Method for reading attributes from an id token

A method providing at least one attribute, signed by a first computer system, to a second computer system, where the at least one attribute is stored in a secure memory of an ID token assigned to a user, the method comprising:

• the ID token authenticating the user, where the ID token comprises an electronic identification document having an interface with a third computer system and where the third computer system is a user computer system;
• the ID token authenticating the first computer system via a network link between the first and third computer systems;
• and
• after successful authentication of the user and the first computer system by the ID token:
• transmitting, to the first computer, via the third computer, a transaction number generated by the second computer system and an attribute specification;
• allowing a read access by the first computer of at least one attribute stored in the ID token in accordance with the attribute specification;
• the third computer receiving from the first computer system, via the network link, the transaction identifier and a time stamp for the at least one attribute, where the at least one attribute, the time stamp and the transaction identifier are signed by the first computer;
• and
• transmitting the at least one attribute, the time stamp and the transaction identifier, all signed by the first computer system, from the third computer system to the second computer system, without use of any direct communication link between the first computer system and the second computer system.

A method providing at least one attribute, signed by a first computer system, to a second computer system, where the at least one attribute is stored in a secure memory of an ID token assigned to a user, the method comprising:

• in response to a request received from a third computer system, the second computer generating a transaction number and an attribute specification, where the third computer system comprises user computer system having an interface with the ID token, and where the attribute specification specifies the at least one attribute stored in the secure memory of the ID token;
• after authentication of the user and the first computer system by the ID token:
• transmitting the transaction number and attribute specification to the first computer system;
• receiving from the first computer system, the at least one attribute, the transaction number and a time indicator, all signed by the first computer system;
• and
• processing the received at least one attribute after validating the signature and validating the received at least one attribute using the time indicator,
• where transmitting the transaction number and attribute specification to the first computer system comprises:
• transmitting the transaction number and attribute specification from the second computer system to the third computer system;
• and
• transmitting the transaction number and attribute specification from the third computer system to the first computer system,
• and where receiving from the first computer system, the at least one attribute, the transaction number and a time indicator, all signed by the first computer system comprises:
• receiving the at least one attribute, the transaction number and a time indicator from the first computer system via the third computer system.

A method providing at least one attribute, signed by a first computer system, to a second computer system, where the at least one attribute is stored in a secure memory of an ID token assigned to a user, the method comprising:

• after authentication of the user and the first computer system by the ID token:
• receiving a transaction number and an attribute specification, the transaction number and attribute specification generated by the second computer system in response to a request from a third computer system, where the third computer system comprises user computer system having an interface with the ID token, and where the attribute specification specifies the at least one attribute stored in the secure memory of the ID token;
• reading at least one attribute stored in the ID token via a network link,
• generating a time indicator for the at least one attribute, the time indicator dependent upon a time at which the receiving or reading operations occur;
• signing the at least one attribute, the time indicator and the transaction identifier;
• and
• transmitting the signed at least one attribute, the time indicator, and the transaction identifier to the second computer system,
• where transaction number and the attribute specification are received from the second computer system via the third computer system, and where the signed at least one attribute, the time indicator, and the transaction identifier are transmitted to the second computer system via the third computer system without use of any direct communication link between the first computer system and the second computer system.

An electronic identification document comprising:

• an interface to a user computer system, the user computer system having a network interface that provides, via a network, a link with a first computer system and a link with a service computer system;
• a memory for storing at least one attribute;
• a processor, coupled to the memory, and operable to:
• authenticate a user associated with the electronic identification document;
• authenticate the first computer system via user computer and the network;
• and
• receive, from the service computer system, an attribute specification generated by the service computer system, the attribute specification specifying one or more specified attributes of the at least one attribute;
• transmit the attribute specification to the first computer system;
• responsive to a request from the first computer system, transmit the one or more specified attributes of the at least one attribute stored in the memory to the first computer system;
• receive, from the first computer system, the one or more specified attributes signed by the first computer system;
• and
• transmit to the service computer system the one or more specified attributes signed by the first computer system.