Patent Publication Number: US-2002010749-A1

Title: Message guaranty system

Description:
BACKGROUND OF THE INVENTION  
       [0001] The present invention relates to a message guaranty system and, more particularly, to a message guaranty system capable of guaranteeing that messages have indeed been transmitted and received between terminals connected on a network system.  
       [0002] A number of conventional methods exist for guaranteeing the transmission and reception of messages between workstations connected on a network system. One such method involves having the transmitting and receiving workstations each manage a message start serial number and a message end serial number which are assigned to each message sent from one side to the other. Another method requires establishing a sequence in which the receiving workstation returns an acknowledgement in response to each message received from the transmitting workstation.  
       [0003] More specifically, the former conventional method (of managing message serial numbers) requires that four serial numbers, i.e., the message start and message end serial assigned to each of the transmitting and receiving terminals, coincide with one another before transmission or reception of any message. When the transmitting terminal transmits the message, the receiving terminal increments its message start serial number by 1. With the message received, the receiving terminal increments its message start serial number by 1. The receiving terminal then processes the message. With the message processing completed, the receiving terminal increments its message end serial number by 1 and returns an acknowledgement message to the transmitting terminal. Having received the acknowledgment message, the transmitting terminal increments its message end serial number by 1. This terminates the entire processing of message transmission/reception. This kind of message serial number management is carried out under the NIF/OSI (Network Interface Feature/Open Systems Interconnection) protocol. If there occurs a serial number mismatch between the transmitting and the receiving terminal, an error is suspected to have occurred in the message processing.  
       [0004] The latter conventional method (of establishing an acknowledgement sequence) requires that the receiving terminal must always return an acknowledgement message (ACK) in response to the message sent from the transmitting terminal. The return of the ACK message is supposed to guarantee an error-free message transmission.  
       [0005] A further method is proposed by Japanese Patent Laid-open No. Hei 4-227154 (cited reference 1). The proposed method involves furnishing a securely managed encryption key and a powerful encryption algorithm whereby the transmitting terminal furnishes the target message with a token constituting a collection of specific information. Using the same encryption key and algorithm, the receiving terminal prepares an authentication token (a collection of information for authentication purposes) by which the token of the received message is checked for authenticity. If any dispute occurs between the transmitting and receiving parties regarding the transmission or reception of a particular message, the two parties alone are responsible for resolving it.  
       [0006] The above conventional methods are effective in detecting mismatches in message processing but fail to provide for eventualities in which the transmitting or receiving party denies having transmitted or received a specific message. Although the system of the cited reference 1 provides high degrees of message authentication, the fact that any dispute is left to be resolved not by any reliable third party but only by the parties concerned does not make the system suitable for an open, distributed environment.  
       SUMMARY OF THE INVENTION  
       [0007] It is therefore an object of the present invention to overcome the above and other deficiencies and disadvantages of the prior art and to provide a message guaranty system having a third party intervene in the transmission and reception of a message by a transmitting and a receiving terminal, the system guaranteeing that every message it mediated was indeed transmitted by the transmitting terminal and received by the receiving terminal. This invention differs from that of the cited reference 1 in that this invention gets a reliable third party in a neutral position to prepare evidence information regarding each message handled and that any dispute is resolved by the third party verifying the authenticity of the evidence information about the message in question.  
       [0008] It is another object of the present invention to provide a message guaranty system offering a delayed delivery service that takes a message from a transmitting terminal and delivers the message to its destination on behalf of the transmitting terminal, the system verifying the authenticity of the evidence information regarding any message so delivered which may be disputed between a plurality of terminals. When the reliable third party delivers a message to its destination on behalf of the transmitting terminal, the transmission and reception of the message are carried out more securely than ever. The inventive system acting as the thirty party effectively guarantees to any transmitting terminal both the transmission of the message in question and the reception thereof by the intended receiving terminal.  
       [0009] In achieving the foregoing and other objects of the present invention, there is provided a message guaranty system featuring the following points:  
       [0010] (1) The inventive message guaranty system for use with a plurality of terminals connected on a network furnishes each message sent from a transmitting to a receiving terminal with evidence information which is prepared by a third party and which attests to the transmission and reception of the message, whereby the transmission of any disputed message by the transmitting terminal or the reception of that message by the receiving terminal is subsequently certified.  
       [0011] (2) The evidence information includes the terminal name of the transmitting terminal (transmitter identifier), the terminal name of the receiving terminal (receiver identifier), time of message transmission, and the message length.  
       [0012] (3) The message guaranty system of the invention comprises evidence information preparing means for having a reliable third party prepare evidence information attesting to the transmission and reception of any message within the network, and evidence information converting means for converting the evidence information into an encryption format or other suitable form that will thwart any unscrupulous attempts to forge or falsify that information.  
       [0013] (4) The message guaranty system of the invention includes, within the connected network, delayed delivery means for transmitting a message to the receiving terminal on behalf of the transmitting terminal when such transmission is requested by the latter, so as to ensure more secure delivery of that message.  
       [0014] (5) The message guaranty system of the invention includes third party verification means for verifying the authenticity of evidence information about a particular message when such verification is requested by a plurality of terminals.  
       [0015] In operation, the message guaranty system of the above constitution offers the following advantages:  
       [0016] (1) According to the invention, any message sent from the transmitting terminal to the receiving terminal is furnished with evidence information which, prepared by the reliable third party, attests to the transmission and reception of that message. The highly reliable evidence information demonstrates unfailingly whether a particular message was actually delivered from one party to another. This feature facilitates the resolution of any message-related dispute between two contending parties.  
       [0017] (2) The evidence information preparing means of the invention prepares evidence information on the basis of such message-related information as the terminal name of the transmitting terminal (transmitter identifier), the terminal name of the receiving terminal (receiver identifier), time of message transmission, and the message length. Analyzing this evidence information provides a highly accurate verdict on the disputed message.  
       [0018] (3) The evidence information converting means of the invention converts the evidence information into an encryption format or other suitable form that will thwart any malicious or unscrupulous attempts to forge or falsify that information. This feature allows the inventive system to attest to the transmission and reception of any message with more certainty than ever.  
       [0019] (4) As mentioned, any message sent from the transmitting terminal to the receiving terminal is equipped with evidence information which is prepared and converted by the evidence information preparing and converting means and which attests to the transmission and reception of that message. This evidence information demonstrates whether a particular message was actually delivered from one party to another. If more security is desired in delivering a message, the delayed delivery means of the invention is used to transmit a message along with its evidence information from an evidence server comprising that means directly to the receiving terminal on behalf of the transmitting terminal. Interposed between the transmitting and the receiving terminal, the delayed delivery means offers more secure delivery of messages therebetween and directly attests to the transmission and reception of any of the messages so delivered.  
       [0020] (5) If a message-related dispute occurs between a plurality of communicating terminals and if these terminals request verification of the evidence information regarding the disputed message, the verification means of the invention verifies the authenticity of the evidence information in question.  
       [0021] Other objects and advantages of the invention will become apparent from the examination of the present disclosure. 
     
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
     [0022]FIG. 1 is a schematic diagram of a message guaranty system practiced as a first embodiment of the invention;  
     [0023]FIG. 2 is a view outlining the process in which the first embodiment prepares evidence E 1  attesting to the transmission of a message M 1 ;  
     [0024]FIG. 3 is a flowchart of steps constituting the process in which to prepare the evidence E 1  attesting to the transmission of the message M 1 ;  
     [0025]FIG. 4 is a flowchart of steps detailing what takes place in step  102  of FIG. 3;  
     [0026]FIG. 5 is a view illustrating the process in which the first embodiment verifies the evidence E 1  attesting to the transmission of the message M 1 ;  
     [0027]FIG. 6 is a flowchart of steps constituting the process in which to verify the evidence E 1  attesting to the transmission of the message M 1 ;  
     [0028]FIG. 7 is a flowchart of steps detailing what takes place in step  201  of FIG. 6;  
     [0029]FIG. 8 is a view outlining the process in which the first embodiment prepares evidence E 2  attesting to the reception of the message M 1 ;  
     [0030]FIG. 9 is a flowchart of steps in which to prepare the evidence E 2  attesting to the reception of the message M 1 ;  
     [0031]FIG. 10 is a view illustrating the process in which the first embodiment verifies the evidence E 2  attesting to the reception of the message E 1 ;  
     [0032]FIG. 11 is a flowchart of steps constituting the process in which to verify the evidence E 2  attesting to the reception of the message E 1 ;  
     [0033]FIG. 12 is a schematic diagram of a message guaranty system practiced as a second embodiment of the invention;  
     [0034]FIG. 13 is a view outlining the process in which the second embodiment prepares evidence E 3  attesting to the transmission of a message M 2 ;  
     [0035]FIG. 14 is a flowchart of steps in which to prepare the evidence E 3  attesting to the transmission of the message M 2 ;  
     [0036]FIG. 15 is a view illustrating the process in which the second embodiment verifies the evidence E 3  attesting to the transmission of the message M 2 ;  
     [0037]FIG. 16 is a flowchart of steps constituting the process in which to verify the evidence E 3  attesting to the transmission of the message M 2 ;  
     [0038]FIG. 17 is a view illustrating the process in which the second embodiment verifies evidence E 4  attesting to the reception of the message E 2 ;  
     [0039]FIG. 18 is a flowchart of steps constituting the process in which to verify the evidence E 4  attesting to the reception of the message M 2 ;  
     [0040]FIG. 19 is a view outlining the process in which the second embodiment prepares evidence attesting to the transmission of a message from a message control server  4  to a plurality of transmitting servers  40  through  42 ; and  
     [0041]FIG. 20 is a flowchart of steps constituting the process in which to prepare the evidence attesting to the transmission of a message from the message control server  4  to the multiple transmitting servers  40  through  42 .  
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS  
     [0042] Preferred embodiments of the invention will now be described with reference to the accompanying drawings. FIG. 1 is a schematic diagram of a message guaranty system practiced as a first embodiment of the invention and including a network system  1 . In FIG. 1, the network  1  is connected with an evidence preparing server  2 , an evidence verifying server  3 , and workstations (each called a WS)  10  through  12 ,  20 , and  30  through  32 . The first embodiment is characterized in that the servers  2  and  3  are each constituted not by any configured workstation but by a reliable third party. Although the first embodiment has the evidence preparing server  2  and the evidence verifying server  3  implemented separately for explanatory purposes, they may be integrated in a single server unit. When an application program (called an AP)  13  started on a WS  10  illustratively transmits a message M 1  to an AP  21  on a WS  20 , the evidence preparing server  2  prepares evidence information (or simply called evidence) E 1  attesting to the transmission of the message M 1  from the AP  13  on the WS  10  to the AP  21  on the WS  20 . How the evidence preparing server  2  prepares the evidence E 1  will be described later in detail with reference to FIG. 4.  
     [0043] The WS  10  furnishes the target message M 1  with the evidence E 1  prepared by the evidence preparing server  2  and transmits the message along with the evidence to the WS  20  (to be described later with reference to FIG. 2).  
     [0044] The evidence verifying server  3  acts to verify the authenticity of the evidence information thus prepared. Such verification of evidence is generally conducted in case of a message processing discrepancy resulting in a dispute between, say, the WS  10  and the WS  20 . It is also possible for the WS  20  to request evidence verification upon receipt of the message M 1  along with the evidence E 1 . One such example is that of FIG. 5, to be described later, in which the AP  21  on the WS  20  requests the evidence verifying server  3  to verify the authenticity of the evidence E 1 .  
     [0045] How the evidence E 1  for the message M 1  is prepared will now be described with reference to FIG. 2 and to the flowchart of FIG. 3. When the AP  13  on the WS  10  requests the evidence preparing server  2  to prepare the evidence E 1  for the message M 1 , the server  2  checks to see if the request is valid (step  101 ). If the request is found to be valid, the evidence preparing server  2  accepts the message M 1  and prepares the evidence E 1  based on the message contents (step  102 ). The evidence preparing server  2  retains the evidence E 1  thus prepared (how to retain it is a local matter) and returns the same evidence to the WS  10  (step  103 ). If the request made by the AP  13  is found to be invalid in step  101 , that request is reported to a security authority (step  104 ). The security authority is provided on the network for the purpose of having overall control on message-related problems on the network. The security authority is responsible for proper enforcement of security-related rules and regulations (i.e., security policy) within the management domain indicated in FIG. 1. If a security breach is detected within the management domain (in step  101 ), the evidence preparing server  2  must notify the security authority of that breach. The kind of security policy and the manner of implementing it, as well as ways to analyze security breaches, are not directly relevant to this invention and will not be discussed herein.  
     [0046] The process in which the evidence preparing server  2  prepares the evidence E 1  (i.e., step  102 ) will now be described in more detail with reference to FIG. 4. The evidence preparing server  2  acquires from the WS  10  information comprising the message name, the transmitter identifier (identifying, e.g., WS  10  paired with AP  13 ), the receiver identifier (identifying, e.g., WS  20  paired with AP  21 ), the time of transmission of the message M 1 , and the length of the message M 1  (step  1021 ). The evidence E 1  is prepared on the basis of these items of information. If it is necessary to convert the evidence information into an encryption format immune to forgery or falsification (step  1023 ), the evidence preparing server  2  encrypts the evidence E 1  using an encryption algorithm known only to this server (step  1024 ). The WS  10  furnishes the target message M 1  with evidence E 1 ′ (E(E 1 )) prepared by the evidence preparing server  2 , and transmits the message M 1  along with the evidence to the WS  20 .  
     [0047] How the evidence E 1  of the message M 1  is verified will now be described with reference to FIGS. 5 and 6. In response to a request by the AP  21  on the WS  20  for verification of the evidence E 1 , the evidence verifying server  3  receives the message M 1  and checks to see if the evidence E 1  attached to the message M 1  is valid (step  201 ). If the evidence E 1  is found to be valid, the evidence verifying server  3  retains the evidence E 1  (how to retain it is a local matter) and returns the result of the verification to the WS  20  (step  202 ). If the evidence E 1  is found to be invalid in step  201 , the security authority is notified thereof (step  203 ).  
     [0048] The process in which the evidence verifying server  3  verifies the evidence E 1  (i.e., step  201 ) is depicted in more detail in FIG. 7. Where the evidence preparing server  2  and the evidence verifying server  3  exist as different server units, it is necessary to install beforehand a common encryption algorithm in both servers. In that case, the evidence verifying server  3  needs to be supplied, in advance during the processing of FIG. 4, with the evidence E 1  prepared by the evidence preparing server  2 . The evidence verifying server  3  checks to see if conversion (i.e., decryption) of the evidence E 1  attached to the message M 1  from the WS  20  is requested. If such a request is found to have been made, the evidence verifying server  3  decrypts the evidence E 1  using the encryption algorithm (steps  2011  and  2012 ). The information contained in the decrypted evidence E 1  is then analyzed and checked against such items of information as the transmitter identifier (identifying, e.g., WS  10  paired with AP  13 ), the receiver identifier (identifying, e.g., WS  20  paired with AP  21 ), the time of transmission of the message M 1 , and the length of the message M 1  (step  2013 ). With these items of information verified, the evidence verifying server  3  determines whether the evidence E 1  is valid as evidence information relevant to the message M 1 . At this point, the evidence E 1  from the WS  20  may alternatively be checked against the evidence E 1  received directly from the evidence preparing server  2  (prepared in the processing of FIG. 4) for coincidence. The coincidence of the evidence from the two different sources should enable more accurate message verification.  
     [0049] After step  202 , the evidence verifying server  3  returns to the WS  20  the result of verification of the evidence E 1 , and requests the evidence preparing server  2  to prepare information (herein called evidence E 2 ) attesting to the reception of the message M 1  by the WS  20  from the WS  10 . The sequence in which to request the preparation of the evidence E 2  is shown in FIG. 8.  
     [0050] How the evidence E 2  attesting to the reception of the message M 1  is prepared will now be described with reference to FIGS. 8 and 9. It may happen that the system is so configured that the evidence preparing server  2  and evidence verifying server  3  are implemented in the same server unit. In that case, all exchanges between the two servers in FIGS. 8 and 9 can be omitted.  
     [0051] The evidence verifying server  3  first requests the evidence preparing server  2  to prepare the evidence E 2  attesting to the reception of the message M 1  by the WS  20  from the AP  13  on the WS  10  (step  301 ). In turn, the evidence preparing server  2  prepares the evidence E 2  attesting to that effect (step  302 ). Concrete steps to prepare the evidence E 2  comply with the processing of FIG. 4. It should be noted that in place of TM  1  (time of transmission of the message M 1 ), the time at which the WS  20  received the message M 1  is designated. The evidence preparing server  2  retains the evidence E 2  (how to retain it is a local matter) and returns the same evidence to the evidence verifying server  3  (step  303 ). The evidence verifying server  3  retains the received evidence E 2  along with the evidence E 1  stored previously (step  304 ).  
     [0052] Although the evidence verifying server  3  requests the evidence preparing server  2  to prepare the evidence E 2  in the above example, the AP  21  on the WS  20  may alternatively request the evidence preparing server  2  to prepare the evidence E 2 .  
     [0053] How to attest to the transmission and reception of a message will now be described with reference to FIGS. 10 and 11. FIG. 10 is a view illustrating the process in which the first embodiment verifies the evidence E 2  attesting to the reception of the message E 1 . If a message processing discrepancy occurs and results in a dispute between the WS  10  and the WS  20 , the processing of FIG. 10 is generally carried out for verification. FIG. 11 is a flowchart of steps corresponding to the processing of FIG. 10. Given a request from the AP  13  on the WS  10  for verification of the evidence E 2 , the evidence verifying server  3  checks to see if the request is valid (step  401 ). If the request is found to be valid, the evidence verifying server  3  receives the evidence E 1  from the WS  10  and checks to see if there exists evidence E 2  corresponding to the evidence E 1  (step  402 ). The evidence verifying server  3  then returns to the WS  10  the result of the verification attesting to the presence or the absence of the evidence E 2  (step  403 ). If the request is found to be invalid in step  401 , the security authority is notified thereof (step  404 ). If the result from the evidence verifying server  3  indicates the presence of the evidence E 2  corresponding to the evidence E 1 , the WS  10  knows that the WS  20  indeed received the message M 1 .  
     [0054] A second embodiment of the invention will now be described with reference to FIGS. 12 through 20. FIG. 12 is a schematic diagram of a message guaranty system practiced as the second embodiment of the invention and including a network system  1 . In FIG. 12, the network  1  is connected with a message control server  4 , an evidence preparing server  2 , an evidence verifying server  3 , and workstations (WS)  10  through  12 ,  20 , and  30  through  32 . The second embodiment differs from the first embodiment in that the second includes the message control server  4 . The rest is the same as the first embodiment. The message control server  4  provides control illustratively on the transmission and reception of messages between the AP  13  on the WS  10  and the AP  21  on the WS  20 , on the evidence preparing server  2  and on the evidence verifying server  3 . Although the second embodiment has a plurality of servers implemented separately for explanatory purposes, they may be integrated in one or two server units.  
     [0055] How to prepare evidence E 3  for a message M 2  will now be described with reference to FIGS. 13 and 14. When the AP  13  on the WS  10  requests the evidence preparing server  2  to prepare the evidence E 3  attesting to the transmission of the message M 2  from the AP  13 , the server  2  checks to see if that request is valid (step  501 ). If the request is found to be valid, the evidence preparing server  2  receives the message M 2  and prepares the evidence E 3  based on the message contents (step  502 ). The contents of the evidence E 3  are the same as those of the evidence E 1  and will not be described further. The evidence preparing server  2  retains the evidence E 3  thus prepared and returns the same evidence to the WS  10  (step  503 ). Where the evidence preparing server  2  and the evidence verifying server  3  are separately implemented, the evidence preparing server  2  sends the evidence E 3  to the evidence verifying server  3  as well. If the request by the AP  13  is found to be invalid in step  501 , the security authority is notified thereof (step  504 ).  
     [0056] The WS  10  furnishes the message M 2  with the evidence E 3  prepared by the evidence preparing server  2  and transmits the message M 2  along with the evidence E 3  to the message control server  4 . This procedure is effective where the transmission of a message from the WS  10  to the WS  20  is delegated to the message control server  4  to ensure higher levels of security.  
     [0057]FIG. 15 is a view illustrating the process in which the second embodiment verifies the evidence E 3  attesting to the transmission of the message M 2 . What takes place in the setup of FIG. 15 will be described below in more detail with reference to the flowchart of FIG. 16. The message control server  4  requests the evidence verifying server  3  to verify the evidence E 3  (step  601 ). When so requested by the message control server  4 , the evidence verifying server  3  checks to see if the evidence E 3  attached to the message M 3  is valid (step  602 ). The method of verifying the evidence E 3  is the same as that of verifying the evidence E 1  described with reference to FIG. 7 and will not be described further. If the result of the verification is correct, the evidence verifying server  3  retains the evidence E 3  and returns the result of the verification to the message control server  4  (step  603 ). The message control server  4  prepares management information MO for its own management, attaches the information MO to the message M 2  and transmits the same information to the WS  20  (step  604 ). The management information MO serves as evidence information attesting to the fact that the message transmission from the WS  10  to the WS  20  is delegated to the message control server  4 . In that respect, the management information MO complies with the format determined by the message control server  4 . Illustratively, the information includes such items as the transmitting terminal name, receiving terminal name, message ID, and ID of the message control server  4 . Furthermore, with the message M 2  delivered to the WS  20 , the message control server  4  prepares information (called evidence E 4 ) attesting to the reception of the message M 2  by the WS  20  from the WS  10  (step  605 ). Where the servers  2 ,  3  and  4  are separately implemented, the message control server  4  may get the evidence preparing server  2  to prepare the evidence E 4 . The evidence E 4  thus prepared is sent to both the message control server  4  and the evidence verifying server  3  for storage. On the other hand, if the evidence verifying server  3  finds the evidence E 3  invalid following the receipt of the request for its verification, the evidence verifying server  3  notifies the security authority thereof (step  606 ).  
     [0058] For delivery of the message from the message control server  4  to the WS  20 , the message control server  4  may additionally furnish the message with information for ascertaining the willingness on the part of the WS  20  to really perform the transaction.  
     [0059]FIG. 17 is a view illustrating the process in which the second embodiment verifies evidence E 4  attesting to the reception of the message E 2 . If a message processing discrepancy occurs and results in a dispute between the WS  10  and the WS  20 , the processing of FIG. 17 is carried out for verification. What takes place in the setup of FIG. 17 will now be described in more detail with reference to the flowchart of FIG. 18. Although the evidence verifying server  3  is generally responsible for this verification process, the message control server  4  may take over the process instead. (FIGS. 17 and 18 show an example in which the message control server  4  carries out the verification process.) When the AP  13  on the WS  10  requests the evidence verifying server  3  to verify the evidence E 4 , the evidence verifying server  3  checks to see if that request is valid (step  701 ). If the request is found to be valid, the evidence verifying server  3  receives the evidence E 3  and verifies whether there exists evidence E 4  corresponding to the evidence E 3  (step  702 ). The result of the verification is returned to the WS  10  (step  703 ). If the request is found to be invalid in step  701 , the security authority is notified thereof (step  704 ).  
     [0060]FIG. 19 is a view outlining the process in which the second embodiment prepares evidence attesting to the transmission of a message from the message control server  4  to a plurality of transmitting servers  40  through  42 . The processing of FIG. 19 is the same as that of FIG. 12 in terms of interposing the message control server  4  between the transmitting and the receiving terminal. What makes the processing of FIG. 19 different from that of FIG. 12 is that the former involves the use of a plurality of transmitting servers for the actual transmission and reception of messages. The message control server  4  must prepare evidence information upon verifying the transmission and reception of any message between these transmitting servers. What takes place in the setup of FIG. 19 will now be described with reference to the flowchart of FIG. 20. The message control server  4  transmits to transmitting servers  4   i  (i=0−2) the message M 2  furnished with the evidence E 3  and management information MO (step  801 ). The transmitting servers  4   i  are each a server with a transmitting and receiving (i.e., repeating) function and an evidence preparation and storage function. As such, the transmitting servers  4   i  prepare evidence Ej (j=5−7) attesting to the transmission of the message and store that evidence (step  802 ). The evidence Ej thus prepared is returned to the message control server  4 , and the message M 2  is sent to the transmitting servers  4   i   +1  (step  803 ). The message control server  4  prepares the evidence E 4  based on the returned evidence Ej (step  804 ). The procedure above allows the message control server  4  to manage and verify in a comprehensive manner the routes through which the message M 2  passed.  
     [0061] With the second embodiment, the transmitting terminal requests the receiving terminal to prepare and verify the evidence E 1  through evidence E 3 . Alternatively, the receiving terminal may request the transmitting terminal to do the same.  
     [0062] As described, the message control server  4  intervenes in the transmission of a message from the WS  10  to the WS  20 . By way of such intervention, the message control server  4  prepares evidence attesting both to the message transmission from the transmitting terminal and to the message reception by the receiving terminal. This makes it impossible not only for the transmitting terminal to deny it ever issued the message M 2 ; it also makes it impossible for the receiving terminal to claim that it never received the message M 2  for such putative reasons as a network system error.  
     [0063] The above embodiments utilize encryption in preventing malicious or unscrupulous attempts to forge or falsify evidence information. Alternatively, the hash function may be employed to provide against tampering.  
     [0064] The above embodiments use evidence information attesting to the transmission and reception of a message effected by the transmitting and the receiving terminal (WS  10  and WS  20 ), respectively. An alternative embodiment may use security information for verifying the security of a message to be sent from the transmitting terminal to the receiving terminal. In that case, the embodiment includes security information preparing means (corresponding to the evidence preparing server  2 ) for preparing security information attesting to the security of the message to be sent from the transmitting terminal, the preparation being effected upon receipt of a request for such security information. The security information thus prepared is retained by the preparing means, and is also transmitted to the transmitting terminal. The embodiment further includes verifying means for verifying whether particular security information is valid upon receipt of a request from either the transmitting or the receiving terminal for verification of the security information in question. If the security information is found to be valid, that information is retained, and the other terminal is notified of the result of the verification.  
     [0065] Another alternative embodiment may comprise control means (corresponding to the message control server  4 ) for control on the exchanges of messages between a plurality of terminals, on the security information preparing means, and on the verifying means. The kinds of control involved pertain to the preparation of receipt information attesting to the reception of a message by the receiving terminal, to the request for the preparing means to prepare security information, and to the request for the verifying means to verify security information and exchange-related information.  
     [0066] As described, the message guaranty system according to the invention offers the following advantages:  
     [0067] (1) According to the message guaranty system of the invention, any message sent from the transmitting terminal to the receiving terminal is furnished with evidence information which, prepared by the reliable third party, attests to the transmission and reception of that message. The highly reliable evidence information demonstrates unfailingly whether a particular message was actually delivered from one party to another, thereby guaranteeing the security of the message in question. This feature permits accurate, discrepancy-free exchanges of messages between the parties concerned and facilitates the resolution of any message-related dispute therebetween.  
     [0068] (2) The evidence information preparing means of the invention prepares evidence information on the basis of such message-related information as the transmitter identifier, the receiver identifier, the time of message transmission and the message length. Analyzing this evidence information provides a highly accurate verdict on the disputed message.  
     [0069] (3) The evidence information converting means of the invention converts the evidence information into an encryption format or other suitable form that will thwart any malicious or unscrupulous attempts to forge or falsify that information. This feature allows the inventive system to attest to the transmission and reception of any message with more certainty than ever.  
     [0070] (4) The delayed delivery means of the invention may be used to transmit a message along with its evidence information from the evidence server comprising that means directly to the receiving terminal on behalf of the transmitting terminal. Acting as it does, the delayed delivery means offers more secure delivery of messages between the transmitting and the receiving terminal.  
     [0071] (5) If a message-related dispute occurs between a plurality of communicating terminals and if these terminals request verification of the evidence information regarding the disputed message, the verification means of the third party verifies the authenticity of the evidence information in question.  
     [0072] As many apparently different embodiments of this invention may be made without departing from the spirit and scope thereof, it is to be understood that the invention is not limited to the specific embodiments thereof except as defined in the appended claims.