ORC: Increasing Cloud Memory Density via Object Reuse with Capabilities
summary
ORC builds a runtime that reuses immutable binary objects across tenants by using hardware memory capabilities (ARM/CHERI-style) and a new relocation type to create per-tenant state, keeping the trusted computing base small. An untrusted guest loads objects; the monitor only verifies safety. Compared with hypervisor page deduplication (KSM), ORC achieves immediate memory savings with lower CPU overhead: experiments show ORC spawns 143 FFmpeg workers in 11 s vs KSM’s slower, CPU-intensive merging that only reaches ~176 workers after minutes and yields highly variable savings.
AI-written summary · about
chapters (13)
- 0:00ORC project overview
- 0:28Memory duplication in clouds
- 1:55KSM deduplication limits
- 3:41KSM CPU overhead issues
- 5:03Cherry capability isolation
- 6:48Cherry intraprocess isolation
- 7:09ORC object reuse design
- 8:11Sharing immutable objects
- 9:35State isolation in ORC
- 10:39Loading ORC objects
- 11:22Benchmark: ORC vs KSM
- 12:48Performance results
- 14:13Summary
related talks
15mOsprey: Transparent and Efficient Virtual Memory for Secure Computation
15mV-ORAM: A Versatile and Adaptive ORAM Framework with Service Transformation...
19mCoSMIX: A Compiler-based System for Secure Memory Instrumentation and Execution in Enclaves
21mUsing a cloud to manage a cloud
05mORAS: Create and Distribute a Multi-platform Image with Secu...
15mTreebeard: A Scalable and Fault Tolerant ORAM Datastore
16mPatronus: High-Performance and Protective Remote Memory
15mH2O2RAM: A High-Performance Hierarchical Doubly Oblivious RAM