In 2014, with Singapore’s cloud security standard newly launched and the Heartbleed bug fresh in memory, the argument that end-to-end encryption (E2EE) is what makes a cloud trustworthy gained ground among Asian banks and cloud buyers. The case rested on one idea: whoever sits between a customer and an organisation’s secure systems should never see the sensitive data.
The trend it responded to
Trust was the sticking point for cloud adoption in 2014, whether firms dealt with public cloud providers, private clouds, partners or end users. Buyers found it hard to compare the security of different providers. Singapore’s answer was the Multi-Tier Cloud Security Standard (MTCS SS), launched that year. Steve Leonard, then executive deputy chairman of the Infocomm Development Authority, said it would make providers’ security levels clearer and raise their accountability and transparency.
The standard was tiered. A low-risk, public-facing website could use a tier-1 certified provider, while sensitive business and personal data might call for tier-2. It was voluntary, but providers bidding for government public cloud tenders had to be certified. Certified providers were expected to encrypt sensitive information in transit and in storage, encrypt non-console administrative access, and protect electronic messaging.
Market data pointed the same way. Gartner forecast that cloud-based security services would grow from US$2.1 billion in 2013 to US$3.1 billion in 2015. Kelly Kavanagh, a Gartner principal research analyst, said controls such as encryption were becoming vital to cloud adoption, though trust concerns and regional differences meant providers had to assess each market with care.
Regulation added pressure. Singapore’s Personal Data Protection Act was due to take effect on 2 July 2014, with the prospect of fines of up to a million dollars for breaches. A Robert Half survey of 407 CIOs in Singapore, Australia, Hong Kong and Japan found that 57% of Asia-Pacific CIOs saw security risk as the biggest problem with cloud. Half worried about the legal consequences of a breach of customers’ personal data in the cloud, and 37% feared loss or theft in cross-border transfers.
The argument for E2EE
The weak point, in this view, was the transport layer. Secure Sockets Layer protects data between browser and web server, but Heartbleed showed that implementations could be attacked. Protecting customer PINs and passwords only up to the web server left them exposed to anything that sat behind it.
Other bodies set the direction. The Cloud Security Alliance’s Cloud Controls Matrix 3.0 included encryption and key management as a control domain, drawing on frameworks such as ISO 27001/2 and calling for encryption of data in storage and in transmission. The Hong Kong Monetary Authority expected financial institutions to apply strong E2EE to highly sensitive data, such as customer passwords, so that it stayed encrypted from the customer’s device until it reached the institution’s trusted internal networks. Banks following the Monetary Authority of Singapore’s Technology Risk Management guidelines were encrypting sensitive data, including payment card data, in storage and in transmission.
The technical case was that E2EE protects both confidentiality and integrity by stopping intermediaries, such as cloud or internet service providers, from reading or tampering with the data. The channel runs between the client’s device and a hardware security module (HSM) in a physically secure location inside the organisation. Passwords are encrypted on the client device and can be decrypted for verification only by the HSM, not by the organisation’s own applications or servers.
i-Sprint’s implementation
Singapore-based i-Sprint Innovations offered this through its AccessMatrix Universal Authentication Server (UAS). Its chief executive, Albert Ching, argued in 2014 that the approach addressed data-leakage weaknesses in web servers and on the network, and that breaches of the Heartbleed kind could be mitigated with the right technology. The pitch to developers was that integrating with an HSM and writing the front-end password encryption normally needed complex low-level coding, which the product took out of the authentication work.
i-Sprint described the UAS and HSM pairing as working like a tamper-resistant vault. In an internet banking setting, the password was protected from encryption on the customer’s PC to decryption and checking at the bank’s HSM. In 2014 the company said its authentication and E2EE products were deployed at Bank of China, Taiwan’s Cathay United Bank and Malaysia’s AmBank, and that its software secured the Inland Revenue Authority of Singapore’s e-tax platform.
How the approach has lasted
The design has endured in i-Sprint’s own materials. Its website still describes E2EE as creating a security domain between the customer’s terminal and the service provider’s HSM, with the password decryptable only at the HSM and so hidden even from the bank’s host. It also notes that the one place a PIN can still be exposed is the customer’s PC.
The company’s AccessMatrix supported-platforms document for version 5.7.5, dated 2024, lists several HSMs and cloud key services. These include Thales and nShield HSMs, AWS CloudHSM, Azure Dedicated HSM, Azure Key Vault, AWS Key Management Service and Google Cloud HSM. This suggests the HSM-anchored model was extended from on-premises banking to cloud-based key custody. i-Sprint’s site now also promotes a post-quantum cryptography migration platform called QubitSafe.