17.2 A 28nm 4.05µJ/Encryption 8.72kHMul/s Reconfigurable Multi-Scheme Fully Homomorphic Encryption Processor for Encrypted Client-Server Computing

Fully homomorphic encryption (FHE) allows arbitrary encrypted computation for privacy enhancement, at the cost of several orders of magnitude slowdown and memory expansion. However, the prohibitive power consumption and fabrication cost associated with the large silicon solutions supporting the computationally expensive bootstrapping operation [1,2,7-11] turn out to be the major barrier to the broader adoption of FHE. Leveled FHE with designated multiplication depth and conjoint encrypted client-server computing [3,4,6,12-17] is considered more desirable and practical for privacy-preserving machine learning (PPML) applications [18]–[21]. As shown in Fig. 17.2.1, three major challenges remain to be addressed for hardware acceleration. First, higher flexibility is required to support prevailing FHE schemes, including BGV [22], BFV [23], and CKKS [24], and diverse primitives on both client side and server side. Second, FHE-specific primitives, including (I)NTT and polynomial automorphism, incur huge computational overhead with complex on-chip data access patterns, which is hard to parallel and tempers the hardware efficiency. Third, FHE-based workloads introduce intensive memory bottlenecks in terms of storage and data movement, making it challenging to execute application-level tasks on-chip. To address these issues, an energy efficient 4.05µJ/Encryption FHE processor with architecture-circuit optimizations to achieve 8.72kHMul/s in the throughput is presented. To the best of our knowledge, this is the first silicon-proven solution to suit well for both client and server computing patterns.