[Paper Review] Towards Practical Oblivious RAM

Emil Stefanov, Elaine Shi+1 more|arXiv (Cornell University)|Jun 18, 2011

Cryptography and Data SecurityComputer Science9 references150 citations

TL;DR

This paper presents a practical Oblivious RAM (O-RAM) construction that achieves an amortized overhead of 20–35×, up to 63× faster than the prior best scheme, by introducing a novel partitioning technique: dividing the O-RAM into smaller, independently managed partitions and using a background eviction mechanism to obliviously shuffle blocks across server-side partitions. The method reduces client storage to a minimal constant fraction of O-RAM capacity while maintaining sub-linear worst-case cost and constant round-trip latency.

ABSTRACT

We take an important step forward in making Oblivious RAM (O-RAM) practical. We propose an O-RAM construction achieving an amortized overhead of 20X-35X (for an O-RAM roughly 1 terabyte in size), about 63 times faster than the best existing scheme. On the theoretic front, we propose a fundamentally novel technique for constructing Oblivious RAMs: specifically, we partition a bigger O-RAM into smaller O-RAMs, and employ a background eviction technique to obliviously evict blocks from the client-side cache into a randomly assigned server-side partition. This novel technique is the key to achieving the gains in practical performance.

Motivation & Objective

• To address the long-standing practicality gap in Oblivious RAM (O-RAM) despite strong theoretical guarantees.
• To reduce the high amortized and worst-case overheads of existing O-RAM schemes, which currently exceed 1,400× in practical settings.
• To design a construction that enables efficient, private data access in cloud storage with minimal client-side storage and low latency.
• To explore a novel recursive partitioning technique that enables both practical and theoretical O-RAM constructions with improved asymptotic and practical performance.

Proposed method

• The core method partitions a large O-RAM of size $N$ blocks into $P$ smaller O-RAMs, each of size $\sqrt{N} + \epsilon$ blocks, to enable localized, efficient management.
• A background eviction process obliviously migrates blocks from client-side cache to randomly assigned server-side partitions, ensuring access patterns remain hidden.
• Each block is assigned a unique alias using a pseudo-random function (PRF) based on its partition and level, allowing the client to retrieve blocks without revealing their real identities.
• The position map is compressed using entropy-based encoding and bit-packing techniques, reducing average storage per block to 0.255 bytes.
• Matrix-based compression using a shared Vandermonde matrix reduces bandwidth by 2× during uploads by transmitting only $k$ coefficients for $2k$ blocks (half real, half dummy).
• Recursive application of the practical construction yields a theoretical O-RAM variant with $O((\log N)^2)$ amortized and worst-case cost, using $O(\sqrt{N})$ client storage.

Experimental results

Research questions

• RQ1 Can a practical O-RAM construction be designed with significantly lower overhead than existing schemes, particularly in real-world cloud storage settings?
• RQ2 How can client-side storage be minimized while maintaining strong privacy guarantees and low latency in O-RAM systems?
• RQ3 Can a novel partitioning and eviction mechanism improve both performance and privacy in O-RAM, especially under realistic data sizes (e.g., terabytes)?
• RQ4 What is the theoretical and practical trade-off between client storage, server storage, and performance in O-RAM constructions?

Key findings

• The practical O-RAM construction achieves an amortized overhead of 20–35×, representing a 63× improvement over the best prior scheme under typical configurations.
• The worst-case cost is sub-linear at $<3\sqrt{N}+o(\sqrt{N})$, significantly improving upon previous schemes with $O(N\log N)$ worst-case bounds.
• Client-side storage is reduced to a very small fraction—0.01% to 0.3% of O-RAM capacity—making it comparable to $\sqrt{N}$ in realistic deployments.
• Server-side storage is empirically bounded at less than $3.2N$ blocks, despite theoretical upper bounds of $4N+o(N)$, due to efficient eviction and dynamic memory usage.
• Matrix compression using a shared Vandermonde matrix enables 2× bandwidth reduction during uploads without compromising privacy.
• Recursive application of the practical construction yields a theoretical O-RAM with $O((\log N)^2)$ amortized and worst-case cost, using only $O(\sqrt{N})$ client storage.