# US 2018/0025145 A1 · Computer-implemented method for controlling access > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0025145 A1 - Document ID: US20180025145A1 - Status: Published application - Kind: A1 - Application number: 15/549,949 - Filed: 2016-02-10 - Published: 2018-01-25 - Earliest claimed: 2015-02-10 - Assignees: Bundesdruckerei GmbH - Applicants: Bundesdruckerei GmbH - Inventors: Frank MORGNER; Paul BASTIAN - Web page: https://patentgrep.com/patent/US20180025145A1 ## CPC - G06F 21/33: using certificates - G06F 21/35: communicating wirelessly - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/10: {for controlling access to devices or network resources} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The invention relates to a computer-implemented method for controlling access of a terminal (118) to an attribute (112) stored in an ID token (100), wherein the ID token (100) is associated with a user, wherein the method comprises receipt of an identification of the terminal (118) by the ID token (100) and checking by the ID token (100) if a session identification validly associated with the identification of the terminal (118) is stored in the ID token (100), wherein, if a session identification validly associated with the identification of the terminal (118) is stored in the ID token (100), the ID token (100) transmits the session identification to the terminal (118) and grants the terminal (118) access to the attribute (112), wherein a subsequent communication with access to the attribute (112) is carried out in an encrypted manner using a session-specific session key, wherein the session-specific session key is stored in the ID token (100) in a manner associated with the session identification or the identification of the terminal (118). ## Claims ### Claim 1 A computer-implemented method for controlling access of a terminal to an attribute stored in an ID token, wherein the ID token is associated with a user, wherein the method comprises receipt of an identification of the terminal by the ID token and checking by the ID token if a session identification validly associated with the identification of the terminal is stored in the ID token, wherein, if a session identification validly associated with the identification of the terminal is stored in the ID token, the ID token transmits the session identification to the terminal and grants the terminal access to the attribute, wherein a subsequent communication with access to the attribute is carried out in an encrypted manner using a session-specific session key, wherein the session-specific session key is stored in the ID token in a manner associated with the session identification or the identification of the terminal, wherein, if no session identification validly associated with the identification of the terminal is stored in the ID token, the method comprises the following steps: authenticating the terminal by the ID token and authenticating the ID token to the terminal, wherein, following successful authentications, the terminal is granted access to the attribute, deriving a session-specific session key, wherein a subsequent communication with access to the attribute is carried out in an encrypted manner using a session-specific session key, deriving a session identification, storing, in the ID token, the identification of the terminal associated with the session identification, storing, in the ID token the session-specific session key associated with the identification of the terminal. ### Claim 2 (depends on 1) The method according to claim 1, wherein, if a session identification validly associated with the identification of the terminal is stored in the ID token, a salt is generated by the ID token and a hash value is generated from the identification of the terminal, the salt, and the session identification, wherein the session identification is transmitted from the ID token to the terminal in the form of a transmission of the hash value together with the salt. ### Claim 3 (depends on 1) The method according to claim 1, wherein, if a session identification validly associated with the identification of the terminal is stored in the ID token, access of the terminal to the attribute is granted for the current session between ID token and terminal without a further authentication process between ID token and terminal. ### Claim 4 (depends on 1) The method according to claim 1, wherein, by the ID token, if there is no session identification validly associated with the identification of the terminal stored in the ID token, metadata of a permanent certificate of the terminal are received by the ID token at the time of authentication of the terminal, wherein the metadata comprise an access authorisation, wherein, following successful completion of the authentications, at least the access authorisation is stored in the ID token in a manner associated with the identification of the terminal, and access of the terminal to the attribute is granted in accordance with the access authorisation, if there is a session identification validly associated with the identification of the terminal stored in the ID token, the access authorisation associated with the identification of the terminal is read by the ID token, wherein access of the terminal to the attribute is granted in accordance with the access authorisation. ### Claim 5 (depends on 1) The method according to claim 1, wherein, by the ID token, if there is no session identification validly associated with the identification of the terminal stored in the ID token, a first timestamp is stored in the ID token in a manner associated with the identification of the terminal, following successful completion of the authentications, wherein the first timestamp specifies a maximum period of validity of the session-specific session key, if there is a session identification validly associated with the identification of the terminal stored in the ID token, the timestamp associated with the identification of the terminal is read, and the session-specific session key is deemed to be validly stored only if the first timestamp is still valid. ### Claim 6 (depends on 5) The method according to claim 5, wherein the metadata comprise the first timestamp. ### Claim 7 (depends on 5) The method according to claim 5, wherein the first timestamp is generated for storing the session-specific session key in the ID token, wherein the first timestamp is generated on the basis of a predefined relative period of validity. ### Claim 8 (depends on 1) The method according to claim 1, wherein the authentication by the ID token comprises the receipt of a permanent certificate of the terminal, the deriving of a terminal hash value from the certificate, and a checking as to whether the terminal hash value is validly stored in the ID token, wherein, if the terminal hash value is validly stored in the ID token, access of the terminal to the attribute is granted without further checking of the permanent certificate of the terminal, wherein the authentication by the ID token comprises the following steps: deriving a first signature from the permanent certificate of the terminal and verifying the first signature with the terminal hash value and a public key of the terminal associated with the permanent certificate, wherein the terminal hash value comprises a hash of the metadata of the certificate, receiving a session-specific public key of the terminal, generating and sending a random first secret to the terminal, receiving a second signature from the terminal and verifying the second signature with use of the session-specific public key of the terminal, the random first secret, and the public key of the terminal associated with the permanent certificate, following successful verification of the first and second signature, storing the terminal hash value in the ID token. ### Claim 9 (depends on 8) The method according to claim 8, wherein the permanent public key of the terminal is contained in the permanent certificate, wherein the terminal hash value comprises a hash of the permanent public key ### Claim 10 (depends on 8) The method according to claim 8, wherein, by the ID token, if the terminal hash value is not validly stored in the ID token, following the successful verification of the first and second signature, the permanent public key is stored in the ID token in a manner linked to a second timestamp, wherein the second timestamp specifies a maximum period of validity of the terminal hash value, if the terminal hash value is stored in the ID token, the second timestamp stored in a manner linked to the terminal hash value is read and the terminal hash value is deemed to be validly stored only if the second timestamp is still valid. ### Claim 11 (depends on 1) An ID token comprising a communication interface, a processor, and a computer-readable storage medium, wherein the storage medium contains computer-readable instructions which, when run by the processor, prompt the execution of a method according to claim 1. ### Claim 12 (depends on 1) A method for granting access to an access-restricted security facility by means of an ID token, wherein the method comprises the following steps: carrying out the method, according to claim 1, by the ID token, following the granting of the access of the terminal to the attribute, reading the attribute by the terminal and sending an access request to an authentication server, wherein the access request comprises the attribute in encrypted form, decrypting and checking the attribute by the authentication server, wherein the authentication server grants access to the security facility in the event of a successful check. ### Claim 13 (depends on 12) A security system comprising an ID token according to claim 12, and an access-restricted security facility, a terminal, and an authentication server, wherein the terminal is designed, following a granting of access of the terminal to the attribute, to read the attribute and to send an access request to the authentication server, wherein the access request comprises the attribute in encrypted form, wherein the authentication server is designed to perform a decryption and checking of the attribute and to grant the access to the security facility in the event of a successful check. ### Claim 14 A computer-implemented method for controlling access of a terminal to an attribute stored in an ID token, wherein the ID token is associated with a user, wherein the method comprises a step of sending an identification of the terminal, by the terminal, to the ID token, wherein, if the ID token responds to the sending of the identification with the transmission of a session identification to the terminal, the terminal checks whether a session-specific session key validly associated with the session identification is stored in the terminal, wherein, if a session-specific session key validly associated with the session identification is stored, access of the terminal to the attribute is granted, wherein the access is carried out by means of a communication of the terminal with the ID token in an encrypted manner using the session-specific session key, wherein, if there is no session-specific session key validly associated with the session identification, the method comprises the following steps: authenticating the terminal to the ID token and authenticating the ID token to the terminal, following successful authentications, deriving a session-specific session key, wherein a subsequent communication with access to the attribute is carried out in an encrypted manner using a session-specific session key, deriving a session identification, storing, in the terminal, the session-specific session key associated with session identification. ### Claim 15 (depends on 14) The method according to claim 14, wherein the session identification is received by the terminal from the ID token in the form of a hash value together with a salt, wherein the terminal generates a temporary hash value for all session identifications stored in the terminal, in each case with the salt and the identification of the terminal, compares the temporary hash values with the received hash value and, if one of the hash values matches, uses the session identification associated with this hash value as the session identification for which a check is performed in order to ascertain whether a session-specific session key is stored in a validly associated manner. ### Claim 16 (depends on 14) A terminal, comprising a communication interface, a processor, and a computer-readable storage medium, wherein the storage medium contains computer-readable instructions which, when run by the processor, prompt the execution of a method according to claim 14.