I am trying to design a system that will allow for staff members in our small company to securely share sensitive customer information (text) and see them on a web page alongside less sensitive communications. I intend to use PHP because that's what I know best.
The main challenge is that the data needs to be stored on the server but it needs to be very time consuming to make useful if the server gets compromised.
My idea is as follows:
When a staff user is created, they choose a secure password and this is hashed using bcrypt(12) and stored in our database. The plain password is also used to create a 4096 bit RSA key pair using OpenSSL. Both keys are stored on the server.
When a secure note is created, it is encrypted with the public key of every staff member and each copy is stored in the database.
When a staff member logs in, their plain password is checked against the hash to see if they match. If they do, the plain password, client IP and user ID are serialised and symmetrically encrypted using mcrypt. The key used to encrypt the string is stored on the server's file system. The cypertext is then sent as a cookie to the client.
When a staff member accesses another page, the server decrypts the cookie and uses the plain password and the user's private key to decrypt any sensitive information in that request and sends the sensitive information to the user's browser.
The whole thing will be over HTTPS with secure ciphers.
I'm aware that this is probably very hard to make completely secure but I would like to know if anyone can spot any obvious flaws in this setup that can reasonably be improved. Generally, it would also be helpful to know how useful is a private key is without the associated secure password.