A method for protecting data and path of a mobile agent from a first server within a network system with a plurality of servers (S 0, S 1,...,S n), at least a number of which the mobile agent has to pass according to an appropriate succession which defines the path of the mobile agent, characterized in that each of the plurality of servers has a pair of a public key (KS 0,...,KS i,..., KS n) and a private key (PKS 0,..., PKS i,..., PKS n) and an ip-address (ip(S 0), ip(S 1),..., ip(S n)), respectively, and the path and data intended for any one of the servers are jointly encrypted within a nested structure, the method comprising at least the following steps: - choosing a unique number and assigning it to the mobile agent, - choosing for each server the mobile agent has to pass a secret symmetric key (S i Ko), respectively, and assigning it to that respective server(S i), - encoding each secret key (S i Ko) with the public key (KS i) of the respective server (S i), - encrypting each secret key (S i Ko) and the public key (KS 0) of the first server (S 0) via a wrapping function (h), thus forming for each respective server (S i) an authentication code (h(KA, S i Ko)), - encoding via a recursive workflow the data and the path jointly in a nested structure consisting of a number of nested terms corresponding to the number of servers, each nested term being decryptable by exactly one server of the number of servers for access only to the data intended for the respective server and to a section of the path, respectively, and wherein a respective workflow starts by encoding as kernel of an innermost term the data intended for the last server (m n) in the succession with the last server's secret key (S n Ko), combines the unique number, that innermost term's kernel ({m n}S n Ko), the encoded respective secret key ({S n Ko}KS n), the respective data authentication code (h(KS 0, S n Ko)) and the ip-address (ip(S n)) of the last server (S n) and the ip-address (ip (S n-1)) of the second last server (S n-1) and encodes that combination with the private key (PKS 0) of the first server (S 0), thus forming the innermost term and serving combined with the ip-address of the last server and the data intended for the second last server as kernel of the second innermost term in the nested structure, and continues accordingly by generating successively the terms of the nested structure correspondingly to the innermost term, wherein each of the nested terms to be decoded by the respective servers for access to the respective data is defined according to the following scheme: Data_S i = r ⁢ 0, ip S i - 1, ip S i, S i ⁢ Ko ⁢ KS i, h KS 0, S i ⁢ Ko, m ʹ i ⁢ S i ⁢ Ko ⁢ P ⁢ KS 0 wherein r0 is the unique number, S i Ko is the respective server's secret key, KS i is the respective server's public key, h is the wrapping function, KS 0 is the first server's public key, PKS 0 is the first server's private key and m' i is the i'th term of the nested terms which is defined as follows: mʹ i = m i, ip ⁢ S i + 1, Data_S i + 1 wherein i is a positive integer value, m i is the data intended for the i'th server S i. - choosing a unique number and assigning it to the mobile agent, - choosing for each server the mobile agent has to pass a secret symmetric key (S i Ko), respectively, and assigning it to that respective server(S i), - encoding each secret key (S i Ko) with the public key (KS i) of the respective server (S i), - encrypting each secret key (S i Ko) and the public key (KS 0) of the first server (S 0) via a wrapping function (h), thus forming for each respective server (S i) an authentication code (h(KA, S i Ko)), - encoding via a recursive workflow the data and the path jointly in a nested structure consisting of a number of nested terms corresponding to the number of servers, each nested term being decryptable by exactly one server of the number of servers for access only to the data intended for the respective server and to a section of the path, respectively, and wherein a respective workflow starts by encoding as kernel of an innermost term the data intended for the last server (m n) in the succession with the last server's secret key (S n Ko), combines the unique number, that innermost term's kernel ({m n}S n Ko), the encoded respective secret key ({S n Ko}KS n), the respective data authentication code (h(KS 0, S n Ko)) and the ip-address (ip(S n)) of the last server (S n) and the ip-address (ip (S n-1)) of the second last server (S n-1) and encodes that combination with the private key (PKS 0) of the first server (S 0), thus forming the innermost term and serving combined with the ip-address of the last server and the data intended for the second last server as kernel of the second innermost term in the nested structure, and continues accordingly by generating successively the terms of the nested structure correspondingly to the innermost term, wherein each of the nested terms to be decoded by the respective servers for access to the respective data is defined according to the following scheme: Data_S i = r ⁢ 0, ip S i - 1, ip S i, S i ⁢ Ko ⁢ KS i, h KS 0, S i ⁢ Ko, m ʹ i ⁢ S i ⁢ Ko ⁢ P ⁢ KS 0 wherein r0 is the unique number, S i Ko is the respective server's secret key, KS i is the respective server's public key, h is the wrapping function, KS 0 is the first server's public key, PKS 0 is the first server's private key and m' i is the i'th term of the nested terms which is defined as follows: mʹ i = m i, ip ⁢ S i + 1, Data_S i + 1 wherein i is a positive integer value, m i is the data intended for the i'th server S i.