HEPCloud: An FPGA-based Multicore Processor for FV Somewhat Homomorphic Function Evaluation

Abstract

In this paper we present an FPGA based hardware accelerator 'HEPCloud' for homomorphic evaluations of medium depth functions which has applications in cloud computing. Our HEPCloud architecture supports the polynomial ring based homomorphic encryption scheme FV for a ring-LWE parameter set of dimension 2 15 , modulus size 1228-bit and a standard deviation 50. This parameter-set offers a multiplicative depth 36 and at least 85 bit security. The processor of HEPCloud is composed of multiple parallel cores. To achieve fast computation time for such a large parameter-set, various optimizations in both algorithm and architecture levels are performed. For fast polynomial multiplications, we use CRT with NTT and achieve two dimensional parallelism in HEPCloud. We optimize the BRAM access, use a fast Barrett like polynomial reduction method, optimize the cost of CRT, and design a fast divide-and-round unit. Beside parallel processing, we apply pipelining strategy in several of the sequential building blocks to reduce the impact of sequential computations. Finally we implement HEPCloud on a medium-size Xilinx Virtex 6 FPGA board ML605 board and measure its on-board performance. To store the ciphertexts during a homomorphic function evaluation, we use the large DDR3 memory of the ML605 board. Our FPGA-based implementation of HEPCloud computes a homomorphic multiplication in 26.67 s, of which the actual computation takes only 3.36 s and the rest is spent for off-chip memory access. It requires about 37551 s to evaluate the SIMON-64/128 block cipher, but the per-block timing is only about 18 s because HEPCloud processes 2048 blocks simultaneously. The results show that FPGA-based acceleration of homomorphic function evaluations is feasible, but fast memory interface is crucial for the performance.

Implementation and Performance Evaluation of RNS Variants of the BFV Homomorphic Encryption Scheme

“…We remark that our best GPU results, namely the homomorphic multiplication runtime of 51 ms for n = 2 16 and log 2 q = 1, 770 and 18.7 ms for n = 2 16 and log 2 q = 1, 020, are more than two orders of magnitude faster than best previously reported runtimes for other implementations of the BFV scheme. For instance, the FPGAbased implementation HEPCloud in [18] of the textbook BFV scheme computed a homomorphic multiplication for n = 2 15 and log 2 q = 1, 228 in 26.67 seconds (with 3.36 seconds spent on the computation and the rest on the off-chip memory access). The BEHZ variant NFLlib CPU implementation in [9] ran a homomorphic multiplication for n = 2 15 and log 2 q = 1, 590 in 4.9 seconds.…”

“…For instance, Al Badawi et al [17] provide a GPU-accelerated implementation of BEHZ. Another recent effort dealt with accelerating the textbook BFV performance using FPGA [18].…”

Heax

“…As has been shown by prior art [53,54], leveraging off-chip memory to store intermediate results significantly reduces the overall performance due to high delays between subsequent reads and writes. One of our primary design goals is to avoid off-chip memory access as much as possible.…”

“…Hardware Acceleration for non-CKKS Schemes. In [53], a system based on FPGA is proposed for BFV scheme to process ciphertext polynomial sizes of 2 15 . However, due to the massive off-chip data transfer, their design does not yield superior performance compared to CPU execution.…”

“…Prior work that propose customized hardware for non-CKKS schemes have taken one of these approaches: (i) Designing co-processors that only accelerate certain low-level ring operations [14,19,20,30,39,61]; high-level operations are performed on the CPU-side, which makes the coprocessors of limited practical use. (ii) Storing intermediate results on off-chip memory, which significantly degrades the performance [51] to the extent that it can be worse than naive software execution [53]. (iii) Designing a hardware for a fixed modest-sized parameter, e.g., n = 2 12 [54].…”