Does Fully Homomorphic Encryption Need Compute Acceleration?

Castro, Leo de; Agrawal, Rashmi; Yazicigil, Rabia Tugce; Chandrakasan, Anantha P.; Vaikuntanathan, Vinod; Juvekar, Chiraag; Joshi, Ajay

doi:10.48550/arxiv.2112.06396

Cited by 6 publications

(7 citation statements)

References 22 publications

(70 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In contrast, prior FHE processors that supported bootstrapping of second-generation schemes were often bottlenecked by the required memory bandwidth [37,52]. In fact, a recent architectural analysis of bootstrapping [16] found that it exhibits low arithmetic intensity and requires large caches. Their conclusion was that FHE processors only benefit marginally from bespoke high-throughput arithmetic units.…”

Section: Batch Bootstrappingmentioning

confidence: 99%

See 1 more Smart Citation

FPT: A Fixed-Point Accelerator for Torus Fully Homomorphic Encryption

Van Beirendonck,

D'Anvers,

Turan

et al. 2023

Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Fully Homomorphic Encryption is a technique that allows computation on encrypted data. It has the potential to drastically change privacy considerations in the cloud, but high computational and memory overheads are preventing its broad adoption. TFHE is a promising Torus-based FHE scheme that heavily relies on bootstrapping, the noise-removal tool that must be invoked after every encrypted gate computation.We present FPT, a Fixed-Point FPGA accelerator for TFHE bootstrapping. FPT is the first hardware accelerator to heavily exploit the inherent noise present in FHE calculations. Instead of double or single-precision floating-point arithmetic, it implements TFHE bootstrapping entirely with approximate fixed-point arithmetic. Using an in-depth analysis of noise propagation in bootstrapping FFT computations, FPT is able to use noise-trimmed fixed-point representations that are up to 50% smaller than prior implementations using floating-point or integer FFTs.FPT's microarchitecture is built as a streaming processor inspired by traditional streaming DSPs: it instantiates high-throughput computational stages that are directly cascaded, with simplified control logic and routing networks. We explore different throughputbalanced compositions of streaming kernels with a user-configurable streaming width in order to construct a full bootstrapping pipeline. FPT's streaming approach allows 100% utilization of arithmetic units and requires only small bootstrapping key caches, enabling an entirely compute-bound bootstrapping throughput of 1 BS / 35𝜇s. This is in stark contrast to the established classical CPU approach to FHE bootstrapping acceleration, which tends to be heavily memory and bandwidth-constrained.FPT is fully implemented and evaluated as a bootstrapping FPGA kernel for an Alveo U280 datacenter accelerator card. FPT achieves almost three orders of magnitude higher bootstrapping throughput than existing CPU-based implementations, and 2.5× higher throughput compared to recent ASIC emulation experiments.

show abstract

Section: Batch Bootstrappingmentioning

confidence: 99%

“…These schemes require bootstrapping only after a certain number of operations. For these schemes, bootstrapping is a complex algorithm that requires large data caches [16] and exhibits low arithmetic intensity, and essentially all prior architectures that support bootstrapping have hit the off-chip memory-bandwidth wall [37,52].…”

Section: Introductionmentioning

confidence: 99%

FPT: A Fixed-Point Accelerator for Torus Fully Homomorphic Encryption

Van Beirendonck,

D'Anvers,

Turan

et al. 2023

Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…Prior work has identified that HE ops have very low arithmetic intensity and are bounded by off-chip memory bandwidth [26], [45], [72]. Even a simple HE op, such as HMult, has a working set including several ciphertexts and an evk, which amounts to several hundreds of MBs.…”

Section: A Limitations Of Prior He Acceleratorsmentioning

confidence: 99%

“…BACKGROUND We explain the pertinent details of HE with an emphasis on CKKS. We adopt notations and terminologies from [26], [34]. Parameters and notations are summarized in Table I.…”

Section: Introductionmentioning

confidence: 99%

ARK: Fully Homomorphic Encryption Accelerator with Runtime Data Generation and Inter-Operation Key Reuse

Kim¹,

Lee²,

Kim³

et al. 2022

Preprint

View full text Add to dashboard Cite

Homomorphic Encryption (HE) is one of the most promising post-quantum cryptographic schemes which enable privacy-preserving computation on servers. However, noise accumulates as we perform operations on HE-encrypted data, restricting the number of possible operations. Fully HE (FHE) removes this restriction by introducing the bootstrapping operation, which refreshes the data; however, FHE schemes are highly memory-bound. Bootstrapping, in particular, requires loading GBs of evaluation keys and plaintexts from off-chip memory, which makes FHE acceleration fundamentally bottlenecked by the off-chip memory bandwidth.We propose ARK, an Accelerator for FHE with Runtime data generation and inter-operation Key reuse. ARK enables practical FHE workloads with a novel algorithm-hardware codesign to accelerate bootstrapping. We first eliminate the off-chip memory bandwidth bottleneck through runtime data generation and inter-operation key reuse. This approach enables ARK to fully exploit on-chip memory by a substantial reduction in the working set size. On top of such algorithmic innovations, we build ARK microarchitecture that minimizes on-chip data movement through an efficient, alternating data distribution policy based on the data access patterns and a streamlined dataflow organization of the tailored functional units -including base conversion, number-theoretic transform, and automorphism units. Overall, our co-design effectively handles the heavy computation and data movement overheads of FHE, drastically reducing the cost of HE operations including bootstrapping.

show abstract

“…Finally, a recent study by De Castro et al highlighted the memory bottleneck of FHE acceleration [15]. The starting point for their analysis is a CPU-like architecture, where ciphertexts do not fit in the Last-Level Cache (LLC).…”

Section: Related Workmentioning

confidence: 99%

BASALISC: Flexible Asynchronous Hardware Accelerator for Fully Homomorphic Encryption

Geelen¹,

Beirendonck²,

Pereira³

et al. 2022

Preprint

View full text Add to dashboard Cite

Fully Homomorphic Encryption (FHE) allows for secure computation on encrypted data. It enables a variety of theoretical and practical applications, but is still several orders of magnitudes too slow to be practical. We present BASALISC, an architecture family of FHE hardware accelerators that aims to substantially accelerate FHE computations in the cloud. BASALISC implements Brakerski, Gentry, and Vaikuntanathan's (BGV) scheme and supports a range of parameter sets. In contrast to many prior studies, we directly support and implement BGV bootstrapping -the noise removal capability necessary to support arbitrary-depth computation.BASALISC exploits data representation in residue number systems and number-theoretic transforms to realize massive FHE parallelism. We propose a new generalized version of bootstrapping that can be implemented with optimized Montgomery multipliers that cost 46% less in silicon area and 40% less in power consumption versus traditional approaches. BASALISC is a Reduced Instruction Set Computing (RISC) architecture with a four-layer memory hierarchy, including a two-dimensional conflict-free inner memory layer that enables 32 Tb/s radix-256 number-theoretic transform (NTT) computations without pipeline stalls. Our conflictresolution data permutation hardware is re-used to compute BGV automorphisms without additional hardware and without throughput penalty. BASALISC additionally includes a custom multiplyaccumulate unit familiar in Digital Signal Processing (DSP) architectures, with which we accelerate tight BGV key switching loops. The BASALISC computation units and inner memory layers are designed in asynchronous logic, allowing them to run at different speeds to optimize each function. BASALISC is designed for Application-Specific Integrated Circuit (ASIC) implementation with * R. Geelen and M. Van Beirendonck contributed equally to this research. a 1 GHz operational frequency, and is already underway toward tape-out with a 150mm 2 die size in a 12nm Global Foundries process.The BASALISC toolchain comprises both a custom compiler and a joint performance and correctness simulator. We evaluate BASALISC in multiple ways: we study its physical realizability; we emulate and formally verify its core functional units; and we study its performance on a single iteration of logistic regression training over encrypted data. For this application, comprising from up to 900K high-level BASALISC instructions (including 513 bootstraps) down to 27B low-level instructions, we show a speedup of at least 2,025× over HElib -a popular software FHE library -running on a Xeon-class processor.

show abstract

Does Fully Homomorphic Encryption Need Compute Acceleration?

Cited by 6 publications

References 22 publications

FPT: A Fixed-Point Accelerator for Torus Fully Homomorphic Encryption

FPT: A Fixed-Point Accelerator for Torus Fully Homomorphic Encryption

ARK: Fully Homomorphic Encryption Accelerator with Runtime Data Generation and Inter-Operation Key Reuse

BASALISC: Flexible Asynchronous Hardware Accelerator for Fully Homomorphic Encryption

Contact Info

Product

Resources

About