  Homomorphic encryption (HE) enables the secure offloading of computations to
the cloud by providing computation on encrypted data (ciphertexts). HE is based
on noisy encryption schemes in which noise accumulates as more computations are
applied to the data. The limited number of operations applicable to the data
prevents practical applications from exploiting HE. Bootstrapping enables an
unlimited number of operations or fully HE (FHE) by refreshing the ciphertext.
Unfortunately, bootstrapping requires a significant amount of additional
computation and memory bandwidth as well. Prior works have proposed hardware
accelerators for computation primitives of FHE. However, to the best of our
knowledge, this is the first to propose a hardware FHE accelerator that
supports bootstrapping as a first-class citizen.
  In particular, we propose BTS - Bootstrappable, Technologydriven, Secure
accelerator architecture for FHE. We identify the challenges of supporting
bootstrapping in the accelerator and analyze the off-chip memory bandwidth and
computation required. In particular, given the limitations of modern memory
technology, we identify the HE parameter sets that are efficient for FHE
acceleration. Based on the insights gained from our analysis, we propose BTS,
which effectively exploits the parallelism innate in HE operations by arranging
a massive number of processing elements in a grid. We present the design and
microarchitecture of BTS, including a network-on-chip design that exploits a
deterministic communication pattern. BTS shows 5,556x and 1,306x improved
execution time on ResNet-20 and logistic regression over a CPU, with a chip
area of 373.6mm^2 and up to 163.2W of power.
