I'm using Azure to store customer data. In a specific country, there are multiple partners. Each partner has his clients. The issue is they don't want us to have access to this data. In other words, the only one who can access the data is the partner and the client. So I'm thinking of using a master key for each partner but I'm not if not the best approach.
My idea is to create 2 layers of encryption:
|Client App||Azure storage||Partner||Client|
|encrypt data (only client and partner can opened)||encrypt data with Microsoft encyption||Get the data||Can get his data|
At this step I'm blocked in the first step where how can I encrypt the data without storing the encryption key of partner(s).
Do you have any suggestions?