self-securing-storage · research

Self-securing storage

Self-securing storage retains version history and audit records behind a storage-side security boundary that distrusts client operating systems.

Related Observatory article: Self-securing storage on hesela.com

The S4 research prototype keeps earlier states for a bounded detection window. Compromising a client does not itself bypass that boundary, but privileged storage administration remains a separate trust assumption. [1]

Historical reads need access control: recovering deleted versions can also reveal previously removed sensitive information. Version retention protects recoverability, not secrecy from every authorized history reader. [1]

Relations

related

Air-gapped backup, Storage immutability, Object versioning, Backup verification

Limitations

• This historical architecture is not a certification of current backup products.

Citations

1. Strunk et al.: Self-Securing Storage, OSDI 2000, pp. 165-180, sections 3.2-3.5 (accessed 2026-10-19)

Further reading

2. Hesela: Backup verification is not a restore test (accessed 2026-10-19)

JSON: /data/terms/self-securing-storage.json