Abstract: An embodiment of a method for securing stored data includes assigning a first user security label to a first user. The method further includes adding an object compartment created by the first user to the first user security label assigned to the first user. The method further includes assigning the object compartment to an object created by the first user by creating the object compartment in an object security label. The method further includes enabling a second user to access to the object created by the first user by assigning the object compartment assigned to the object to a second user security label of a second user. The method further includes determining, by a processing device, whether to permit the second user to access to the object based at least in part on the object security label and the second user security label.

Abstract: An embodiment of a method for securing stored data includes assigning a first user security label to a first user. The method further includes adding an object compartment created by the first user to the first user security label assigned to the first user. The method further includes assigning the object compartment to an object created by the first user by creating the object compartment in an object security label. The method further includes enabling a second user to access to the object created by the first user by assigning the object compartment assigned to the object to a second user security label of a second user. The method further includes determining, by a processing device, whether to permit the second user to access to the object based at least in part on the object security label and the second user security label.

Abstract: An embodiment of a non-transitory computer-readable storage medium stores instructions which, when processed by a processor, cause the processor to implement a method of securing data. The method includes: creating a user-controlled compartment associated with an object security label, the user-controlled compartment configured to be administered by a first user, the first user being associated with a first security label; storing, by the first user, a data set as an object in a data storage system accessible by multiple users, and associating the object with the object security label; and associating the first user security label with the user-controlled compartment, the user-controlled compartment defining access to the object as set by the user.

Abstract: An apparatus for processing data from a host storage device includes a client processing device configured to be connected by a communication channel to the host storage device. The client processing device includes: a processor configured to request a data set stored at the host storage device, the data set associated with a globally unique identifier; and a cache configured to store a copy of the data set and the globally unique identifier based on the processor receiving the data set from the host storage device, the cache being a persistent storage configured to retain the copy of the data set until the processor stores a new data set in the cache, the cache configured to retain the copy of the data set independent of an amount of time that the data set is stored in the cache.

Abstract: An apparatus for processing data from a host storage device includes a client processing device configured to be connected by a communication channel to the host storage device. The client processing device includes: a processor configured to request a data set stored at the host storage device, the data set associated with a globally unique identifier; and a cache configured to store a copy of the data set and the globally unique identifier based on the processor receiving the data set from the host storage device, the cache being a persistent storage configured to retain the copy of the data set until the processor stores a new data set in the cache, the cache configured to retain the copy of the data set independent of an amount of time that the data set is stored in the cache.

Abstract: An embodiment of a non-transitory computer-readable storage medium stores instructions which, when processed by a processor, cause the processor to implement a method of securing data. The method includes: creating a user-controlled compartment associated with an object security label, the user-controlled compartment configured to be administered by a first user, the first user being associated with a first security label; storing, by the first user, a data set as an object in a data storage system accessible by multiple users, and associating the object with the object security label; and associating the first user security label with the user-controlled compartment, the user-controlled compartment defining access to the object as set by the user.