I'm passing sensitive financial data to a payment processor online via cloud functions and would like your expert opinions, please.
The workflow is as follows:
A customer indicates they want to transact by tapping a checkout button.
The checkout button hits an API on the server which generates public and private keys. Both keys are sent to a secured database, keyed by the public key. Only the server has permissions to read and write to the database. The server responds to the client with the public key so the customer can asymmetrically encrypt their data.
The customer enters their sensitive bits into the client on ssl/tls, which encrypts the data with the public key and then sends the data and public key back to the server.
The server fetches the private key from the database using the public key, decrypts the customers sensitive data, deletes both keys from the database, tokenizes the decrypted data, and finally submits the tokenized data to the transactional processor. The client is updated with a callback for the transaction state or error.
Is this a secure procedure? What weak points can I address? What is the technical term for this strategy?