1

I have a database table called "patient" where I store the patient information. The structure (list of columns) is as follows.

patient table

idPatient (int)
user_name (varchar)
password (varchar)
first_name (varchar)
last_name (varchar)
height (double)
weight (double)

This database is connected to an android app remotly. There is a login process and that is why you can see user_name and password fields.

However I have an idea about the following table structure, instead of above.

user table

idUser (int)
user_name (varchar)
password (varchar)

patient table

idPatient (int)
user_iduser (int) /*The foriegn key of `user` table*/ 
first_name (varchar)
last_name (varchar)
height (double)
weight (double)

So which type of structure is the best? The only reason I came up with 2nd structure is because to further protect user information by not putting them in same place where it is used for login check.

Please advice.

  • 2
    It couldn't hurt I suppose, though as @David has said, it's not really going to be a significant security improvement over and above having them in the same table. Your biggest security 'feature' should be around the encryption of your password data, potentially using a hashing algorithm. – Molenpad Sep 6 '16 at 15:11
1

I would recommend you implement security by encrypting the data you want to keep secure. Separating the username and password to a different table would not significantly improve their protection.

1

Split registration data from security data is a good approach. It's allow you put down the risk of transferring data to client application and accidental data corruption by business logic. But also you need to hash password by sha256 for example and compare password hash, not password.

1

I see no improvement in security. As said in other answers: most important is not to store passwords plain text. Use hashing (not encryption) and use a salt.

In case there are or will be types of users other than patients, with different attributes, then your approach is correct, for normalisation reasons (not security).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.