the illustrative embodiments provide mechanisms for a separation of compute infrastructure built within a storage unit that helps govern computing algorithms that extract a particular set of information from a large set of raw data on a storage node owned by a country, such that such computing algorithms to extract such information may only be executed according to the governing requirements associated with that particular country. The geo-fencing aware compute mechanism also provides hardened security through maintenance, access limitations, or the like, of the compute algorithm and common object storage compute layers as per the governing requirements, as noted by administrators or business requirements.