証明書ベースのアクセス（CBA）を使用して、 Google Cloud リソースへのアクセスに検証済みの X.509 証明書を必須にできます。追加の認証情報はデバイス ID のシグナルを強化し、アクセス権を付与する前に、ユーザー認証情報と元のデバイス証明書の両方を要求することで、認証情報の盗難や偶発的な紛失から組織を保護します。
署名なしトークンなどの認証情報のみを使用して Google CloudAPI とリソースへのアクセス権を付与すると、リスクが生じる可能性があります。これらの認証情報は、ユーザーエラーによって公開されたり、攻撃者の主要な標的になったりするおそれがあります。攻撃者が認証情報を取得すると、認証情報をリプレイしてリソースにアクセスできるようになります。
CBA を使用すると、追加の承認要素（デバイス証明書）を要求することで、リソースのセキュリティを強化できます。デバイス証明書は、相互 TLS handshake を使用して検証および確認されます。これにより、ユーザーは証明書に関連付けられた秘密鍵を保持していることを証明する必要が生じるため、デバイス ID のシグナルが強化されます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-05 UTC。"],[],[],null,["# Certificate-based access overview\n\nYou can use certificate-based access (CBA) to require verified X.509 certificates for\naccess to Google Cloud resources. The additional credential provides a stronger\nsignal of device identity and helps protect your organization from credential\ntheft or accidental loss by requiring that both the user credentials and the\noriginal device certificate are present before granting access.\n\nRelying only on credentials, like bearer tokens, to grant access to the Google Cloud\nAPIs and resources can put you at risk. Those credentials can be exposed by user\nerror or become prime targets for attackers. If attackers obtain the\ncredentials, they can replay the credentials to access resources.\n\nBy using CBA, you enhance the security of your resources by requiring an\nadditional authorization factor, a device certificate. Device certificates are\nvalidated and verified using a mutual TLS handshake. This requires users to\nprove possession of the private key associated with the certificate, thereby\nproviding a strong signal of device identity.\n\nFollowing is a high-level illustration of the CBA access flow:\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n### The benefits of using Google CBA\n\nFollowing are some of the benefits of using CBA.\n\nComprehensive Security\n: Protects your important resources by preventing access using stolen\n credentials from untrusted devices, such as cookie theft.\n: Protects all Google Cloud API requests regardless of access points,\n including on-premises or Google networks, and web browsers or desktops applications.\n\nFine-grained Policy Control\n: Works seamlessly with VPC Service Controls service perimeters and lets you to specify\n fine-grained access control over your resources.\n: Works seamlessly with user groups and lets you apply CBA to a group of users.\n\nGood Developer Experience\n: Automated CBA support in common libraries and tools, such as the\n gcloud CLI, which reduces the programming cost of using CBA.\n\nWhat's next\n-----------\n\n- [Understand mutual TLS at Google Cloud](/chrome-enterprise-premium/docs/understand-mtls)\n- [Set up certificate-based access](/chrome-enterprise-premium/docs/set-up-cba)"]]
