16.1 A 2.7-to-13.3μJ/boot/slot Flexible RNS-CKKS Processor in 28nm CMOS Technology for FHE-Based Privacy-Preserving Computing

Fully homomorphic encryption (FHE) has been gaining significant attention as a privacy-preserving solution for emerging server systems with critical information, which allows the server to perform various primitive computations on encrypted data from clients without decrypting original messages as shown in Fig. 16.1.1 [3–6]. Among various FHE candidates, based on the ring learning with error (RLWE) problem, the recent CKKS approach using the residue number system (RNS) is regarded as the most promising method [4–6]. For an n-slot user message, the RNS-CKKS scheme constructs (l+1) N degree polynomials to save the processing complexity with low-resolution coefficients bounded by small prime moduli $q_{i}(0 \leq i \leq \eta)$. For the unlimited FHE operations, however, the bootstrapping step on RNS-CKKS polynomials requires significant computing costs, mainly caused by key-switch (KS) functions, including NTT/iNTT, base conversion (BConv) and other modular operators [4–6]. For different applications, moreover, the KS processing is characterized by various parameters like the bit-width of primes, the ciphertext level (l), and the number of special moduli (a), resulting in different tradeoffs as shown in Fig. 16.1.1. Hence, it is desirable to develop a cost-efficient and flexible KS accelerator for practical RNS-CKKS systems; however, the existing works only report outdated parameter sets [4], architecture-level estimations [5] and energy-inefficient realization [4–6]. This paper presents an integrated high-efficiency FHE processor to meet all the RNS-CKKS demands. Based on the programmable core with dedicated instructions, as shown in Fig. 16.1.1, we develop novel design-level optimizations to save energy consumption and reduce processing latency: 1) inter-/intra-set scheduling of residue polynomials and 2) cost-reduced computing engines. Implemented in 28nm CMOS, we report the energy efficiencies of $2.7-13.3 \mu \mathrm{J}$ /boot/slot for various log N values, which outperforms recent RNS-CKKS works with comparable FHE parameters.