| Abstract: | The problem of protecting an execution environment from possibly malicious mobile agents has been studied extensively, but the reverse problem, protecting the agent from malicious execution environments, has not. We propose an approach that relies on trusted and tamper-resistant hardware to prevent breaches of trust, rather than correcting them after the fact. We address the question of how to base trust on technical reasoning. We present a pessimistic approach to trust that tries to prevent malicious behavior from occurring in the first place, rather than correcting it after it has occurred |
