blocks|key|3919808|text|你有没有考虑过使用Virtual+Private+Server？我相信，使用VPS，您应该能够在操作系统级别完全控制谁有权访问什么内容。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3919809|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Virtual_private_server^0|9|M|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Have you considered using a <a href="http://en.wikipedia.org/wiki/Virtual_private_server" rel="nofollow noreferrer">Virtual Private Server</a>? I believe with a VPS you should be able to have complete control over who has access to what at the operating system level.

blocks|key|3919709|text|你看过吗：SQL+Server+2008+Transparent+Data+Encryption|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3919710|另外：|3919711|SQL+Server+2008+Transparent+Data+Encryption|3919712|Understanding+Transparent+Data+Encryption+(TDE)|3919713|entityMap|0|LINK|mutability|MUTABLE|url|http://www.mssqltips.com/tip.asp?tip=1514|1|http://www.simple-talk.com/community/blogs/brad_mcgehee/archive/2008/09/21/69659.aspx|2|http://msdn.microsoft.com/en-us/library/bb934049.aspx^0|5|17|0|0|0|0|17|1|0|0|1B|2|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@$A|W|B|X|1|Y]]|C|$]]|$1|D|3|E|5|6|7|Z|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|10|8|@]|9|@$A|11|B|12|1|13]]|C|$]]|$1|H|3|I|5|6|7|14|8|@]|9|@$A|15|B|16|1|17]]|C|$]]|$1|J|3|-4|5|6|7|18|8|@]|9|@]|C|$]]]|K|$L|$5|M|N|O|C|$P|Q]]|R|$5|M|N|O|C|$P|S]]|T|$5|M|N|O|C|$P|U]]]]

Have you looked at: <a href="http://www.mssqltips.com/tip.asp?tip=1514" rel="nofollow noreferrer">SQL Server 2008 Transparent Data Encryption</a>?

Also:

<a href="http://www.simple-talk.com/community/blogs/brad_mcgehee/archive/2008/09/21/69659.aspx" rel="nofollow noreferrer">SQL Server 2008 Transparent Data Encryption</a>

<a href="http://msdn.microsoft.com/en-us/library/bb934049.aspx" rel="nofollow noreferrer">Understanding Transparent Data Encryption (TDE)</a>

blocks|key|771916|text|你可以加密数据，但没有办法保护代码(尤其是面向web的代码)，但坦率地说，这个问题没有意义-如果你与某个与你有隐含信任关系的人存在信任问题，那么你需要寻找不同的提供商。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|771917|如果你不信任任何人(个人心理，不能承受)，你需要自己主持。|771918|附录:从另一个角度来看，为什么你要为某人托管一些东西，而不能对其进行安全甚至法律方面的检查？|771919|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

You can encrypt data, but there's no way to protect code (especially not web-facing code), but frankly the question doesn't make sense - if you have trust issues with someone you have an implicit trust relationship with then you need to find a different provider. 

If you don't trust anyone (personal psychology not withstanding) you need to host it yourself.

Addendum: look at it from the other way round, why would you host something for someone without being able to inspect it for security and even legal concerns?

blocks|key|3919892|text|如果你想要完全的安全，有相当多的事情你需要实现：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3919893|正如其他人所说，您需要对数据库进行物理加密。仅仅阻止他们访问数据库是不够的，因为他们可以访问物理数据库文件，并可以使用这些文件上的工具直接访问数据。|3919894|您将需要使用web.config加密|3919895|Walkthrough:+Encrypting+Configuration+Information+Using+Protected+Configuration|offset|length|3919896|How+To:+Encrypt+Configuration+Sections+in+ASP.NET+2.0+Using+DPAPI|3919897|然而，这在安全性上是有问题的，因为它需要在服务器上安装密钥容器，所以可以说，邪恶的管理人员复制您的密钥，然后使用它来手动解密您的web.config是可以实现的。为了进一步保护您自己，您需要创建一个受保护的web服务(对邮件传输、SSL和内容本身在SSL传输隧道内加密的受保护邮件都进行了保护，请参阅WCF服务安全性)，您的应用程序会不断与该服务进行通信，以获取受保护的数据，例如sql+server数据库的登录用户，然后应用轮换密码，以便在他们截获一个密码时使其生效，如果该密码被轮换，则该密码可能不再有效。|3919898|在此之后，您将需要使用源代码保护，包括反编译保护和代码混淆。这将增加一层保护，禁止直接查看应用程序的源代码，以获取有关如何保护应用程序的信息(尽管这只能阻止复杂的黑客)。|3919899|总而言之，在这一点上，您已经在托管环境中实现了几乎最高级别的代码/数据安全性，但这又回到了核心问题。如果您担心系统操作员是邪恶的，那么如果管理员足够熟练并有足够的动机这样做，那么所有这些保护措施甚至仍然可以被击败。|3919900|如果你需要在这上面和背后的保护，你会真的想看看主机托管，或者至少是专用的服务器主机，这将允许你在操作系统级别应用加密，因为这可以保护你免受最有效的蛮力攻击，这些攻击只涉及从机器中取出硬盘，并用空气除尘器倒置喷洒ram来冻结它，然后尝试从与服务器断开连接的ram中窃取加密密钥。|3919901|要获得使您对此类攻击免疫(或几乎免疫)的安全性，基本上需要使用TrueCrypt对您的文件系统进行本地加密，这样您就不需要在内存中缓存密钥/密钥文件。在这一点上，唯一剩下的安全措施是托管在像ThePlanet或Rackspace这样有声誉的数据中心，这些数据中心有24/7电子监控，邪恶的员工几乎不可能在没有视频记录的情况下危害您的服务器。|3919902|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/dtkwfdky.aspx|1|http://msdn.microsoft.com/en-us/library/ff647398.aspx^0|0|0|0|0|27|0|0|0|1T|1|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|15|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|16|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|17|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|18|8|@]|9|@$H|19|I|1A|1|1B]]|A|$]]|$1|J|3|K|5|6|7|1C|8|@]|9|@$H|1D|I|1E|1|1F]]|A|$]]|$1|L|3|M|5|6|7|1G|8|@]|9|@]|A|$]]|$1|N|3|O|5|6|7|1H|8|@]|9|@]|A|$]]|$1|P|3|Q|5|6|7|1I|8|@]|9|@]|A|$]]|$1|R|3|S|5|6|7|1J|8|@]|9|@]|A|$]]|$1|T|3|U|5|6|7|1K|8|@]|9|@]|A|$]]|$1|V|3|-4|5|6|7|1L|8|@]|9|@]|A|$]]]|W|$X|$5|Y|Z|10|A|$11|12]]|13|$5|Y|Z|10|A|$11|14]]]]

If you want total security there's quite a few things you need to implement:

As others have said you need physical encryption of your database. Merely blocking them from accessing the database is not enough because they have access to the physical database files and can use tools on them to access the data directly.

You will want to use web.config encryption

<a href="http://msdn.microsoft.com/en-us/library/dtkwfdky.aspx" rel="nofollow noreferrer">Walkthrough: Encrypting Configuration Information Using Protected Configuration</a>

<a href="http://msdn.microsoft.com/en-us/library/ff647398.aspx" rel="nofollow noreferrer">How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI</a>

This is rather questionable security however since it requires a key container to be installed upon the server it would be arguably achievable for a nefarious administration to copy your key and then use it to manually decrypt your web.config. To protect yourself further than that you would need to create a secured web service (secured both for message transport, SSL, and secured message that the content itself is encrypted inside the SSL transport tunnel, see WCF services security) that your application constantly talks to for protected data like the login users for the sql server database and then apply rotating passwords to make it if they intercepted one password that it might not be valid anymore if it's been rotated.

After this point you will need to use source code protection that includes decompilation protection and code obfuscation. This will add a layer of protection from prohibiting viewing the source of your application directly for information about how else you protect your application (this will only go so far to stop a sophisticated cracker though).

All in all at this point you've achieved nearly the highest level of code/data security you can inside a hosted environment but this goes back to the core problem. If you have concerns that the system operator is nefarious then all of these protections even can still be beaten if the admin is skilled enough and has enough motivation to do it. 

If you need protection above and behind this you would really want to look at colocation hosting or at the very least dedicated server hosting that would allow you to apply encryption at the operating system level as this protects you from the most effective brute strength attacks which involve just ripping out hard drives from a machine and spraying ram with air duster upside down to freeze it and then attempt to steal encryption keys from the ram itself disconnected from the server. 

Having security that makes you immune (or nearly immune) to this kind of attack basically requires using TrueCrypt for native encryption of your file system where you do not have it cache the keys/key files in memory. At this point the only last part of security left is to host at a reputable data center like ThePlanet or Rackspace that has 24/7 electronic surveillance that it would be nearly impossible for a nefarious employee to be able to compromise your server without video recordings of it occuring.

blocks|key|1517282|text|从系统管理员角色中删除BUILTIN\Administrators组-显然，这只能由服务器管理员完成，但在适当的环境中，域管理员可能只能维护服务器，而看不到数据。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1517283|在2008年，默认情况下不包含此内容。|1517284|至于代码，您可以混淆您的DLL，但没有完全的方法可以对可以访问文件系统的人隐藏代码。|1517285|entityMap^0|B|M|0|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|O|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|P|8|@]|D|@]|E|$]]|$1|J|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|K|$]]

Remove the <code>BUILTIN\Administrators</code> group from the sysadmin role - obviously this can only be done by a server admin, but in a proper environment, it is possible for domain admins to only be able to maintain servers nad not see data.

In 2008, the default is to not include this.

As for code, you can obfuscate your DLLs, but there is no complete way to hide code from someone who can access the filesystem.

blocks|key|3919936|text|您将无法隐藏源代码，但您确实有一些选择，以减少它对管理员的吸引力：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3919937|3919938|obfuscate+-阻止人们从语法上知道发生了什么。虽然他们可以遵循代码并最终弄清楚(如果他们想要的话)，但这需要更多的努力。毕竟，只要有足够的努力和诀窍，任何东西都可以被破解。|ordered-list-item|offset|length|style|BOLD|3919939|encrypt+-因为网页需要由服务器解密，所以服务器需要有密钥才能解密它。此密钥需要存储在服务器(以及管理员)有权访问的文件中。使用一些模糊处理，您可以尝试(再次)隐藏它，但任何存在对称加密的地方，超级用户都有能力破解它。|3919940|3919941|备注：|3919942|3919943|任何时候加密的东西，都很可能需要解密才能使用/view。这一过程将对性能产生负面影响。|3919944|当事物被加密时，特别是从管理员的角度来看，它本质上是一个发出警报的邀请；它会引起好奇心。如果是数据，这是一回事，但在有信任的地方不应该对代码进行加密。这就像是说你有什么东西想藏起来，通常是指你不想被发现的“坏”东西。|3919945|3919946|entityMap^0|0|0|0|9|0|0|7|0|0|0|3|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|X|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|Y|8|@$F|Z|G|10|H|I]]|9|@]|A|$]]|$1|J|3|K|5|E|7|11|8|@$F|12|G|13|H|I]]|9|@]|A|$]]|$1|L|3|-4|5|6|7|14|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|15|8|@$F|16|G|17|H|I]]|9|@]|A|$]]|$1|O|3|-4|5|6|7|18|8|@]|9|@]|A|$]]|$1|P|3|Q|5|E|7|19|8|@]|9|@]|A|$]]|$1|R|3|S|5|E|7|1A|8|@]|9|@]|A|$]]|$1|T|3|-4|5|6|7|1B|8|@]|9|@]|A|$]]|$1|U|3|-4|5|6|7|1C|8|@]|9|@]|A|$]]]|V|$]]

You won't be able to hide the source code, but you do have some options to make it less inviting to admins:

<ol>
<li>obfuscate - deter people from knowing what is happening syntactically. While they can follow the code and eventually figure it out (if they want), it requires more effort. After all, with enough effort and know-how, anything can be cracked. </li>
<li>encrypt - because the web page needs to be decrypted by the server, the server needs to have a key to decrypt it. This key needs to be stored in a file that the server (and thus admin) has access to. Using some obfuscation, you can try and hide this (again), but any places there is a symmetric encryption, a superuser has the ability to get at it.</li>
</ol>

Note: 

<ol>
<li>Any time something is encrypted, it will most likely require a decrypt to use/view. The process will be a negative performance impact.</li>
<li>When things are encrypted, especially from an admin perspective, it is essentially an invitation calling for alarm; it creates curiosity. If it's data, that's one thing, but code should not need to be encrypted where there is trust. It's like saying that you have something you want to hide, generally meaning something "bad" that you don't want found out.</li>
</ol>

I want to make a secure website using ASP.NET, but when I publish it, the domain administrator can see all the data stored in my database (SQL Server). I want to hide my data and code from the domain administrator too. Are there any procedures to do that? Please give me the address of a good domain I can use, which will give me all administrative power of my website (Domain owner also cannot access my databases and files.) Thanks for your suggestion.

How to hide my data stored in database from domain administrator of web server?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我想使用ASP.NET创建一个安全的网站，但当我发布它时，域管理员可以看到我的数据库(SQL Server)中存储的所有数据。我也想对域管理员隐藏我的数据和代码。有什么程序可以做到这一点吗？请给我一个好的域名地址，我可以使用，这将给我的网站的所有管理权力(域名所有者也不能访问我的数据库和文件)。谢谢你的建议。

问如何向web服务器的域管理员隐藏我存储在数据库中的数据？
EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何向web服务器的域管理员隐藏我存储在数据库中的数据？EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何向web服务器的域管理员隐藏我存储在数据库中的数据？
EN