Encrypt and decrypt data accessible by multiple users within a team I'm currently working on web services which allows to send and retrieve data.

The data belong to a team.
A team is composed of users.

Each authenticated user can send and retrieve data to/from their team.

I need to add encryption to this with the following requirements:


Data are encrypted on the server and the server doesn't store (might handle, but not store) any key
Each user has a different key or password to decrypt the data
Each user encrypts the data before sending it (data must of course be "decryptable" by other team users)


After searching for hours, I came to this solution, however I would like to have some comments whether this seems to be good or not, and if I could improve it.


Each user, at creation time, receives a RSA public and a private key, the keys are generated by the server, the public key is stored in the database, the private key is immediately sent back to the user via SSL secured connection and removed from server memory.
When the first user is added to a new team, the server generates a 64bits key (for AES). The user public key is used to encrypt the AES key.
The encrypted AES key is stored in the database (user/team pair).
When a user receives/sends some data, he first has to get the encrypted AES key from the server. The user uses his private key to decrypt the AES key.
For "send" action, he uses the AES key to encrypt the data.
For "receive" action, he uses the AES key to decrypt the data.
When a user needs to be added to a team, the existing team member will use the new user public key to encrypt the AES key then send the new user info to the server (user info + encrypted AES key for the new user/team pair)


Two things I don't like:


If a user needs to be removed from a team, he still could have saved the AES key.
This is not a major problem has he won't be authenticated anymore and therefore won't have access to the encrypted data anymore.
AES requires an IV, which should be different for each encrypted piece of data, so I would need to store an IV for each piece of data.


Do you think of any better solution ?

Thank you
One potential risk is your AES key length. Using a key length of 64 bits or less is not advisable as it can be relatively easy to brute force these days. Recommend that you use at least 128 bits. 

As for your problem when a user is removed, you may like to try something similar to PGP. Each time you commit a file to the server, you encrypt it with a randomly generated symmetric key and encrypt the key with the public keys of all other legitimate users. In this way, a removed user would no longer be able to access newer files. 

But I dunno if that will be secure enough, its two cents worth.