A method for controlling access of a terminal to an attribute stored in a mobile radio device (100, 804), wherein the mobile radio device (100, 804) comprises a first mobile radio interface, a first communications interface, and an application which is configured to control the mobile radio device (100, 804) in order to carry out the method, wherein the method comprises an authentication of the terminal by the mobile radio device (100, 804) and an authentication of the mobile radio device (100, 804) by the terminal, wherein the mobile radio device (100, 804) comprises a chip card operating system, and wherein the application is a chip card application which is executable on the chip card operating system, wherein the chip card operating system is emulated by an emulator of the mobile radio device (100, 804) and the chip card application is executed on the emulated chip card operating system, wherein the authentication of the terminal by the mobile radio device (100, 804) comprises: - sending a first access token from the terminal to the mobile radio device (100, 804), - verifying, by the mobile radio device (100, 804), a first signature of the first access token using a static public key associated with the terminal, - generating and sending a session-based temporary public key by the terminal to the mobile radio device (100, 804), - generating and sending a random first secret by the mobile radio device (100, 804) to the terminal, - creating a second signature of the random first secret using a static private key associated with the terminal and using the session-based temporary public key of the terminal, - sending the second signature by the terminal to the mobile radio device (100, 804), - verifying the second signature of the random first secret by the mobile radio device (100, 804) using the random first secret, the session-based temporary public key of the terminal and the static public key associated with the terminal, - following successful verification of the first and second signature, releasing the access of the terminal to the attribute, wherein the access of the terminal to the attribute is provided only on the precondition of successful authentication of the mobile radio device (100, 804) by the terminal, wherein the authentication of the mobile radio device (100, 804) comprises: - sending, to the terminal, a public key of the mobile radio device (100, 804) and a domain parameter associated with the public key, - calculating, by the mobile radio device (100, 804), a second secret, which is common to the mobile radio device (100, 804) and to the terminal, from a private key of the mobile radio device (100, 804), the session-based temporary public key of the terminal, and the domain parameter, - calculating, by the terminal, the common second secret from the public key of the mobile radio device (100, 804), the session-based temporary private key of the terminal, and the domain parameter, - generating a random third secret by the mobile radio device (100, 804), - sending the random third secret to the terminal, and - generating, by the mobile radio device (100, 804) and the terminal, a symmetric session key from the third secret and the common second secret, wherein the subsequent communication, with the access to the attribute, occurs encrypted by the symmetric session key, wherein the mobile radio device (100, 804) communicates by means of its mobile radio interface via a digital cellular mobile radio network with a remote maintenance server, which provisions the cryptographic key associated with the mobile radio device (100, 804) via a mobile radio number of the mobile radio device (100, 804). - sending a first access token from the terminal to the mobile radio device (100, 804), - verifying, by the mobile radio device (100, 804), a first signature of the first access token using a static public key associated with the terminal, - generating and sending a session-based temporary public key by the terminal to the mobile radio device (100, 804), - generating and sending a random first secret by the mobile radio device (100, 804) to the terminal, - creating a second signature of the random first secret using a static private key associated with the terminal and using the session-based temporary public key of the terminal, - sending the second signature by the terminal to the mobile radio device (100, 804), - verifying the second signature of the random first secret by the mobile radio device (100, 804) using the random first secret, the session-based temporary public key of the terminal and the static public key associated with the terminal, - following successful verification of the first and second signature, releasing the access of the terminal to the attribute, - sending, to the terminal, a public key of the mobile radio device (100, 804) and a domain parameter associated with the public key, - calculating, by the mobile radio device (100, 804), a second secret, which is common to the mobile radio device (100, 804) and to the terminal, from a private key of the mobile radio device (100, 804), the session-based temporary public key of the terminal, and the domain parameter, - calculating, by the terminal, the common second secret from the public key of the mobile radio device (100, 804), the session-based temporary private key of the terminal, and the domain parameter, - generating a random third secret by the mobile radio device (100, 804), - sending the random third secret to the terminal, and - generating, by the mobile radio device (100, 804) and the terminal, a symmetric session key from the third secret and the common second secret,