Restricted storage zones

Restricted storage zones are utilized to protect sensitive data. Only employees can access restricted storage.

Third-party user authentication is not supported in the restricted zone.

Note:

Restricted storage zones are End of Maintenance. This lifecycle policy is described in more detail under the Lifecycle Milestones Definitions. The creation of new restricted storage zones is not supported. Existing customers utilizing restricted storage zones will receive further communication about any future product milestones.

Restricted zone features

Zone authentication: In addition to logging on to ShareFile, users must authenticate separately to the storage zones controller to access documents stored in a restricted zone. Directory lookup ensures that the user logging on to ShareFile is the same one authenticating to the zone. This extra authentication requirement limits sharing. Documents can be shared only with others who have access to the storage zones controller and who can authenticate using enterprise credentials. In a restricted zone, files cannot be shared anonymously. Users must be granted permission to view a file and must always log on to receive a shared file.

Metadata encryption: All information about files and folders in the zone is encrypted with your key before being sent to ShareFile. As a result, no one outside of your organization can see folder or file names in restricted zones. Access to encryption keys, decrypted files, and metadata is available only through enterprise authentication to storage zones controller.

Internal address for storage zones controller: For a restricted zone, authorization occurs between storage zones controller and ShareFile clients instead of between storage zones controller and the ShareFile cloud. As a result, a storage zones controller that hosts restricted zones does not require an external address or external SSL certificate. When the storage zones controller is configured with an internal-only address, users must connect to the company network or VPN to access documents in the restricted zone.

Email notifications from your mail server: When users receive email notifications about shared files and folders in a restricted zone, the email is sent from your internal mail server instead of a ShareFile server.

Differences between standard and restricted zones

Standard and restricted storage zones

You can designate a storage zone as standard or restricted.

• A standard storage zone is intended for non-sensitive data and enables employees to share data with non-employees.
• A restricted storage zone protects sensitive data: Only employees can access the data stored in the zone.

The following table summarizes the differences between standard and restricted zones.

In a Citrix-managed zone, the ShareFile cloud performs all operations except for employee authentication, which is handled by storage zones controller.

In the standard zone, website maintenance and updates, client and application updates, file metadata, upload and download authorization, email notifications (SMTP), third-party user authentication, and folder permissions are handled in the cloud. Employee authentication and file storage and encryption are handled by the controller.

In the restricted zone, website maintenance and updates, client and application updates, and folder permissions are handled in the cloud. Employee authentication, file storage and encryption, file metadata, upload and download authorization, and email notifications (SMTP) are handled by the controller. Third-party user authentication is not supported in the restricted zone.

ShareFile supports a mix of standard and restricted zones within an account. You can create multiple restricted zones, each with their own unique authentication requirements. For example, if users in Domain A should not be allowed to share files with users in Domain B, install a separate restricted zone for each domain.

The rest of this section describes the workflow in ShareFile-managed, standard, and restricted zones.

Proof-of-concept deployment for restricted storage zones

A storage zones controller configured for restricted zones does not need to accept in-bound connections from the ShareFile cloud: You can configure it with an internal address. The following figure indicates the traffic flow between user devices, the ShareFile cloud, and storage zones controller.

In this scenario, one firewall stands between the Internet and the secure network. Storage zones controller resides inside the firewall to control access. User connections to ShareFile must traverse the firewall and use the SSL protocol on port 443 to establish this connection. To support this connectivity, you must open port 443 on the firewall and install an SSL certificate, which can be private, on the IIS service of the storage zones controller.

For restricted zones, storage zones controller sends email notifications from your local SMTP server instead of from ShareFile.

High availability deployment for restricted zones

Storage zones controllers configured for restricted zones do not need to accept in-bound connections from the ShareFile cloud: You can configure each one with an internal address. The following figure shows a high availability deployment for restricted zones.

In this scenario, one firewall stands between the Internet and the secure network. The storage zones controllers reside inside the firewall to control access. User connections to ShareFile must traverse the firewall and use the SSL protocol on port 443 to establish this connection. To support this connectivity, you must open port 443 on the firewall and install an SSL certificate, which can be private, on the IIS service of the storage zones controller.

For restricted zones, storage zones controller sends email notifications from your local SMTP server instead of from ShareFile.

Restricted zones

The following table describes the network connections that occur when a user logs on to ShareFile and then downloads a document from a restricted zone. All connections use HTTPS.

Deployment for restricted storage zones

The following figure shows a high availability deployment for restricted zones.

For restricted zones, storage zones controller sends email notifications from your local SMTP server instead of from ShareFile.

Network connections for restricted zones

The following diagram and table describe the network connections that occur when a user logs onto ShareFile and then uploads a document to a restricted zone. In this case, the account uses Active Directory Federation Services (ADFS) for SAML logon. Authentication traffic is handled by an ADFS proxy server that communicates with an ADFS server on the trusted network.

For restricted storage zones:

• Use an internal or external host name.

• Enable SSL for communications with ShareFile.

  If you use an internal host name, you can use a private certificate. The certificate must be trusted by user devices.

  If you use an external host name, the SSL certificate on the storage zones controller must be trusted by user devices and ShareFile web servers.

• Provide outbound HTTP access from storage zones controller to one of the following service bus URIs:

  • ShareFile.com accounts: sf-zk-email-use.servicebus.windows.net
  • ShareFile.eu accounts: sf-zk-email-euw.servicebus.windows.net

  Be sure to arrange network dependencies with your networking team.

Client requirements for restricted storage zones

The ShareFile web application supports restricted storage zones from the following web browsers:

• Internet Explorer 11

  To enable access from the ShareFile web application to folders and connectors in restricted zones:

  1. Open Internet Explorer, go to Internet Options, click the Security tab, and then click Trusted Sites.
  2. Click Sites and then add your subdomain and the external storage zones controller address.
  3. Click Close and then click Custom Level.
  4. For Miscellaneous > Access data sources across domains, select Enable.
  5. For User Authentication > Logon, select Prompt for user name and password.

• Chrome

• Firefox

• Safari

• Secure Web

To support restricted storage zones, ShareFile clients must be upgraded to the following versions or later:

• ShareFile Sync for Windows 3.1
• ShareFile Outlook Plug-in 3.2.2
• ShareFile for iOS 3.3
• ShareFile for Android 3.4
• ShareFile for Windows Phone 2.3.10

These ShareFile clients and tools are not supported for use with restricted storage zones as of the publication date of this article:

Note: For the latest information about ShareFile client capabilities, see the ShareFile support site or contact your ShareFile support representative.

• Off-domain use of ShareFile Desktop Sync for Windows 3.1 and ShareFile Outlook Plug-in

  The clients must be on a domain-joined Windows desktop that is in the same Active Directory forest as the storage zones controller server. Clients can use NTLM or Kerberos for silent authentication to a restricted zone.

• On-Demand Sync for Windows

• Sync for Mac

• ShareFile Enterprise Sync Manager

• Secure Mail for iOS

• ShareFile Desktop Widget

• ShareFile for BlackBerry

• ShareFile mobile website

The following alternative account access methods are not supported for use with restricted storage zones:

• FTP
• PowerShell
• ShareFile Command Line Interface (SFCLI)
• HTTPS API (V1)
• WebDav
• SMTP

Important

ShareFile does not officially support and does not recommend utilizing DFS replication. It has been known to cause locking failures for larger files. If DFS replication must be used, use separate backup solutions during off-peak hours when the zone is not actively in use.

Upgrade Restricted Storage Zone

When you upgrade a storage zones controller to the latest version, that controller continues to use standard zones. You cannot upgrade a standard zone to a restricted zone.

To replace a standard zone with a restricted zone, you must install a new storage zones controller and configure a restricted zone.

To support restricted zones or web access to connectors, you must perform additional Citrix ADC configuration after you complete the wizard. The configuration ensures that ShareFile clients send credentials only when logged on to a trusted ShareFile domain. To support web access to connectors, you also add a path (/ProxyService) to the content switching policy used for traffic to /cifs and /sp.

Additional restricted zones information

Support for restricted storage zones affects all aspects of the ShareFile service. As a result of protocol changes required to support metadata encryption and zone authentication, some ShareFile clients and features are not supported when working with documents in a restricted storage zone.

Contents

• Clients and tools
• Browsers
• Features
• Sync for Windows
• Mobile Apps
• Outlook Plug-in

Clients and tools

Browsers

Features

End user actions: Working with files:

End user actions: Sharing and collaboration:

Administrative actions:

Sync for Windows

Minimum version - 3.1

Mobile apps

See the app-specific tables below:

iOS - Minimum version 3.3

Android - Minimum version 3.4

Outlook plug-in