diff --git a/build.gradle b/build.gradle
index 5724707..62a8c2c 100644
--- a/build.gradle
+++ b/build.gradle
@@ -34,6 +34,9 @@ dependencies {
 
     //JSON Parser
     implementation 'com.google.code.gson:gson:2.8.5'
+
+    compile group: 'org.springframework.security', name: 'spring-security-core', version: '5.1.4.RELEASE'
+
 }
 
 node {
diff --git a/src/main/java/hhn/labsw/bugageocaching/controller/Controller.java b/src/main/java/hhn/labsw/bugageocaching/controller/Controller.java
index 9a03c55..b0b29d6 100644
--- a/src/main/java/hhn/labsw/bugageocaching/controller/Controller.java
+++ b/src/main/java/hhn/labsw/bugageocaching/controller/Controller.java
@@ -1,14 +1,18 @@
 package hhn.labsw.bugageocaching.controller;
 
 import com.google.gson.Gson;
-import hhn.labsw.bugageocaching.repositories.CacheRepository;
-import hhn.labsw.bugageocaching.repositories.RewardRepository;
-import hhn.labsw.bugageocaching.repositories.StationRepository;
+import hhn.labsw.bugageocaching.entities.*;
+import hhn.labsw.bugageocaching.exceptions.IllegalParameterException;
+import hhn.labsw.bugageocaching.repositories.*;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.web.bind.annotation.CrossOrigin;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.bind.annotation.RestController;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.crypto.bcrypt.BCrypt;
+import org.springframework.web.bind.annotation.*;
+
+import java.time.Clock;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicLong;
 
 @RestController
 public class Controller {
@@ -22,11 +26,92 @@ public class Controller {
   @Autowired
   StationRepository stationRepository;
 
-  @CrossOrigin(origins = "http://localhost:8081") // only for dev purpose
-  @RequestMapping("/allCaches")
+  @Autowired
+  BearbeitetRepository bearbeitetRepository;
+
+  @Autowired
+  CacheAccesDefinitionRepository cacheAccesDefinitionRepository;
+
+  @Autowired
+  TeamRepository teamRepository;
+
+  @Autowired
+  UserRepository userRepository;
+
+  private AtomicLong counter = new AtomicLong();
+
+  @RequestMapping("/api/allCaches")
   @ResponseBody
-  public String getAllCaches(){
+  public String getAllCaches() {
     return new Gson().toJson(cacheRepository.findAll());
   }
 
+  @RequestMapping("/api/login")
+  @ResponseBody
+  public ResponseEntity<Object> login(@RequestBody User user){
+    if(user.getUsername() == null || user.getPassword() == null){
+      return ResponseEntity.status(401).body(null);
+    }
+    if(userRepository.findByUsername(user.getUsername()) == null){
+      return ResponseEntity.status(401).body(null);
+    }
+
+    if(BCrypt.checkpw(user.getPassword(), userRepository.findByUsername(user.getUsername()).getPassword())){
+      String token = BCrypt.hashpw(String.valueOf(System.currentTimeMillis() + counter.incrementAndGet()), BCrypt.gensalt());
+      String hashedToken = BCrypt.hashpw(token, BCrypt.gensalt());
+      userRepository.findByUsername(user.getUsername()).setToken(hashedToken);
+      userRepository.save(userRepository.findByUsername(user.getUsername()));
+      return ResponseEntity.ok(new Gson().toJson(token));
+    }
+    return ResponseEntity.status(HttpStatus.BAD_GATEWAY).body(null);
+  }
+
+  @RequestMapping("/api/startCache")
+  public @ResponseBody
+  String startCache(@RequestParam(value = "userID", defaultValue = "-1") String userID,
+                    @RequestParam String cacheID) throws IllegalParameterException {
+
+    if (!userID.equals("-1")) { // ein angemeldeter user startet den cache(es werden zwei parameter übergeben)
+
+      Bearbeitet bearbeitet = new Bearbeitet();
+
+      Optional<User> userOptional = userRepository.findById(Integer.valueOf(userID));
+      if (userOptional.isPresent()) {
+        User user = userOptional.get();
+        bearbeitet.setUser(user);
+      } else {
+        throw new IllegalParameterException("There is no user with the ID " + userID);
+      }
+
+      Optional<Cache> cacheOptional = cacheRepository.findById(Integer.valueOf(cacheID));
+      if (cacheOptional.isPresent()) {
+        Cache cache = cacheOptional.get();
+        bearbeitet.setCache(cache);
+      } else {
+        throw new IllegalParameterException("There is no cache with the ID " + cacheID);
+      }
+
+      Optional<CacheAccesDefinition> cacheAccesDefinitionOptional =
+          cacheAccesDefinitionRepository.findById(1); // bearbeitet
+      if (cacheAccesDefinitionOptional.isPresent()) {
+        CacheAccesDefinition cacheAccesDefinition = cacheAccesDefinitionOptional.get();
+        bearbeitet.setCacheAccesDefinition(cacheAccesDefinition);
+      } else {
+        throw new IllegalParameterException("There is no cacheAccesDefinition with the ID " + 1);
+      }
+
+      bearbeitetRepository.save(bearbeitet);
+
+      return new Gson().toJson(bearbeitet);
+
+    } else { // kein angemeldeter User startet den cache(es wird nur der cache als parameter übergeben)
+      Optional<Cache> cacheOptional = cacheRepository.findById(Integer.valueOf(cacheID));
+      if (cacheOptional.isPresent()) {
+        Cache cache = cacheOptional.get();
+        return new Gson().toJson(cache);
+      } else {
+        throw new IllegalParameterException("There is no cache with the ID " + cacheID);
+      }
+    }
+  }
 }
diff --git a/src/main/java/hhn/labsw/bugageocaching/entities/Bearbeitet.java b/src/main/java/hhn/labsw/bugageocaching/entities/Bearbeitet.java
new file mode 100644
index 0000000..c2c284d
--- /dev/null
+++ b/src/main/java/hhn/labsw/bugageocaching/entities/Bearbeitet.java
@@ -0,0 +1,54 @@
+package hhn.labsw.bugageocaching.entities;
+
+
+import javax.persistence.*;
+
+@Entity
+@Table
+public class Bearbeitet {
+
+  @Id
+  @GeneratedValue
+  private int id;
+
+  @OneToOne
+  private User user;
+
+  @OneToOne
+  private Cache cache;
+
+  @OneToOne
+  private CacheAccesDefinition cacheAccesDefinition;
+
+  public int getId() {
+    return id;
+  }
+
+  public void setId(int id) {
+    this.id = id;
+  }
+
+  public User getUser() {
+    return user;
+  }
+
+  public void setUser(User user) {
+    this.user = user;
+  }
+
+  public Cache getCache() {
+    return cache;
+  }
+
+  public void setCache(Cache cache) {
+    this.cache = cache;
+  }
+
+  public CacheAccesDefinition getCacheAccesDefinition() {
+    return cacheAccesDefinition;
+  }
+
+  public void setCacheAccesDefinition(CacheAccesDefinition cacheAccesDefinition) {
+    this.cacheAccesDefinition = cacheAccesDefinition;
+  }
+}
\ No newline at end of file
diff --git a/src/main/java/hhn/labsw/bugageocaching/entities/CacheAccesDefinition.java b/src/main/java/hhn/labsw/bugageocaching/entities/CacheAccesDefinition.java
new file mode 100644
index 0000000..e3dd2dc
--- /dev/null
+++ b/src/main/java/hhn/labsw/bugageocaching/entities/CacheAccesDefinition.java
@@ -0,0 +1,31 @@
+package hhn.labsw.bugageocaching.entities;
+
+
+import javax.persistence.*;
+
+@Entity
+@Table
+public class CacheAccesDefinition {
+
+  @Id
+  @GeneratedValue
+  private int id;
+
+  private String description;
+
+  public int getId() {
+    return id;
+  }
+
+  public void setId(int id) {
+    this.id = id;
+  }
+
+  public String getDescription() {
+    return description;
+  }
+
+  public void setDescription(String description) {
+    this.description = description;
+  }
+}
diff --git a/src/main/java/hhn/labsw/bugageocaching/entities/Role.java b/src/main/java/hhn/labsw/bugageocaching/entities/Role.java
new file mode 100644
index 0000000..5019a0b
--- /dev/null
+++ b/src/main/java/hhn/labsw/bugageocaching/entities/Role.java
@@ -0,0 +1,34 @@
+package hhn.labsw.bugageocaching.entities;
+
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.Id;
+
+@Entity
+public class Role {
+
+  @Id
+  @GeneratedValue
+  private int id;
+  private String name;
+
+  public Role() {
+
+  }
+
+  public int getId() {
+    return id;
+  }
+
+  public void setId(int id) {
+    this.id = id;
+  }
+
+  public String getName() {
+    return name;
+  }
+
+  public void setName(String name) {
+    this.name = name;
+  }
+}
diff --git a/src/main/java/hhn/labsw/bugageocaching/entities/Team.java b/src/main/java/hhn/labsw/bugageocaching/entities/Team.java
new file mode 100644
index 0000000..d4dd2c2
--- /dev/null
+++ b/src/main/java/hhn/labsw/bugageocaching/entities/Team.java
@@ -0,0 +1,41 @@
+package hhn.labsw.bugageocaching.entities;
+
+import javax.persistence.*;
+import java.util.ArrayList;
+import java.util.List;
+
+@Entity
+@Table
+public class Team {
+
+  @Id
+  @GeneratedValue
+  private int id;
+
+  private String name;
+  private int rankingPoints;
+
+  public int getId() {
+    return id;
+  }
+
+  public void setId(int id) {
+    this.id = id;
+  }
+
+  public String getName() {
+    return name;
+  }
+
+  public void setName(String name) {
+    this.name = name;
+  }
+
+  public int getRankingPoints() {
+    return rankingPoints;
+  }
+
+  public void setRankingPoints(int rankingPoints) {
+    this.rankingPoints = rankingPoints;
+  }
+}
diff --git a/src/main/java/hhn/labsw/bugageocaching/entities/User.java b/src/main/java/hhn/labsw/bugageocaching/entities/User.java
new file mode 100644
index 0000000..ffbed7d
--- /dev/null
+++ b/src/main/java/hhn/labsw/bugageocaching/entities/User.java
@@ -0,0 +1,108 @@
+package hhn.labsw.bugageocaching.entities;
+
+import javax.persistence.*;
+import java.util.List;
+
+@Entity
+@Table
+public class User {
+
+  @Id
+  @GeneratedValue
+  private int id;
+
+  private String firstname;
+  private String lastname;
+  private String username;
+  private int rankingPointsSum;
+  private String email;
+  private String password;
+
+  @ManyToMany
+  private List<Role> roles;
+
+  private String token;
+
+  @ManyToOne
+  private Team team;
+
+  public int getId() {
+    return id;
+  }
+
+  public void setId(int id) {
+    this.id = id;
+  }
+
+  public String getFirstname() {
+    return firstname;
+  }
+
+  public void setFirstname(String firstname) {
+    this.firstname = firstname;
+  }
+
+  public String getLastname() {
+    return lastname;
+  }
+
+  public void setLastname(String lastname) {
+    this.lastname = lastname;
+  }
+
+  public String getUsername() {
+    return username;
+  }
+
+  public void setUsername(String username) {
+    this.username = username;
+  }
+
+  public int getRankingPointsSum() {
+    return rankingPointsSum;
+  }
+
+  public void setRankingPointsSum(int rankingPointsSum) {
+    this.rankingPointsSum = rankingPointsSum;
+  }
+
+  public String getEmail() {
+    return email;
+  }
+
+  public void setEmail(String email) {
+    this.email = email;
+  }
+
+  public String getPassword() {
+    return password;
+  }
+
+  public void setPassword(String password) {
+    this.password = password;
+  }
+
+  public Team getTeam() {
+    return team;
+  }
+
+  public void setTeam(Team team) {
+    this.team = team;
+  }
+
+  public List<Role> getRoles() {
+    return roles;
+  }
+
+  public void setRoles(List<Role> roles) {
+    this.roles = roles;
+  }
+
+  public String getToken() {
+    return token;
+  }
+
+  public void setToken(String token) {
+    this.token = token;
+  }
+}
diff --git a/src/main/java/hhn/labsw/bugageocaching/exceptions/IllegalParameterException.java b/src/main/java/hhn/labsw/bugageocaching/exceptions/IllegalParameterException.java
new file mode 100644
index 0000000..df77bae
--- /dev/null
+++ b/src/main/java/hhn/labsw/bugageocaching/exceptions/IllegalParameterException.java
@@ -0,0 +1,65 @@
+package hhn.labsw.bugageocaching.exceptions;
+
+
+/**
+ * Thrown to indicate that a method has been passed an illegal or inappropriate argument.
+ * This matches the IllegalArgumentException, but is no RuntimeException. This forces the
+ * developer to catch it.
+ * <p>
+ */
+public class IllegalParameterException extends Exception {
+  /**
+   * Constructs a new exception with {@code null} as its detail message.
+   * The cause is not initialized, and may subsequently be initialized by a
+   * call to {@link #initCause}.
+   */
+  public IllegalParameterException() {
+  }
+
+  /**
+   * Constructs a new exception with the specified detail message.  The
+   * cause is not initialized, and may subsequently be initialized by
+   * a call to {@link #initCause}.
+   *
+   * @param message the detail message. The detail message is saved for
+   *                later retrieval by the {@link #getMessage()} method.
+   */
+  public IllegalParameterException(final String message) {
+    super(message);
+  }
+
+  /**
+   * Constructs a new exception with the specified detail message and
+   * cause.  <p>Note that the detail message associated with
+   * {@code cause} is <i>not</i> automatically incorporated in
+   * this exception's detail message.
+   *
+   * @param message the detail message (which is saved for later retrieval
+   *                by the {@link #getMessage()} method).
+   * @param cause   the cause (which is saved for later retrieval by the
+   *                {@link #getCause()} method).  (A <tt>null</tt> value is
+   *                permitted, and indicates that the cause is nonexistent or
+   *                unknown.)
+   * @since 1.4
+   */
+  public IllegalParameterException(final String message, final Throwable cause) {
+    super(message, cause);
+  }
+
+  /**
+   * Constructs a new exception with the specified cause and a detail
+   * message of <tt>(cause==null ? null : cause.toString())</tt> (which
+   * typically contains the class and detail message of <tt>cause</tt>).
+   * This constructor is useful for exceptions that are little more than
+   * wrappers for other throwables.
+   *
+   * @param cause the cause (which is saved for later retrieval by the
+   *              {@link #getCause()} method).  (A <tt>null</tt> value is
+   *              permitted, and indicates that the cause is nonexistent or
+   *              unknown.)
+   * @since 1.4
+   */
+  public IllegalParameterException(final Throwable cause) {
+    super(cause);
+  }
+}
diff --git a/src/main/java/hhn/labsw/bugageocaching/repositories/BearbeitetRepository.java b/src/main/java/hhn/labsw/bugageocaching/repositories/BearbeitetRepository.java
new file mode 100644
index 0000000..fb4a270
--- /dev/null
+++ b/src/main/java/hhn/labsw/bugageocaching/repositories/BearbeitetRepository.java
@@ -0,0 +1,7 @@
+package hhn.labsw.bugageocaching.repositories;
+
+import hhn.labsw.bugageocaching.entities.Bearbeitet;
+import org.springframework.data.repository.CrudRepository;
+
+public interface BearbeitetRepository extends CrudRepository<Bearbeitet, Integer> {
+}
diff --git a/src/main/java/hhn/labsw/bugageocaching/repositories/CacheAccesDefinitionRepository.java b/src/main/java/hhn/labsw/bugageocaching/repositories/CacheAccesDefinitionRepository.java
new file mode 100644
index 0000000..2a01cab
--- /dev/null
+++ b/src/main/java/hhn/labsw/bugageocaching/repositories/CacheAccesDefinitionRepository.java
@@ -0,0 +1,7 @@
+package hhn.labsw.bugageocaching.repositories;
+
+import hhn.labsw.bugageocaching.entities.CacheAccesDefinition;
+import org.springframework.data.repository.CrudRepository;
+
+public interface CacheAccesDefinitionRepository extends CrudRepository<CacheAccesDefinition, Integer> {
+}
diff --git a/src/main/java/hhn/labsw/bugageocaching/repositories/TeamRepository.java b/src/main/java/hhn/labsw/bugageocaching/repositories/TeamRepository.java
new file mode 100644
index 0000000..edf1d5d
--- /dev/null
+++ b/src/main/java/hhn/labsw/bugageocaching/repositories/TeamRepository.java
@@ -0,0 +1,7 @@
+package hhn.labsw.bugageocaching.repositories;
+
+import hhn.labsw.bugageocaching.entities.Team;
+import org.springframework.data.repository.CrudRepository;
+
+public interface TeamRepository extends CrudRepository<Team, Integer> {
+}
diff --git a/src/main/java/hhn/labsw/bugageocaching/repositories/UserRepository.java b/src/main/java/hhn/labsw/bugageocaching/repositories/UserRepository.java
new file mode 100644
index 0000000..2434da1
--- /dev/null
+++ b/src/main/java/hhn/labsw/bugageocaching/repositories/UserRepository.java
@@ -0,0 +1,8 @@
+package hhn.labsw.bugageocaching.repositories;
+
+import hhn.labsw.bugageocaching.entities.User;
+import org.springframework.data.repository.CrudRepository;
+
+public interface UserRepository extends CrudRepository<User, Integer> {
+  User findByUsername(String username);
+}