Take the 2-minute tour ×  I'm building a system that need to
collect some user sensitive data via secured web connection,
store it securely on the server for later automated decryption
and reuse. System should also allow user to view some part of
the secured data (e.g., *****ze) and/or change it completely via
web. System should provide reasonable level of security.  I was
thinking of the following infrastructure:  App (Web) Server 1
1. Web server with proper TLS support for secured web
connections.    2. Use public-key algorithm (e.g. RSA) to
encrypt entered user sensitive data and send it to App Server 2
via one-way outbound secured channel (e.g. ssh-2) without
storing it anywhere on either App Server 1 or DB Server 1.    3.
Use user-password-dependent symmetric-key algorithm to encrypt
some part of the entered data (e.g. last few letters/digits) and
store it on the DB Server 1 for later retrieval by App Server 1
during user web session.    4. Re-use step 2 for data
modification by user via web.  DB Serv