GPU powered batch policy matching speeds up rule processing
BitPCE: Batched Multi-Dimensional PolicyResolution with GPU Bitmap Algebra
Distributed, Parallel, and Cluster ComputingCryptography and Security
Summary
Matching workloads to rules often requires checking many labels and rules, which can be slow and complicated. The authors study this challenge and create BitPCE, a method that runs on GPUs to quickly find which workloads match which rules in batches. They use smart techniques like caching and dependency tracking to avoid doing the same work repeatedly. Their method runs faster than CPU-only solutions, especially when handling large batches and many labels, but small or sparse cases might still favor CPUs.
What this means in practice
- •For cloud network operators: Accelerate multi-dimensional policy rule evaluation for real-time network workload management with reduced latency.
- •For data center infrastructure teams: Optimize batch processing of label-based access policies across thousands of workloads using GPU-enabled set operations.
Authors
Shengwei Wang
Abstract
Policy controllers must determine which workloads match rules spanning several label dimensions. Hash sets, compressed bitmaps, and GPU set-processing primitives address the underlying set operations. However, intermediate results, repeated scope evaluations, dependent policy updates, and host transfers can dominate the cost of a heterogeneous batch. We study this problem as batched intersection-of-unions (IoU). Our design exploits independent scope--word tasks, reusable endpoint expressions, and policy dependencies. The challenges are preserving wildcard, empty-group, and exclusion semantics, recognizing equal scopes, and retaining unchanged recipients affected by source edits. BitPCE addresses them with register-resident GPU evaluation, canonical scope compilation, and dependency-complete candidate selection under a stated rendering contract. IP-only changes reuse cached memberships. We establish correctness and word-work bounds. On a four-vCPU A10G host, resident GPU execution is 3.46--36.60$\times$ faster than the best tested native CPU path, including CRoaring, and 1.14--2.22$\times$ faster than an adapted operand-parallel GPU reduction. Gains narrow at the host-output boundary: on an eight-vCPU host, including upload and compact identifier output, resolution takes 16.3 ms versus 19.3 ms for CPU at 100K objects and 500 scopes. Sparse labels and small batches can favor CPU execution. Scope reuse, candidate selection, and incremental transfers are measured as components; complete update-to-enforcement latency remains unevaluated.