BTS: An Accelerator for Bootstrappable Fully Homomorphic Encryption

Homomorphic encryption (HE) enables secure offloading of computation to the cloud by providing computation on encrypted data (ciphertexts). HE is based on noisy encryption schemes such that noise accumulates as we apply more computation to the data. The limited number of operations applicable to the data prevents practical applications from exploiting HE. Bootstrapping enables an unlimited number of operations or fully HE (FHE) by refreshing the ciphertext. Unfortunately, bootstrapping requires a significant amount of additional computation and memory bandwidth. Prior works have proposed hardware accelerators for computation primitives of FHE. However, to the best of our knowledge, this is the first to propose a hardware FHE accelerator tailored to support bootstrapping efficiently. In particular, we propose BTS -- Bootstrappable, Technology-driven, Secure accelerator architecture for FHE. We identify the challenges of supporting bootstrapping in the accelerator and analyze the off-chip memory bandwidth and computation required. In particular, given the limitations of modern memory technology, we identify the HE parameter sets that are efficient for FHE acceleration. Based on the insights from our analysis, we propose BTS that effectively exploits parallelism innate in HE operations by arranging a massive number of processing elements in a grid. We present the design and microarchitecture of BTS, including the network-on-chip that exploits the deterministic communication pattern. BTS shows 5,556$\times$ and 1,306$\times$ improved execution time on ResNet-20 and logistic regression over CPU, using 373.6mm$^2$ chip area and up to 133.8W of power.