{
  "slug": "self-securing-storage",
  "term": "Self-securing storage",
  "aliases": [],
  "definition": "Self-securing storage retains version history and audit records behind a storage-side security boundary that distrusts client operating systems.",
  "note": "The S4 research prototype keeps earlier states for a bounded detection window. Compromising a client does not itself bypass that boundary, but privileged storage administration remains a separate trust assumption. [s4]\n\nHistorical reads need access control: recovering deleted versions can also reveal previously removed sensitive information. Version retention protects recoverability, not secrecy from every authorized history reader. [s4]",
  "status": "research",
  "advantages": [],
  "limitations": [
    "This historical architecture is not a certification of current backup products."
  ],
  "related": [
    "air-gap-backup",
    "immutability-storage",
    "object-versioning",
    "backup-verification"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-19",
  "citations": [
    {
      "id": "s4",
      "title": "Strunk et al.: Self-Securing Storage, OSDI 2000, pp. 165-180, sections 3.2-3.5",
      "url": "https://static.usenix.org/events/osdi2000/full_papers/strunk/strunk_html/index.html",
      "accessed": "2026-10-19"
    },
    {
      "id": "hesela-backup",
      "title": "Hesela: Backup verification is not a restore test",
      "url": "https://hesela.com/analyses/backup-verification-is-not-a-restore-test/#history-access",
      "accessed": "2026-10-19"
    }
  ]
}