I'm thinking about the safest possible way to store secure data (eg. Credit Card numbers) with a requirement of sending them in clear text to third party API (so hashing doesn't come into play).
I've came to solution that seems to be more secure than typical 'store them cryptedencrypted and decrypt when you have to use them using the same key'.
The idea is to encrypt it and store on the application server directly after acquiring it from user with a public key.
The private key wouldn't be stored on the application server at all. Instead the application server would send the message to 3rd party API using the encrypted values.
The second part of the solution would be an HTTP Proxy on a separate server that would route the messages to the third party API and decrypt the encrypted values. The private key would be stored only on the proxy and wouldn't be stored on disk (only in RAM - each restart would require inputting the private key).
It seems, that using proxy as a black box that wouldn't need to change despite application development would help in securing it better than the application server (to which more people have to have access). Also, because of the requirement of not storing the private key on disk, it wouldn't be such a problem to enter the key after each restart of the proxy server since it wouldn't have to be restarted as frequently as an application server machine.
Any thoughts on advantages and disadvantages of such a solution? Are there any applications that could help me achieve it (proxy with ability to use custom transformation code, method of securely storing values in RAM)?
