Abstract: Aspects of the invention include systems and methods configured to prevent masquerading service attacks. A non-limiting example computer-implemented method includes sending, from a first server in a cloud environment, a communication request comprising an application programming interface (API) key and a first server identifier to an identity and access management (IAM) server of the cloud environment. The API key can be uniquely assigned by the IAM server to a first component of the first server. The first server receives a credential that includes a token for the first component and sends the credential to a second server. The second server sends the credential, a second server identifier, and an identifier for a second component of the second server to the IAM server. The second server receives an acknowledgment from the IAM server and sends the acknowledgment to the first server.

Abstract: In an approach, a processor obtains an encrypted data key and a first encrypted protection key from a storage device. A processor sends the first encrypted protection key to a first device. A processor obtains a protection key from the first device, wherein the protection key is generated by the first device through decrypting the first encrypted protection key. A processor decrypts the encrypted data key using the protection key to obtain a data key.