Pipelined Key Switching Accelerator Architecture for CKKS-Based Fully Homomorphic Encryption

Abstract

The increasing ubiquity of big data and cloud-based computing has led to increased concerns regarding the privacy and security of user data. In response, fully homomorphic encryption (FHE) was developed to address this issue by enabling arbitrary computation on encrypted data without decryption. However, the high computational costs of homomorphic evaluations restrict the practical application of FHE schemes. To tackle these computational and memory challenges, a variety of optimization approaches and acceleration efforts are actively being pursued. This paper introduces the KeySwitch module, a highly efficient and extensively pipelined hardware architecture designed to accelerate the costly key switching operation in homomorphic computations. Built on top of an area-efficient number-theoretic transform design, the KeySwitch module exploited the inherent parallelism of key switching operation and incorporated three main optimizations: fine-grained pipelining, on-chip resource usage, and high-throughput implementation. An evaluation on the Xilinx U250 FPGA platform demonstrated a 1.6× improvement in data throughput compared to previous work with more efficient hardware resource utilization. This work contributes to the development of advanced hardware accelerators for privacy-preserving computations and promoting the adoption of FHE in practical applications with enhanced efficiency.

High-throughput and fully-pipelined ciphertext multiplier for homomorphic encryption

“…The no sw lanes are not shown in the figure but synchronized in the similar way as key sw lane. It should be noted that different from other designs [24,28], the length of each block in the timing chart is not related to the latency of any block as there is no pipeline blocking. Each block is a subpolynomial sequence with the length of 𝑁 𝑠𝑢𝑏 𝑝𝑜𝑙𝑦 , which is 2048 clock cycles in this design.…”

“…A high throughput and pipelined NTT/INTT design proposed in [32] is used in our design. Unlike the NTT/INTT blocks used in other key switching designs [24,26,27,28], our block dose not require RAM access, which ensures the entire pipeline is not blocked by potential access conflict. However, the original NTT/INTT design is on a small parameter set and the twiddle factors for NTT/INTT are saved on chip, which consumes huge area for large parameter set.…”

“…There are also attempts on GPUs to achieve higher parallelism, but on single GPU, the acceleration is still inefficient and utilizing GPU cluster results in high power consumption and expense [15,16]. Using specific hardware, including FPGA and ASIC, is a promising method to further accelerate HE calculations [17,18,19,20,21,22,23,24,25,26,27,28]. In [19] and [20], circuits for accelerating HE operations are designed on single ASIC chips.…”

“…Authors in [29,30] design the accelerators for Number-Theoretic Transform (NTT)/Inverse NTT (INTT), which takes much time among low-level HE operations. [24,25,26,27,28] introduce the accelerators for high-level operations, such as key switching and ciphertext multiplication. Most structures have the pipeline design; however, the pipelines are coarse-grained and the sub-blocks are not fully-pipelined.…”

Configurable Encryption and Decryption Architectures for CKKS-Based Homomorphic Encryption

“…These units are constructed using two-parallel multi-path delay feedback (MDF) architecture, which enables NTT and INTT executions to generate coefficients every clock cycle in a fully pipelined manner. Different from a prior study [18], we targeted various polynomial degrees and larger integer moduli for practical HE schemes. The proposed NTT and INTT units are configurable to support various polynomial degrees by manipulating the multiplexer selection signal.…”