WPEC 2024 Talk 2b2: Practical and Affordable FPGA-based Fully Homomorphic Encryption

Abstract. In this talk, we present an affordable and practical acceleration of approximate homomorphic computing to enable real world privacy-preserving machine learning applications. Our initial analysis reveals that memory bandwidth is the main performance bottleneck due to the large amount of data that needs to be shuttled between the compute units and the main memory. To alleviate this memory bandwidth bottleneck, we make three contributions. First, we introduce memory-aware design techniques wherein we propose several hardware-centric and algorithmic optimizations while considering small cache sizes that exist in the most commercially available compute platforms. Through these techniques, we observe significant improvement in CKKS bootstrapping throughput. However, we also observe that the memory bandwidth still remains a bottleneck. Our second contribution is FAB, an FPGA-based accelerator that implements fully packed bootstrapping for the first time on an FPGA while utilizing several FPGA-centric design optimizations. Our design utilizes limited on-chip memory and the compute resources efficiently, thus providing practical performance at a fraction of ASIC cost. Even though FAB outperforms all prior CPU/GPU implementations by 9.5x to 456x, the performance is still limited by the bootstrapping operation, which could not be parallelized on multiple FPGAs. To overcome this we propose HEAP, an FHE accelerator with parallelized bootstrapping using a hybrid scheme switching approach. HEAP uses the CKKS scheme for the non-bootstrapping steps, but switches to the TFHE scheme when performing the bootstrapping step of the CKKS scheme. The approach in HEAP is agnostic of the hardware and can be mapped to any system with multiple compute nodes. With this proposed approach, we require smaller-sized bootstrapping keys leading to about 18× less amount of data to be read from the main memory for the keys. HEAP outperforms FAB by 15.39x for the bootstrapping operation. HEAP outperforms FAB and FAB-2 for the logistic regression model training by 14.71x and 11.57x, respectively.

[Slides]