Fact-checked by Grok 2 weeks ago

Remote procedure call

A remote procedure call (RPC) is a that enables a to execute a subroutine or on a remote across a , presenting the interaction to the programmer as if it were a local procedure call by abstracting away the details of network communication, parameter passing, and control transfer. The concept of RPC emerged in the late 1970s as a way to simplify distributed programming, with early discussions appearing in technical literature around 1976. The term "remote procedure call" was coined by Bruce J. Nelson in his 1981 PhD thesis at Carnegie-Mellon University. A foundational implementation was developed in 1983–1984 by Andrew D. Birrell and Bruce J. Nelson at PARC for the programming environment, which ran on computers connected via Ethernet; this system emphasized semantics matching local calls, use of stubs for interface generation, and optimizations for performance and security within a protected network. In 1988, formalized a widely adopted through 1057, defining the Open Network Computing (ONC) RPC protocol 2, which specified message formats using (XDR), support for multiple transports like and , program versioning, and basic authentication mechanisms. RPC systems operate on core principles including and server-side stubs that arguments into messages and unmarshal results, ensuring no shared between caller and callee to maintain . Unlike local procedure calls, which assume reliable, instantaneous execution in the same , RPCs must handle -induced issues such as (often orders of magnitude slower), partial failures, and exceptions for communication errors, without access to the caller's globals or side effects. These mechanisms have made RPC a cornerstone of , facilitating client-server architectures in operating systems, file services, and .

Fundamentals

Definition and Overview

Remote procedure call (RPC) is a that enables a program to execute a subroutine or on a remote as if it were a local call, by suspending the caller, transferring control and parameters across a , executing the remotely, and returning results transparently. This mechanism abstracts the underlying complexities, such as packet transmission, retransmissions, and acknowledgments, allowing programmers to focus on application logic rather than low-level communication details. In distributed computing, RPC plays a central role by facilitating client-server interactions in networked environments, where distributed applications can leverage a familiar procedure call to build scalable systems without explicit handling of inter-machine communication. The core components include the client (the calling program), the (the remote procedure executor), and stub routines: the client stub marshals arguments into network messages and invokes the , while the server stub unmarshals incoming messages and dispatches the call to the actual procedure. A high-level example illustrates RPC's transparency; a local procedure call might appear as result = add(a, b);, and the remote equivalent uses identical syntax, with the client stub handling the network transmission invisibly to the programmer. Unlike direct socket programming, which requires explicit management of byte streams, connections, and data serialization, RPC provides location transparency by mimicking local calls and hiding these details through stubs and runtime support.

Core Principles

Remote procedure calls (RPCs) are designed to provide a level of that allows developers to invoke remote s as if they were local, abstracting away the complexities of . transparency hides the physical or of the from the client, enabling calls without specifying details. Access transparency conceals the differences in representation and communication protocols between client and , ensuring seamless across heterogeneous systems. Failure transparency masks errors such as partitions or crashes, presenting them in a manner similar to local exceptions, while performance transparency aims to mitigate the impact of latency and variability, though it often requires additional mechanisms like caching or retries to approximate local call speeds. At the heart of RPC's abstraction layers are client and server stubs, which serve as intermediaries to handle the distribution details. The client stub packs procedure parameters into a through a known as marshaling, transmitting them to the server, while the server stub unpacks these parameters via unmarshaling before invoking the actual procedure. Conversely, upon completion, the server stub marshals the results, and the client stub unmarshals them for return to the caller. This stub-based approach ensures that the programmer interacts only with familiar local procedure semantics, without direct involvement in communication. Traditional RPC implementations employ synchronous, blocking calls as the default model, where the client suspends execution until the responds, mirroring the behavior of local procedure calls to maintain semantic . This blocking nature simplifies programming but can introduce issues in high-latency networks. Non-blocking or asynchronous variants, where the client continues execution after issuing the call and later retrieves the result via callbacks or polling, address these limitations by improving concurrency and responsiveness, particularly in event-driven or multi-ed applications. To ensure cross-platform compatibility, RPC systems handle data representation through standardized formats that convert machine-dependent data into a neutral, external form. (XDR), for instance, defines a canonical encoding for basic types like integers and strings, independent of host byte order or architecture, allowing parameters to be accurately interpreted on diverse systems during marshaling and unmarshaling. RPC provides semantic guarantees regarding execution to manage the uncertainties of distributed environments, typically adhering to at-most-once semantics where, if a response is received, the procedure has executed exactly once, but retries may result in no execution if failures occur. Achieving exactly-once semantics is challenging due to potential duplicate requests from network issues, often requiring idempotency in procedures or additional state management.

Historical Development

Origins in Early Computing

The development of remote procedure calls (RPC) emerged from the broader context of early in the 1970s, where systems and wide-area networks like highlighted the need for efficient resource sharing across disparate machines. systems, such as and the (CTSS), enabled multiple users to access centralized computing resources interactively, but as connected remote sites starting in 1969, researchers sought mechanisms to extend this sharing beyond local boundaries. The primary motivation was to overcome the limitations of and isolated mainframes by allowing programs on one computer to access data or services on another, fostering collaborative environments in academic and military research funded by . A pivotal early proposal for RPC as a subroutine-level originated in at PARC, where Jim White advanced concepts for remote invocation within the Distributed Programming System () integrated into SRI's . This work built on discussions, including Jack Haverty's 722, which outlined a request-response discipline for network servers, emphasizing synchronous communication to mimic local calls. The motivations centered on simplifying distributed programming in an era of expanding networks, where low-level proved cumbersome; RPC drew inspiration from familiar calls in sequential languages like Mesa (similar to Pascal) and , aiming to provide transparent semantics for parameters, exceptions, and across address spaces. Bruce Jay Nelson's 1981 dissertation further formalized these ideas, evaluating prototypes like Envoy and to demonstrate RPC's efficiency over Ethernet, achieving round-trip times as low as 149 microseconds on high-speed processors. Initial prototypes materialized in the /Mesa environment at PARC, where Birrell and Nelson implemented RPC in 1984 to support networked applications on Dorado workstations. This system generated stubs to handle marshaling and unmarshaling, ensuring at-most-once semantics and integrating with the Mesa language for seamless local-remote transitions, with simple calls completing in about 1 millisecond over Ethernet. The design prioritized ease of use for programmers, abstracting network details like and failure recovery. In the , RPC concepts gained formalization through Xerox's protocol, introduced in 1981 as part of the (), which defined a standardized RPC layer for application protocols like remote filing and over PUP and Ethernet. emphasized type-safe data representation and idempotency, influencing subsequent systems. Concurrently, early UNIX implementations, such as rexec and rsh in 4.2BSD (1983), provided rudimentary RPC-like remote execution, using for command invocation and output return, though lacking advanced features like stubs or encryption. These efforts solidified RPC as a foundational for distributed systems.

Key Milestones and Evolution

The 1980s marked the emergence of standardized RPC implementations that enabled practical distributed computing. Sun Microsystems introduced ONC RPC in 1984 as part of its Network File System (NFS) project, providing a lightweight protocol for remote invocations over UDP or TCP, which became one of the first widely adopted RPC systems in Unix environments. This binary protocol emphasized simplicity and performance, influencing subsequent standards. Building on these foundations, the Open Software Foundation (OSF) released DCE RPC in 1990 as a core component of its Distributed Computing Environment (DCE), offering enhanced features like secure authentication, directory services, and support for heterogeneous networks through an interface definition language (IDL). In the 1990s, RPC evolved toward object-oriented paradigms to support more complex distributed applications. The Object Management Group (OMG) integrated RPC mechanisms into the Common Object Request Broker Architecture (CORBA) with its 1.1 specification in 1991, enabling method invocations on distributed objects across languages and platforms. Similarly, Microsoft extended its Component Object Model (COM) with Distributed COM (DCOM) in 1996, adapting DCE RPC for Windows-based object invocations and facilitating enterprise integration in proprietary ecosystems. The 2000s saw RPC adapt to web-based architectures, shifting from proprietary binary protocols to XML and HTTP for broader interoperability. , proposed by in 1998, introduced a simple XML-over-HTTP format for remote calls, paving the way for web services. This culminated in , standardized by the W3C in 2000 as a protocol for exchanging structured information in web services, supporting RPC-style operations while incorporating and other extensions for enterprise use. Recent developments through 2025 have focused on high-performance, cloud-native RPC suited for . Google open-sourced in 2015, leveraging for multiplexing and for efficient serialization, which has become a staple for low-latency inter-service communication in scalable systems. In the 2020s, cloud providers enhanced RPC support; for instance, added native integration to API Gateway in 2021, enabling serverless RPC deployments with automatic scaling. Overall, RPC has transitioned from binary, platform-specific protocols to HTTP-centric and RESTful alternatives, yet retains prominence in architectures where offers superior efficiency over for internal service meshes.

Operational Mechanics

Message Passing Fundamentals

In remote procedure calls (RPC), communication between client and server relies on an exchange of structured messages that abstract the underlying network transport. The fundamental message types are the request (or call) message and the reply message. A request message contains the procedure identifier—typically a numeric value specifying the remote , , and specific —along with the parameters to be passed to that . These parameters are encoded in a platform-independent format to ensure across heterogeneous systems. The reply message, in turn, carries the procedure's results or an indication of , including any output values generated by the execution. This bidirectional message model mimics local procedure invocation while handling the distributed nature of the interaction. Central to message passing in RPC is the marshaling process, which serializes parameters and results into a byte stream suitable for transmission over the network. Marshaling involves converting machine-specific data representations into a canonical (XDR), a standard defined for ONC RPC that supports both types like integers and strings, as well as types such as arrays, structures, and unions. For instance, an array of structures would be encoded by first serializing the array's length, followed by each element's fields in a defined order, ensuring no padding or issues arise during deserialization on the receiving end. This process, performed by client stubs before sending and by stubs upon receipt, enables transparent handling of data without assumptions. The original RPC emphasized efficient marshaling to minimize overhead, fitting typical messages into single packets where possible. RPC messages are typically transported over reliable protocols like for connection-oriented delivery or for lightweight, datagram-based exchanges, with the choice influencing reliability semantics. Over , messages are framed with length prefixes to delineate records in the byte stream, providing inherent ordering and delivery guarantees. , being connectionless, requires explicit retransmission logic for lost packets, often using timeouts to trigger retries. handling is embedded in the message protocol through status codes in replies; for example, accept errors include codes for program unavailability (1), procedure unavailability (3), invalid arguments (4, e.g., garbage parameters), and system errors (5), while reject errors cover RPC version mismatches (0) or failures (1). Timeouts are managed at the application or , with replies indicating failures like invalid parameters via these codes to inform the client without further negotiation. To support robust operation in unreliable networks, RPC incorporates idempotency considerations, primarily through at-most-once invocation semantics enabled by a (xid) in each message. Clients include the xid in requests and retransmit with the same value if no timely reply is received, allowing servers to detect duplicates via a of recent xids and avoid re-executing non-idempotent procedures that could cause side effects, such as duplicate database updates. While exactly-once semantics are not guaranteed due to potential server crashes or network partitions, this mechanism ensures retries do not amplify errors, with the original RPC design prioritizing exactly-once under normal conditions when a reply is returned.

Sequence of Events in RPC

The sequence of events in a remote procedure call (RPC) begins when a invokes a remote procedure, abstracting the distributed nature of the interaction to resemble a local subroutine call. This relies on client and stubs—automatically generated that handles the low-level details of communication—to maintain for the . The triggers a series of steps involving argument preparation, network transmission, execution on the , and result return, all orchestrated by the RPC . First, the client process makes a local call to the client , passing the name and arguments as if calling a local . The client stub then marshals these arguments—converting them into a network-transmittable format, such as byte streams or packets—along with the procedure specification, ensuring across machines. This marshaled request is packaged into one or more packets and handed to the RPC runtime for transmission over the network to the server's address, which is assumed to be resolved prior to invocation. The client process typically blocks at this point, suspending execution until the response arrives, mimicking synchronous local calls. Upon receipt, the server's RPC delivers the packets to the server stub. The server stub unmarshals the arguments, reconstructing them into the appropriate format for the server's , and then dispatches a local call to the actual server with these parameters. The server executes as a standard local , performing the requested computation without awareness of its remote origin. Once execution completes, the procedure returns its results (including any output parameters or exceptions) to the server stub. The server stub then marshals the results into a reply packet and passes it to the RPC for transmission back across to the client. On the , the RPC receives the reply, and the client unmarshals the results, converting them back into the client's format before returning the value to the invoking process. This resumes the client's execution, delivering the outcome as if from a local procedure. The entire round-trip aims for at-most-once semantics, where the call executes no more than once despite potential network issues. RPC systems must handle exceptions arising from network unreliability, such as lost packets, timeouts, or failures, integrated into the to preserve reliability. If packets are lost during transmission, the RPC runtime detects this via acknowledgments or numbers and initiates retransmissions of the request or reply, ensuring idempotency to avoid duplicate executions. Timeouts occur if no response arrives within a predefined , prompting the client to raise an exception (e.g., a communication ) to the client , similar to how local calls might handle deadlocks. Probe packets may be sent periodically to detect server crashes or network partitions, notifying the client via exceptions without altering the core . These mechanisms do not guarantee exactly-once execution but provide robust detection and recovery.

Binding and Contact Mechanisms

In remote procedure calls (RPC), binding refers to the process of establishing a logical between a client and a , enabling the client to locate and invoke procedures on the remote . This resolves the client's reference to the 's , typically involving the specification of addresses, ports, and identifiers for the target procedure. Binding is essential prior to invocation, as it handles the variability in server locations and configurations across distributed systems. Static binding occurs at compile-time or link-time, where the client's code is resolved to fixed server addresses or ports hardcoded into the application. This approach simplifies development by embedding server details directly, avoiding runtime discovery overhead, but it limits flexibility since changes to server locations require recompilation. In early RPC designs, static binding was favored for environments with stable, known server endpoints. Dynamic binding, in contrast, resolves server details at runtime, allowing clients to discover available servers without prior knowledge of their exact locations. This is achieved through intermediary services that map abstract identifiers to concrete network endpoints. For instance, in the Open Network Computing (ONC) RPC protocol, the rpcbind service (formerly portmapper) operates on well-known TCP/UDP port 111, where servers register their program numbers and versions upon startup, and clients query this port to obtain the corresponding dynamic port assignments for the desired service. This enables transport-independent binding using universal addresses in ASCII string format. Naming services provide a higher-level for dynamic , associating human-readable or hierarchical names with objects or interfaces. In the (CORBA), the Naming Service maintains a of bindings within naming contexts, where clients use operations like bind to object references and resolve to retrieve them by name, supporting nested hierarchies for scalable resolution. Similarly, in the (DCE) RPC, universal unique identifiers (UUIDs) uniquely identify interfaces and optional object endpoints; servers these with an endpoint mapper, which clients query to complete partial bindings lacking endpoint details. Universal Resource Locators (URLs) and Domain Name System (DNS) resolution extend naming services to RPC endpoints by mapping symbolic names to IP addresses and ports, facilitating location transparency in internet-scale deployments. For example, DNS-based service discovery allows clients to resolve RPC server hostnames to addresses dynamically, often combined with port mappers for full endpoint binding. To support scalability and reliability, binding mechanisms incorporate load balancing and failover through multiple server replicas. In DCE RPC, servers can register vectors of endpoints with the mapper, enabling clients to select from available replicas for distributing load or redirecting to healthy instances upon failure. ONC RPC similarly allows multiple registrations under the same program number, permitting clients to query and bind to alternate ports for balanced invocation across replicas. These techniques ensure continued availability without single points of failure in the binding phase.

Implementations and Analogues

Language-Specific Variants

Remote procedure call (RPC) implementations vary across programming languages, often integrating with native syntax, libraries, and tools to facilitate seamless remote invocations while addressing language-specific concerns like type marshalling and generation. These variants typically leverage interface definition languages (IDLs) or built-in mechanisms to handle data , ensuring compatibility within the language ecosystem and, where possible, across languages through standardized encodings. In C and C++, ONC RPC, originally developed by Sun Microsystems, provides a foundational implementation using the rpcgen tool to automate stub generation from interface definitions written in XDR (eXternal Data Representation), a language-agnostic IDL that standardizes type handling for cross-language compatibility by specifying encodings like big-endian integers and padded structures. The rpcgen compiler processes .x files to produce client stubs, server stubs, header files, and XDR routines, enabling developers to write RPC programs as if they were local functions; for example, a simple procedure definition in XDR can generate C code for remote calls over or . This approach emphasizes static compilation for performance, with XDR ensuring portable data representation across heterogeneous systems. Java's Remote Method Invocation (RMI), introduced in JDK 1.1 in 1997, supports RPC through interface-based remote objects, where developers define remote interfaces extending java.rmi.Remote to specify callable methods, and implement them in classes that extend java.rmi.server.UnicastRemoteObject for automatic stub export. The RMI registry, accessed via java.rmi.registry.Registry and LocateRegistry, serves as a naming service for binding and looking up remote objects by name, typically on port 1099, allowing clients to obtain stubs dynamically for method invocation. Java RMI handles type marshalling via object serialization, passing remote references for objects implementing Remote while serializing primitives and non-remote objects by value. Python offers RPC support through standard libraries like xmlrpc.client, which provides a dynamic proxy for invoking methods on XML-RPC servers over HTTP, where ServerProxy creates an object that maps method calls to XML-encoded requests without requiring predefined stubs. For more advanced object-oriented RPC, the third-party Pyro5 library enables dynamic proxies that allow transparent remote access to Python objects, supporting features like method invocation, attribute access, and even callbacks with minimal boilerplate, using serialization for type handling. Pyro5 proxies can be created from URIs or object IDs, facilitating ad-hoc remote calls while handling exceptions and one-way invocations. Go's net/rpc package, part of the , implements RPC using exported methods on objects, where clients dial connections to call procedures synchronously or asynchronously, defaulting to gob encoding for type-safe marshalling. For broader compatibility, the net/rpc/jsonrpc subpackage supports 1.0 over HTTP, allowing clients to send -formatted requests via DialHTTP and integrating with Go's http package for setup using HandleHTTP. This enables cross-language use where handles diverse types like structs and slices, though Go-specific conventions require methods to follow a receiver-arguments-error signature. Differences in type handling across these variants often stem from language-specific IDLs or serialization strategies; for instance, ONC RPC's XDR provides explicit, cross-language type mappings for fixed and variable arrays, while Java RMI relies on JVM serialization for object graphs, and Python's xmlrpc uses XML schemas for basic types, potentially limiting complex structures without extensions like Pyro5's pickle-based serialization. These approaches balance ease of use within the language against , with IDLs like XDR promoting for multi-language environments.

Application and Framework-Specific Uses

In database systems, remote procedure calls facilitate distributed querying and execution across interconnected instances. PostgreSQL's dblink extension enables connections to remote databases, allowing the execution of SQL statements, including calls to stored procedures, as if they were local. For instance, dblink_exec can invoke a remote procedure by passing the procedure call as a SQL command string, supporting and modification across servers. Similarly, uses database links to access objects on remote databases, where procedures are invoked by appending the link name to the procedure identifier, such as procedure_name@dblink, enabling seamless execution of remote logic within local transactions. In web services and architectures, RPC frameworks like Thrift and integrate deeply to handle inter-service communication. Thrift, originally developed by in 2007, provides a scalable, cross-language RPC system for defining and invoking services, emphasizing efficient and transport for high-throughput applications such as backends. , built on , is commonly deployed in service meshes like Istio, where it supports proxyless integration for direct service discovery, traffic routing, and load balancing among , reducing latency in containerized environments. For operating systems, Windows employs the Microsoft Remote Procedure Call (MSRPC) protocol to enable distributed system calls across networked machines. MSRPC extends the standard, allowing client applications to invoke server procedures transparently, as seen in components like for authentication and management tasks. In cloud applications, RPC patterns underpin serverless and container orchestration workflows. functions can be invoked synchronously via protocols, often through API Gateway integrations that translate requests into Lambda execution events, supporting high-performance, event-driven architectures for scalable processing. In , service calls frequently leverage for efficient pod-to-pod communication, with built-in load balancing ensuring even distribution of RPC traffic across replicas to maintain reliability in distributed deployments. A notable case study is Hadoop's use of RPC for high-performance distributed data processing. Hadoop's framework employs a custom RPC layer, based on abstractions like the IPC (Inter-Process Communication) protocol, to coordinate tasks between the NameNode, DataNodes, and client applications, enabling fault-tolerant execution of MapReduce jobs across clusters handling petabyte-scale datasets. This RPC mechanism ensures low-latency communication for metadata operations and data transfers, contributing to Hadoop's scalability in big data environments.

General Architectural Analogues

Remote Procedure Call (RPC) shares architectural similarities with several distributed communication paradigms but differs in its emphasis on synchronous, procedural invocation that mimics local function calls across network boundaries. One key analogue is the model, exemplified by the (CORBA), which extends RPC principles to support . In CORBA, clients invoke operations on remote objects via object references—unique identifiers that encapsulate location and interface details—allowing transparent access similar to RPC stubs but with added support for , polymorphism, and dynamic invocation through an (IDL). Unlike basic RPC, which focuses on stateless procedure calls, CORBA's mediates requests across heterogeneous environments, enabling interoperability among diverse implementations while maintaining request-response semantics. In contrast to RPC's synchronous, tightly coupled nature, (MOM) such as the Java Message Service (JMS) employs an asynchronous, messaging paradigm. RPC requires the caller to block until a response returns, enforcing a direct procedural flow, whereas MOM facilitates one-way through queues or topics, where producers and consumers operate independently without knowledge of each other. For instance, JMS implementations like prioritize bandwidth-efficient pipelining over latency-sensitive responses, making them suitable for loosely coupled systems but diverging from RPC's immediate invocation model. This architectural shift in MOM reduces temporal , as messages persist until processed, unlike RPC's ephemeral request-response exchanges. RPC also contrasts with resource-oriented architectures like Representational State Transfer () over HTTP , where communication revolves around manipulating resources via uniform interfaces rather than executing procedures. In RPC, operations are action-centric, with clients specifying methods and parameters akin to local APIs, often using custom protocols for efficiency. , however, treats services as collections of addressable resources (e.g., URIs representing entities), employing standard HTTP methods (GET, , PUT, DELETE) to perform CRUD operations, which promotes and hypermedia-driven discoverability but can introduce overhead for complex, multi-step procedures compared to RPC's streamlined calls. This resource-focused design in enhances in web-scale environments, while RPC prioritizes performance in procedure-heavy scenarios. Event-driven systems, particularly publish-subscribe (pub-sub) models like those in , further diverge from RPC by emphasizing one-to-many, asynchronous event dissemination over point-to-point invocation. In pub-sub architectures, publishers broadcast events to topics without targeting specific recipients, and subscribers receive notifications based on interests, fostering and reactivity. RPC's synchronous —where sender and receiver synchronize on message boundaries and content—contrasts sharply with pub-sub's push-based, flow, which avoids blocking and supports high-throughput event streams but lacks RPC's direct return values. Kafka's log-based pub-sub, for example, ensures durable event storage and ordered delivery, enabling scalable processing absent in RPC's transient interactions. Hybrid approaches like represent evolutions that blend RPC's procedural efficiency with modern web standards, specifically for transport. maps RPC semantics—defined via for structured, binary —onto 's multiplexing and bidirectional streaming, allowing multiple concurrent calls over a single connection without the head-of-line blocking common in HTTP/1.1-based RPC variants. This integration preserves RPC's method-invocation transparency while leveraging 's header compression and flow control for web-compatible, high-performance distributed services, bridging traditional RPC with REST-like interoperability in cloud-native ecosystems.

Advantages and Limitations

Benefits of RPC

Remote Procedure Call (RPC) offers significant developer by allowing programmers to execute remote operations using syntax identical to local calls, thereby concealing the underlying network intricacies such as message , , and error handling. This simplifies the development of distributed applications, making it as straightforward as conventional and reducing the amount of required for . As noted in the seminal work on RPC implementation, this approach makes distributed computation "easy" by leveraging automatically generated stubs that handle the marshalling and unmarshalling of parameters. RPC enhances in distributed systems by enabling clear separation of client and components through well-defined interfaces, which supports , testing, and scaling of modules. Stub generators facilitate separate of client and , promoting reusable and maintainable architectures without tight between distributed entities. This is particularly beneficial in large-scale systems where components can evolve while maintaining consistent patterns. In terms of performance, RPC is well-suited for fine-grained, synchronous calls, achieving efficiencies close to raw network transmission times—often within a factor of five—by omitting unnecessary protocol layers and optimizing data transfer for procedure-like invocations. RPC supports interoperability across heterogeneous environments via Interface Definition Languages (IDLs), which define procedure signatures in a language-agnostic manner, allowing code generated in one programming language to seamlessly invoke services implemented in another. This capability aids integration in polyglot systems, such as those combining C++, Java, and Python components. In latency-sensitive real-time applications, RPC's low-latency and reliable invocation model enables efficient, high-throughput data exchange.

Challenges and Drawbacks

Remote procedure calls (RPCs) introduce several inherent challenges in distributed systems, primarily stemming from the discrepancies between local and remote execution environments. Unlike local procedure calls, which occur within a single with negligible overhead, RPCs must contend with unpredictability, leading to performance degradation and reliability issues. These drawbacks often necessitate additional mechanisms for mitigation, though they can complicate system design and maintenance. Network latency represents a fundamental limitation of RPCs, as the synchronous nature of most implementations requires clients to block until a response is received, amplifying the impact of round-trip times across potentially unreliable networks. This overhead can be orders of magnitude higher than local calls; for instance, early RPC systems reported remote invocations taking up to 20 times longer than local ones due to parameter marshaling, transmission delays, and unmarshaling. Message losses, reordering, and variable delays further exacerbate this, often requiring acknowledgments and timeouts that add to the effective latency. Partial failure handling poses significant challenges in RPC systems, where detecting and recovering from remote crashes or network partitions is nontrivial. Server failures can result in lost state, such as open file handles, leaving clients in inconsistent states without clear mechanisms for . Moreover, client crashes may create "orphans"—ongoing computations that consume resources without completion—violating desired semantics like at-most-once . Distinguishing between slow servers and outright failures often relies on heuristics like periodic pings, but these can lead to false positives or prolonged hangs, complicating in heterogeneous environments. Scalability limits arise from the tight between client and server interfaces in RPC designs, which hinder scaling in large distributed systems. Traditional RPCs support only point-to-point communication, lacking native or broadcast capabilities despite underlying network hardware support, thus restricting efficient to multiple recipients. Server-side for active calls can also performance, with early implementations capping call rates at less than one per second per machine to avoid overload. Modern variants like incorporate load balancers and to improve for high-throughput scenarios. Versioning problems in RPC interfaces stem from the evolution of procedures and data types, often requiring coordinated updates across clients and servers to avoid breaking changes. In heterogeneous systems, varying parameter types and counts—particularly in languages like C—complicate marshaling, while persistent data formats demand translation for backward compatibility. Implementations like SunRPC use version numbers in identifiers to manage this, but mismatches can lead to runtime failures or require complex proxy layers, increasing deployment overhead. Debugging RPC-based applications is particularly arduous due to the of boundaries, which obscures the flow of control and data across distributed components. Tracing issues requires specialized tools to monitor stubs, bindings, and message exchanges, as global variables, pointers, and exceptions behave differently remotely, often resulting in opaque errors like unexpected messages or incomplete traces. The physical separation of machines further demands remote interfaces, such as decentralized or abstract layers, to and inspect executions without disrupting unrelated processes, yet these add significant complexity.

Security and Modern Considerations

Security Vulnerabilities

Remote procedure call (RPC) systems, particularly early implementations like ONC RPC, suffer from significant authentication weaknesses that expose them to spoofing attacks. The original ONC RPC protocol provided limited authentication flavors, such as AUTH_NONE, which offers no identity verification and allows any caller to impersonate legitimate users without detection. AUTH_SYS, the default for many systems, relies on easily forged UNIX-style credentials transmitted in plaintext, enabling attackers to spoof user identities and gain unauthorized access to procedures. Additionally, AUTH_DH employs a flawed Diffie-Hellman key exchange with a small prime modulus, making it susceptible to cryptographic attacks that compromise shared secrets and facilitate impersonation. These deficiencies stem from the protocol's design priorities on simplicity over security, as outlined in its foundational specification. Authorization and access control in RPC introduce further risks, where insufficient verification of caller privileges can result in . In RPC frameworks, procedures often execute with varying levels of system privileges, but without robust checks, an authenticated but low-privilege caller can invoke high-privilege operations, such as or configuration changes. For instance, in large-scale RPC services, misconfigured s have allowed escalation from user-level to administrative privileges by exploiting unverified procedure invocations. Automated analysis tools have identified such vulnerabilities in production RPC systems, highlighting how incomplete logic amplifies the impact of initial breaches. Network exposure compounds these issues, as RPC communications typically occur over unencrypted or channels, rendering them vulnerable to and man-in-the-middle (MITM) attacks. In ONC RPC, message payloads—including sensitive parameters and responses—are sent in , allowing attackers to intercept and inspect or alter it undetected to inject malicious content. This lack of and is inherent to the protocol's , which defers to higher layers but often leaves it unimplemented in practice. Denial-of-service (DoS) attacks exploit RPC's resource-intensive nature, leading to amplification effects or exhaustion through crafted calls. Recursive or deeply nested procedure invocations can trigger unbounded computation or memory allocation on the server, consuming CPU and RAM until services become unresponsive; without recursion limits, a single malicious call can amplify into widespread disruption. Resource exhaustion also arises from flooding endpoints with high-volume requests, overwhelming port mappers or endpoint handlers in protocols like ONC RPC, where stateless UDP support exacerbates the issue by enabling spoofed packets without connection overhead. Historical exploits underscore these vulnerabilities, notably in Microsoft RPC (MSRPC) during the early 2000s. The MS03-026 in the DCOM interface allowed remote unauthenticated attackers to execute arbitrary code by sending malformed RPC requests to ports like 135 or 445, leading to full system compromise and widespread worm propagation, such as the Blaster worm that infected hundreds of thousands of machines in 2003. Similar s in MSRPC components, like the Server service, enabled code execution or crashes, demonstrating how implementation flaws in authentication and parsing amplified network-based risks.

Best Practices and Contemporary Adaptations

To ensure in RPC systems, via TLS/SSL is a fundamental practice, particularly in protocols like , which supports and recommends TLS for production connections to protect from interception or tampering. Authentication mechanisms such as and JWT tokens further enhance security by verifying client identities before granting access to RPC endpoints, allowing fine-grained in distributed environments. For resilience against network failures, implementing idempotency in RPC operations is essential; this involves assigning unique identifiers to requests, ensuring that retries produce the same outcome without unintended side effects, such as duplicate processing in payment systems. Retry strategies complement this by exponentially backing off after failures, while circuit breakers prevent cascading issues by halting calls to unresponsive services until recovery is detected, thereby maintaining overall system stability. In cloud-based deployments, API gateways serve as proxies for RPC traffic, enabling centralized monitoring of call volumes, , and error rates, while enforcing to mitigate abuse and ensure resource fairness across services. Contemporary adaptations of RPC as of 2025 emphasize serverless architectures integrated with , where functions execute RPC calls closer to users for reduced in real-time applications like , supported by platforms that abstract infrastructure management. Additionally, enables browser-based RPC invocations through protocols like gRPC-Web, allowing client-side code to directly call server procedures without plugins, enhancing performance in web applications via compiled modules that interface seamlessly with transports. In 2025, ongoing security challenges in RPC were highlighted by vulnerabilities in Windows RPC implementations, including the Win-DoS epidemic (disclosed August 2025), which exploited RPC for and DDoS attacks via public domain controllers, and authentication coercion techniques targeting obscure RPC interfaces (November 2025). Microsoft responded with patches like KB5066014 for CVE-2025-49716, hardening Netlogon RPC against unauthenticated calls and tightening access controls to prevent spoofing and . These incidents underscore the continued need for protocol updates, such as enhanced and in modern RPC variants. Best practices for long-term maintainability include interface versioning, where new RPC methods are added without breaking existing contracts—often by appending version suffixes to service definitions—facilitating gradual client upgrades in ecosystems. For , tools like are widely used to collect RPC-specific metrics, such as request counts and durations, exposing them via standardized endpoints for alerting and visualization in systems like .

References

  1. [1]
    [PDF] Implementing Remote Procedure Calls - Bitsavers.org
    Abstract: Remote procedure calls (RPe) appear to be a useful paradigm for providing communication across a network between programs written ...
  2. [2]
    RFC 1057: RPC: Remote Procedure Call Protocol specification: Version 2
    ### Summary of RFC 1057: Remote Procedure Call Protocol Specification Version 2
  3. [3]
    [PDF] Implementing Remote Procedure Calls - Washington
    This paper describes a package providing a remote procedure call facility, the options that face the designer of such a package, and the decisions ~we made.
  4. [4]
    [PDF] Remote Procedure Call - NYU Computer Science
    May 9, 1981 · Remote procedure call is the synchronous language-level transfer of control between programs in disjoint address spaces whose primary ...
  5. [5]
    Networking, RPC, and Sharding - Brown Computer Science
    Remote Procedure Call (RPC)​​ Using network connections and sockets directly involves programming against a byte stream abstraction. Both the server and the ...
  6. [6]
    [PDF] Distributed Systems
    Transparency has several dimensions. Page 19. Types of Transparency ... location of resource (no effect on access). Replication. Hide the possibility that ...
  7. [7]
    [PDF] Implementing Remote Procedure Calls
    Remote procedure calls (RPC) appear to be a useful paradig m for providing communication across a network between programs written in a high-level language.Missing: core transparency marshaling
  8. [8]
    Core concepts, architecture and lifecycle - gRPC
    Nov 12, 2024 · On the other hand, networks are inherently asynchronous and in many scenarios it's useful to be able to start RPCs without blocking the current ...
  9. [9]
    RFC 1014 - XDR: External Data Representation standard
    XDR is a standard for the description and encoding of data. It is useful for transferring data between different computer architectures.
  10. [10]
    [PDF] A History of the ARPANET: The First Decade - DTIC
    Apr 1, 1981 · system, Air Line reservations systems, and time-sharing systems). However, there had been only a very small number of attempts to connect ...
  11. [11]
    [PPT] Remote Procedure Calls - Cornell: Computer Science
    Error handling: special network cases; Performance: two orders of magnitude slower than local procedure calls. ONC RPC (RFC 1831). Binding independent. Language ...Missing: failure | Show results with:failure
  12. [12]
    [PDF] Distributed Object Computing With CORBA
    In 1991 the OMG published revision 1.1 of the Common Object Request Broker Architecture (CORBA) specification, a concrete description of the interfaces and ...
  13. [13]
    DaveNet : RPC over HTTP via XML - Scripting News
    RPC over HTTP via XML. Friday, February 27, 1998 by Dave Winer. Good morning! Today I'm writing this DaveNet piece with WordPad.
  14. [14]
    Simple Object Access Protocol (SOAP) 1.1 - W3C
    May 8, 2000 · SOAP is a lightweight protocol for exchange of information in a decentralized, distributed environment. It is an XML based protocol that consists of three ...
  15. [15]
    Introducing gRPC, a new open source HTTP/2 RPC Framework
    Feb 26, 2015 · We are open sourcing gRPC, a brand new framework for handling remote procedure calls. It's BSD licensed, based on the recently finalized HTTP/2 standard.Missing: announcement | Show results with:announcement
  16. [16]
    Beyond REST: alternative API architectures | CS 484
    RPC approaches are often used in systems that require low latency and high performance, such as real-time applications or microservice architectures. By ...
  17. [17]
    RFC 5531 - RPC: Remote Procedure Call Protocol Specification ...
    This document describes the Open Network Computing (ONC) Remote Procedure Call (RPC) version 2 protocol as it is currently deployed and accepted.
  18. [18]
  19. [19]
    Implementing remote procedure calls - ACM Digital Library
    A survey of remote procedure calls. The Remote Procedure Call (RPC) is a popular paradigm for inter-process communication (IPC) between processes in different ...
  20. [20]
    Remote Procedure Call
    If the procedure has OUT parameters or return values, these are then marshaled by the server stub, transmitted back to the client and unmarshaled there. The ...
  21. [21]
    RFC 1833: Binding Protocols for ONC RPC Version 2
    ### Summary of RPC Binding Mechanisms, Portmapper, Port 111, and Dynamic Binding in ONC RPC (RFC 1833)
  22. [22]
    [PDF] Naming Service Specification - Object Management Group
    A name binding is always defined relative to a naming context. A naming context is an object that contains a set of name bindings in which each name is unique.
  23. [23]
    DCE 1.1: Remote Procedure Call - Introduction to the RPC API
    A remote procedure call requires a remote binding. The calling client must bind to a server that offers the interface it wants, and the client's local procedure ...
  24. [24]
    DCE 1.1: Remote Procedure Call - Interface Definition Language
    The Interface Definition Language (IDL) is a language for specifying operations (procedures or functions), parameters to these operations, and data types.<|control11|><|separator|>
  25. [25]
    rpcgen Programming Guide - ONC+ Developer's Guide
    This section introduces the rpcgen tool and provides a tutorial with code examples and usage of the available compile-time flags. See Glossary for the ...Missing: ONC C++
  26. [26]
    Remote Procedure Calls - OMSCS Notes
    SunRPC uses an IDL called eXternal Data Representation (XDR). XDR is a different specification from any programming language. An RPC system can also use an IDL ...RPC Requirements · Steps in RPC · SunRPC XDR Example · Compiling XDRMissing: explanation | Show results with:explanation
  27. [27]
    [PDF] Java™ Remote Method Invocation Specification - Sunsite ICM
    The RMI system is easily extensible and maintainable. Revision 1.41, JDK 1.1.1, March 24, 1997. Page 2. Copyright ...
  28. [28]
    Implementing a Remote Interface (The Java™ Tutorials > RMI)
    The java.rmi.registry.Registry remote interface is the API for binding (or registering) and looking up remote objects in the registry. The java.rmi.registry.
  29. [29]
    xmlrpc.client — XML-RPC client access — Python 3.14.0 ...
    This module supports writing XML-RPC client code; it handles all the details of translating between conformable Python objects and XML on the wire.Missing: dynamic | Show results with:dynamic
  30. [30]
    Debian -- Details of package python3-pyro5 in sid
    Pyro simplifies a lot the creation of clients and servers, and has among its features: - dynamic and static proxies for all remote method invocations, - a ...
  31. [31]
    net/rpc - Go Packages
    Documentation ¶. Overview ¶. Package rpc provides access to the exported methods of an object across a network or other I/O connection.Documentation · Overview · Functions · Types
  32. [32]
    Documentation: 18: dblink_exec - PostgreSQL
    dblink_exec executes a command (that is, any SQL statement that doesn't return rows) in a remote database. When two text arguments are given, the first one is ...
  33. [33]
    SQL Language Reference
    ### Summary: Using Database Links for Remote Procedure Calls in Oracle
  34. [34]
    [PDF] Thrift: Scalable Cross-Language Services Implementation
    Apr 1, 2007 · Thrift is a software library and set of code-generation tools devel- oped at Facebook to expedite development and implementation of efficient ...
  35. [35]
    gRPC Proxyless Service Mesh - Istio
    Istio 1.11 adds experimental support for adding gRPC services directly to the mesh. We support basic service discovery, some VirtualService based traffic ...
  36. [36]
    Remote procedure call (RPC) - Win32 apps | Microsoft Learn
    Feb 7, 2022 · Microsoft Remote Procedure Call (RPC) defines a powerful technology for creating distributed client/server programs.
  37. [37]
    The versatility of gRPC, an open source high-performance RPC ...
    Nov 19, 2020 · gRPC is an emerging open source protocol and a successor to HTTP designed to focus around the contract between applications and to let other protocols handle ...
  38. [38]
    gRPC Load Balancing on Kubernetes without Tears
    Nov 7, 2018 · In this blog post, we describe why this happens, and how you can easily fix it by adding gRPC load balancing to any Kubernetes app with Linkerd.Missing: failover binding
  39. [39]
    HDFS Architecture Guide - Apache Hadoop
    HDFS is a distributed file system designed to run on commodity hardware. It has many similarities with existing distributed file systems.
  40. [40]
    [PDF] The Common Object Request Broker: Architecture and Specification
    CORBA is designed to support different object mechanisms, and it does so by structuring the ORB with components above the ORB Core, which pro- vide interfaces ...
  41. [41]
    Messaging Concepts
    ### Comparison of ActiveMQ and RPC
  42. [42]
    Chapter 1 Messaging Systems: An Introduction
    They are different in that RPC- and ORB-based middleware create systems of tightly-coupled components, whereas MOM-based systems allow for a looser coupling of ...
  43. [43]
    What's the Difference Between RPC and REST? - Nordic APIs
    Mar 22, 2022 · The most fundamental difference between RPC and REST is that RPC was designed for actions, while REST is resource-centric. RPC executes ...What Is Rpc? · What Is Rest? · Understanding The...<|separator|>
  44. [44]
    Comparing SOAP vs REST vs GraphQL vs RPC API - AltexSoft
    May 29, 2020 · REST is based on the resource or noun instead of action or verb-based. In REST, things are done using HTTP methods such as GET, POST, PUT, ...
  45. [45]
    Event-Driven Architecture and Pub/Sub Pattern Explained - AltexSoft
    Jun 29, 2021 · In this article, we're going to talk about event-driven architecture (EDA) and its most commonly used messaging pattern: publish/subscribe (pub/sub).Missing: RPC | Show results with:RPC
  46. [46]
    [PDF] The Many Faces of Publish/Subscribe
    As shown in Figure 4, RPC differs from publish/subscribe in terms of coupling: the synchronous nature of RPC introduces a strong time, syn- chronization (on ...
  47. [47]
    Introduction to gRPC
    ### Summary: How gRPC Blends RPC with HTTP/2 Web Standards
  48. [48]
    [PDF] Implementing Remote Procedure Calls
    Implementing Remote Procedure Calls. Andrew Birrell & Bruce Nelson 1984. • Andrew Birrell known for Grapevine (1981), with first distributed naming system ...
  49. [49]
    What is Remote Procedure Call (RPC)? | Definition from TechTarget
    May 13, 2024 · RPC is commonly used to build and interact with distributed systems. RPC enables a program to call a subroutine on a different computer without ...What Does Rpc Do? · How Does Rpc Work? · Pros And Cons Of Rpc
  50. [50]
    Bridge the gap between gRPC and REST HTTP APIs - Google Cloud
    Aug 14, 2024 · In this environment, gRPC has emerged as a high-performance communication protocol and is widely adopted for its low latency, efficient ...
  51. [51]
    5.3 Remote Procedure Call — Computer Networks
    While the RPC concept is simple, there are two main problems that make it more complicated than local procedure calls: The network between the calling process ...5.3. 1 Rpc Fundamentals · Overcoming Network... · Sunrpc
  52. [52]
    [PDF] Remote Procedure Call: Limitations and Drawbacks
    In this paper we discuss problems with Remote Procedure Call (RPC) in the area of the concept of the model itself, technical problems with its implementation, ...
  53. [53]
    Overview of RPC Debugging - Windows drivers - Microsoft Learn
    Dec 5, 2024 · RPC debugging is difficult because it hides network calls. Tools like DbgRpc and debugger extensions are used, and state information can be ...
  54. [54]
    RFC 2695 - Authentication Mechanisms for ONC RPC
    Other secure authentication mechanisms need to be developed for ONC RPC. RFC 2203 describes the RPCSEC_GSS ONC RPC security flavor, a secure authentication ...
  55. [55]
    Privilege-Escalation Vulnerability Discovery for Large-scale RPC ...
    Jun 4, 2021 · From a security perspective, the blast radius of RPCs is worryingly big since each RPC often interacts with tens of internal system components.
  56. [56]
    Microsoft Security Bulletin MS03-026 - Critical
    ### Summary of MS03-026 Vulnerability in MSRPC
  57. [57]
    What is gRPC and How Does it Enhance API Security?
    Dec 13, 2024 · gRPC (Google Remote Procedure Call) is a high-performance framework for building distributed systems and APIs, using HTTP/2 and Protocol ...
  58. [58]
    What is gRPC? Use Cases and Benefits - Kong Inc.
    Apr 26, 2024 · gRPC is RPC-based and uses HTTP/2 as its transport layer protocol for communication. Being RPC-based, clients can call any service method of the ...
  59. [59]
    Authentication - gRPC
    Jan 12, 2024 · An overview of gRPC authentication, including built-in auth mechanisms, and how to plug in your own authentication systems.Authentication · Additional Examples · Extending Grpc To Support...
  60. [60]
    Securing Java gRPC services with JWT-based authentication
    Jun 21, 2019 · In this tutorial, we are going to create a gRPC server and secure it with JWT-based authentication. Boost Your Team with TeamPulse.3. Gprc Server · 5. Authorization · 5.1. Server Security
  61. [61]
    Implementing Retry with Resilience4j - Reflectoring
    Jul 16, 2020 · If we want to apply retries, the operation must be idempotent. Suppose the remote service received and processed our request, but an issue ...
  62. [62]
    Downstream Resiliency: The Timeout, Retry, and Circuit-Breaker ...
    Dec 2, 2024 · This article will dive into downstream resiliency and how timeouts, retries, and circuit breakers work together.Missing: RPC idempotency
  63. [63]
    How to Build Resilient Backend Systems with Circuit Breakers ...
    Sep 8, 2025 · How to Build Resilient Backend Systems with Circuit Breakers, Exponential Backoff, Rate Limiting, and Idempotency Keys. View profile for SURAJ ...
  64. [64]
    How API Gateways Handle gRPC Requests - API7.ai
    Apr 25, 2025 · This article explores how modern API gateways process, route, and manage gRPC traffic, what challenges they face, and what best practices developers should ...
  65. [65]
    What Is an API Gateway? - Palo Alto Networks
    The API gateway also provides additional functionality, such as authentication, authorization, rate limiting, caching, and monitoring. By centralizing these ...Missing: RPC | Show results with:RPC
  66. [66]
    Why do microservices need an API gateway? - Tyk.io
    Apr 10, 2023 · You can use it not just for routing but for rate limiting, access quota management, caching, security and more. You can also use it for ...How An Api Gateway Works In... · The Benefits Of A... · Prevents Exposing Internal...<|separator|>
  67. [67]
    Serverless Edge Computing: A Taxonomy, Systematic Literature ...
    Feb 16, 2025 · The review identifies the essential features of serverless edge computing, focusing on architectural designs, QoS metrics, implementation ...
  68. [68]
    5 Serverless Computing Trends in 2025 - Rent a Mac in the Cloud
    Apr 15, 2025 · Discover key serverless computing trends, from AI integration to edge computing, driving scalability, cost-efficiency, and innovation.Missing: RPC | Show results with:RPC
  69. [69]
    transitioning microservices to WebAssembly(Wasm) via RPC.
    Nov 19, 2019 · In the next section we are going to show you how to: Write custom Rust code and compile to Wasm; Set up a Remote Procedure Call (RPC) server ...Missing: integration | Show results with:integration
  70. [70]
    Remote-procedure call (RPC) - Workers - Cloudflare Docs
    Sep 23, 2025 · The RPC system is designed to feel as similar as possible to calling a JavaScript function in the same Worker.
  71. [71]
    Using gRPC-Web with Blazor WebAssembly - Steve Sanderson
    Jan 15, 2020 · gRPC-Web is an extension to gRPC which makes it compatible with browser-based code (technically, it's a way of doing gRPC over HTTP/1.1 requests).Missing: integration | Show results with:integration
  72. [72]
    RpcInterface - iTwin.js
    Jun 11, 2025 · See below for more on interface versioning. The definition class must be in a directory or package that is accessible to both frontend and ...
  73. [73]
    Versioning in APIs: Best Practices - API7.ai
    Mar 25, 2025 · This article explores the importance of API versioning, examines common strategies, and provides best practices to help developers and API gateway users.Missing: RPC | Show results with:RPC
  74. [74]
    Prometheus monitoring for your gRPC Go servers. - GitHub
    Apr 18, 2023 · Prometheus monitoring for your gRPC Go servers and clients. A sister implementation for gRPC Java (same metrics, same semantics) is in grpc-ecosystem/java-grpc ...(deprecated) Go Grpc... · Metrics · Useful Query Examples
  75. [75]
    Metrics Monitoring - Apache Dubbo
    Dubbo supports the collection of runtime Metrics indicators and their integration with Prometheus and Grafana systems to achieve visual monitoring of ...How To Run · Run Server · Deploy To Local