DI chip, communication device, system and operation method

Abstract

DI (device identification) wafers, smartphones, communication devices, systems, methods, or methods of operation can impart punitive impairment to network criminals and network terrorism. Comprising the steps of establishing a DI database, setting required specified DI information, formatting a DI data packet, and transmitting an operation instruction of verifying the DI data packet. The DI repository may include prohibited DI manifests and / or limited DI member manifests. The punishment measure combined with the prohibited DI list enables communication equipment of a network criminal offender not to access the Internet once the communication equipment is registered in the prohibited DI list, and the operation system of the network criminal offender also fails. Thus, a network crime / network terrorism can perform any network crime for free at the first time. It is likewise unique to a DI member-specific list that will allow only communication devices pre-registered with DI information to access the central server, thereby also preventing for the first time any potential network attacks from unknown communication devices.

Description

Field of the Invention

[0001] The present invention generally relates to the field of providing network security protection. More specifically, a network security communication chip, device, system, process, method, program and operating system are provided to be able to impose punitive damages on cyber criminals and cyber terrorists by prohibiting their communication devices from providing Internet access. It also relates to providing a dedicated Internet or network for DI members that can only be accessed by communication devices with pre-registered device identification (DI). Background of the Invention

[0002] The applicant has been committed to the research of energy-saving power supply system since 1998, and has made great progress in energy-saving power supply system (U.S. Patent No. 6,098,175, 2000); energy-saving power supply system using keep-alive DC power supply to continuously power control circuit (U.S. Patent No. 6,098,175); remote instant access computer with keep-alive memory (U.S. Patent No. 6,341,354); communication device selectively switching between main processor with main operation instructions and keep-alive processor with keep-alive operation instructions (U.S. Patent No. 6,658,576); device and operating system with multiple operation functions stored in keep-alive memory (U.S. Patent No. 6,920,573); and operating system providing energy-saving operation function, US-20050268126-A1. Energy saving is a key function required for the development of many modern computers / laptops, servers, mobile phones (or cellular phones and smart phones), AI (artificial intelligence) and other digital communication applications, and on the other hand, it also provides convenience for cyber criminals, including criminals who use computers or smart phones with the above-mentioned energy-saving power function to conduct telephone fraud.

[0003] One of the most significant factors leading to the devastating commercial impact of skyrocketing cyber risk and billions of dollars in economic losses is that it is essentially a cost-free scheme for cybercriminals who initially purchase stolen sensitive data, ransomware, malware, exploit kits, and cyberattack services from the dark web without paying any fees. The dark web is known as a part of the deep web that is intentionally hidden, unindexed, and inaccessible to search engines and is used to hide and facilitate heinous cybercriminal activities. The severity of OpenAI's ChatGPT's newly developed application is still evident due to a vulnerability in the open source library it uses that exposed payment-related information and other sensitive information of its ChatGPT Plus subscribers. The use of ChatGPT can also lead to the accidental disclosure of corporate information. Cybercriminals can deploy artificial intelligence to replicate the voice and video of a victim's friends or relatives to conduct video call scams.

[0004] In response to fraudulent calls, U.S. Patent No. 9,060,057 discloses a system or method for caller ID authentication and fraud detection based on call processing (e.g., whitelist and blacklist phone numbers). However, '057 teaches blocking all calls without providing the option to leave a voicemail for misidentified calls. U.S. Patent No. 11,146,676 provides a method for automatically authenticating incoming calls through a shared key and login credentials. U.S. Patent No. 10,757,116 discloses a system and method for dynamically modifying client role-based access control based on an activity that is initially granted access to a network resource and then determined by a second reputation score to be modified. U.S. Patent No. 10,938,811 provides a communicator configured to communicate with a host device and an external device, and a processor configured to rely on a "user ID" from the external device to achieve secure access to information. U.S. Patent No. 11,218,324 discloses a method for authenticating a requesting device using a verified evaluator by an authentication device configured to receive and digitally sign an assertion. U.S. Patent Application No. 2023 / 0156023 provides a computing platform for achieving secure participation by authenticating biometric information of the user to be received. U.S. Patent Application No. 2022 / 0060498 aims to protect a node network from malicious or unauthorized activities by processing a data packet to determine whether a data packet, a first node, or a second node is untrustworthy. U.S. Patent No. 11,337,076 provides a data network security platform executed on a home network router. U.S. Patent No. 7,058,613 discloses a device including an arithmetic formula for checking the identity of a user. U.S. Patent Application No. 2023 / 0155829 provides another authentication scheme in a virtual private network by confirming the authenticity / identity of the user.

[0005] Obviously, these prior art patents mentioned above implement various aspects of network security, but rely heavily on authentication of user identity or biometric information. U.S. Patent No. 8,204,833 provides a technology for generating fingerprints of computers and their users based on information collected through the actions taken by the user on the Internet. '833 treats device and account information as a complete set of authentication entries, rather than relying on a representative of an individual. These prior art patents and applications are generally related to the CPC classification under Class 726 Information Security and Subclass H04L Digital Information Transmission.

[0006] To more strictly support the novelty of the present invention, subgroups with different degrees of relevance are broadly considered herein, including H04L65 / 1079 call control particularly related to identifying SPAM VoIP calls; 51 / 212 message exchange systems, such as email systems, with filtering and selective blocking capabilities; 63 / 14 for detecting or protecting against malicious traffic; 63 / 00 network architecture or network communication protocols for network security; H04L63 / 1458 mitigation of denial of service attacks; 9 / 3226 using a predetermined password, passphrase or PIN to support the authentication of an entity; 9 / 32 including devices for verifying the identity or authority of a system user; 63 / 00 network architecture or network communication protocols for network security; 9 / 00 encryption mechanisms or encryption arrangements for secret or secure communications; H04W12 / 00 network architecture or network communication protocols for wireless network security; and G06F21 / 00 security arrangements for protecting computers or computer systems from unauthorized activities.

[0007] Compared to the prior art that utilizes user identity authentication to grant network access rights, the present invention aims to achieve network security protection by actively creating punitive measures to inflict economic losses on cyber criminals and cyber terrorists. More specifically, the present invention discloses the creation, updating and synchronization of prohibited and / or allowed DI (device identification) lists. The punitive measures combined with the prohibited DI list are to inflict economic punitive damages on Internet cyber criminals by making it impossible for their communication devices to access secured or even unsecured Internet or network communications in the future once they are identified as being involved in malicious activities. According to the present invention, for the first time, no cyber criminal can continue to carry out malicious cyber criminal activities without facing the risk of punitive damages. The allowed DI list includes device identification information of predefined or preselected communication devices, which is used to grant DI-members exclusive Internet or network access rights, thereby preventing any unauthorized activities of unknown communication devices. Summary of the invention

[0008] Therefore, the first major preferred embodiment of the present invention is to provide a network security Internet system, which has punitive measures for punishing cyber criminals and cyber terrorists. Specifically, the punitive measures are to prohibit the Internet access function of the communication device of the cyber criminal once it is determined that the communication device of the cyber criminal is involved in cyber criminal activities. The first main preferred embodiment includes: (a) a communication device for accessing Internet data; (b) a storage device storing a prohibited DI (device identification) list of communication devices prohibited from providing Internet or online access; (c) a control system for controlling the operation of the communication device and the storage device; and (d) operating instructions stored in the storage device, which the control system can use to: (i) allow the communication device to initiate the first stage communication in response to an incoming signal from the communication device to obtain the DI information of the communication device; (ii) promote the communication device to the second stage communication to grant online access to the web page only when the DI information is received and the DI information is not included in the prohibited DI list; (iii) if it is detected that the online access of the communication device involves bad activities on the web page, then implement penalty measures by revoking the online access rights previously granted to the communication device; and (iv) add the DI information of the communication device involved in the bad activities to the prohibited DI list to implement the penalty measures. In addition, once the communication device is registered in the prohibited DI list, the penalty measures will further deprive its hardware device / component of reusability and invalidate its machine-based operating system license, thereby causing punitive damage to cyber criminals and cyber terrorists. The operational directive further synchronizes the banned DI list with other Internet systems participating in cybersecurity protection so that any communication device with DI information, once identified as participating in bad activities on one Internet system, will be comprehensively banned by all other Internet systems as punitive damages.

[0009] The second main preferred embodiment of the present invention is to provide a punitive network security protection method for protected Internet data. The method includes: (a) setting, for any remote communication device requesting online access, setting DI information that needs to be obtained, wherein the DI information includes at least one ID selected from the group consisting of IDs of hardware components and / or software of the remote communication device, wherein the ID refers to identification, identifier, identity, serial number and / or address; (b) establishing, for the remote communication device to be prohibited from online access to protected data, establishing a disabled DI list; (c) in response to an incoming signal of the communication device, obtaining DI information of the communication device; and (d) only when the DI information is obtained and the DI information is not included in the disabled DI list, access to protected data is allowed; (e) if it is detected that the communication device has participated in bad activities on the protected web page, online access is not allowed; and (f) the DI information of the communication device participating in bad activities is added to the disabled DI list to update the penalty measures.

[0010] The third main preferred embodiment of the present invention is to further provide a punitive network security operation method for public or non-secure Internet data. The method includes: (a) establishing a prohibited DI list to prohibit a communication device from providing online access rights as a punitive measure; (b) obtaining DI information of a communication device in response to an incoming signal sent from the communication device; (c) allowing online access on a web page only when the DI information is received and the DI information is not included in the prohibited DI list; (d) prohibiting online access if it is detected that the communication device has participated in bad activities on the web page; and (e) adding DI information of the communication device involved in bad activities to the prohibited DI list to update the punitive measures.

[0011] A fourth major preferred embodiment of the present invention is to provide a method for securely operating a DI-member exclusive network. The method includes: (a) constructing an allowed DI list for predefined or preselected communication devices that are allowed to access the DI-member exclusive network; (b) obtaining DI information of the communication device in response to an incoming signal sent from the communication device; (c) granting access to the DI-member exclusive network only when the DI information is received and included in the allowed DI list; and (d) updating the allowed DI list if necessary.

[0012] The fifth main preferred embodiment of the present invention is to provide a smartphone network security protection method for handling fraudulent calls and / or phishing messages. The method includes: (a) establishing an allowed list, a prohibited list, a repeated list that is performed at any time together with the prohibited list, and / or a prohibited list that is always prohibited, wherein the allowed list includes at least the contacts of the smartphone as a contact list, and the repeated list refers to an incoming signal that repeatedly requests to establish communication; (b) providing, during normal working hours, providing a first-stage communication in a silent mode or a "time-independent Do Not Disturb" mode (i.e., turning off the traditional time-related "Do Not Disturb" mode during the day), for the following steps: (i) obtaining, obtaining ID information from the incoming signal, wherein the ID refers to an identifier selected from the group consisting of at least one phone number, at least one sender identity, at least one email address, at least one social network media account, at least one device identifier (e.g., a name, a serial number, or a string of characters), at least one social network media account, and any combination thereof; (ii) comparing, comparing the ID information with the allowed list, the prohibited list, the prohibited list, and the repeated list; (iii) deny, if the ID information matches the prohibited list, and / or matches the forbidden list but does not match the repeat list, deny the communication request; and (iv) allow, if the ID information is not included in the allowed list, the forbidden list and the repeat list, allow the message to be left; wherein the message is selected from the group consisting of voicemail, text message, multimedia message, video message and any combination thereof; and (c) promote, when the ID information (i) matches the allowed list, and / or (ii) matches the repeat list but does not match the prohibited list, promote the smartphone to the second stage of communication in active mode, indicating an audio / visual / vibration notification that should be paid attention to immediately.

[0013] The sixth main preferred embodiment of the present invention is to provide a DI operating system for establishing DI communication, including: (a) establishing, on an Internet communication device, a DI database for controlling whether online access requests from communication devices are allowed, wherein the DI database includes DI information of the communication device to be controlled, and the DI information is selected from a group consisting of system DI, hardware DI, software DI, any conversions thereof, and any combination of their respective component IDs; (b) setting specified DI information to be received from the communication device that issues an online access request; (c) formatting, formatting the specified DI information into at least one DI data packet, a reference bit string; and (d) transmitting, transmitting at least one DI data packet from the communication device to the Internet communication device for verification.

[0014] The seventh main preferred embodiment is to provide a DI chip for realizing trusted inbound and outbound communication, including: (a) an input / output device for establishing a circuit connection with hardware components such as a motherboard, a microprocessor, a graphics processing unit and a memory; (b) a DI mutual communication device for circuit communication with the input / output device to obtain ID information of the hardware components and the software, wherein the ID information is selected from a computer system product ID, a universally unique identifier (UUID), an Internet IP address, a domain name address, a URL address, a MAC address of a wired and / or wireless communication circuit, a mobile device ID, a phone number ID, a hardware VPN ID, a basic input / output system firmware ID, a motherboard ID, a microprocessor ID, a graphics processing unit ID, a RAM module ID, a memory ID, a TPM module ID (including a generated ID), a monitor ID, a device OS license ID, an activation code, an installation ID, a digital license ID, a machine ID (including a client machine ID), a software VPN ID, a link to a software developer server for account verification; wherein ID refers to an identification, identifier, identity, serial number and / or address selected from the group consisting of numbers, letters, characters, printed symbols and any combination thereof; and (c) a control device including a coprocessor and instructions for (i) setting the content of the ID to be focused and selected and / or included to form DI information; and (ii) formatting the DI information into a form suitable for transmission so as to provide trusted DI communication to a remote communication device; (d) a persistent memory circuit for storing the DI information as a device fingerprint to enable trusted inbound and outbound communication; (e) an encryption processor for encoding, encrypting and / or hashing the DI information; and / or (f) a communication circuit for receiving and controlling incoming signals from a remote communication device to prevent any incoming network attack from entering the device memory. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is the first main preferred embodiment, showing various layouts of punitive network security communication devices and systems.

[0016] Figure 2 It is a second main preferred embodiment, describing a flow chart of a network security operation method for punitively protecting secure Internet data.

[0017] Figure 3 It is a third main preferred embodiment, a flow chart describing a network security operation method for punitively protecting global Internet data.

[0018] Figure 4It is a fourth main preferred embodiment, describing a flow chart of an operation method for providing a DI-member exclusive network.

[0019] Figure 5 This is a flowchart of the fifth main preferred embodiment, which is an operating method for providing network security protection for a smart phone.

[0020] Figure 6 A sixth major preferred embodiment is shown for implementing a punitive network security operating system for DI communications.

[0021] Figure 7 A block diagram of the DI module embedded in the main board of the seventh main preferred embodiment.

[0022] Figure 8 It is a block diagram of a DI chip with integrated communication circuitry to block any incoming network attack signals and provide trusted outgoing communications. Detailed description of specific embodiments Some definitions of equipment

[0023] In order to facilitate the description of the present invention, Figure 1 and Figure 8 The elements shown in and described above and below are grouped under the term "device" as follows: (A) “Non-communications equipment” Generally used as components or parts, which cannot achieve Internet or network communication by themselves, such as (i) hardware devices or components, such as MPU / CPU, GPU, RAM, memory circuit or storage, firmware, ROM, TPM (Trusted Platform Module), embedded chip, communication connection device 180 (including wired network cable or wireless transmission), and (ii) operating instructions, applications, platforms, operating systems and other software; (B) “Communications equipment” Each non-communication device is appropriately integrated and capable of providing Internet / network connectivity or communication, including, for example: (i) The communication device 191 has a router, Ethernet, Wi-Fi, NearLink, Bluetooth, NFC, UWB (ultra-wideband) Wired or wireless communication circuits used with mobile device modules, such as IMEI / IMEISV / ICCID / IMSI mobile broadband service cards; (ii) Figure 1 Internet communication equipment or Internet system as shown in (FIG.1), such as a punitive Internet communication system 110, 110A, 110B and 110C or network security protection device 190, ISP (Internet Service Provider), private server 131, website hosting provider, cloud computing, NSP (Network Service Provider) / MAE (Metropolitan Area Exchange) / NAP (Network Access Point) 103 and Deep Sea Data Center / Cloud Storage 104, mainly used to provide Internet or host Internet data to be accessed; and (iii) Personal communication devices, such as Wi-Fi devices or routers 132 and NearLink 132A, computers 131, 133, 133H, 136, tablet computers 137, smart phones or cell phones 134 and 135, can be used by individuals to access Internet data residing on the Internet system.

[0024] Internet communication devices and personal communication devices are typically used by Internet data providers (for providing the Internet or hosting online data) and Internet data users (for accessing the Internet or online data), respectively. The expressions Internet access and online access are generally considered interchangeable in the present invention, as multiple personal communication devices can be locally connected to a company server (where corporate data is stored for online access) or connected to an Internet communication device that is further connected to an Internet provider (where Internet data is not stored) to access the Internet from the outside. In other words, both arrangements provide a controlled local network for personal communication devices or shared Internet access from Internet communication devices. Therefore, punitive network security protections will apply to both Internet and online access. Punitive cybersecurity protections for the Internet and personal communications devices

[0025] The first major preferred embodiment is embodied in a cybersecurity communication device, apparatus, device or system that is capable of imposing punitive measures on cybercriminals. The punitive measures are intended to prevent communication devices from accessing the Internet or online networks once they are identified as participating in a cyberattack. Punitive cybersecurity protection can be implemented globally to personal communication devices (such as computers, mini computers, laptops, notebooks, tablets and smartphones that can access online or Internet data for personal use) and Internet systems (such as Internet service providers, network hosts, servers, search engines, data centers, social networking media systems, cloud storage and other systems used for Internet services).

[0026] Figure 1FIG. 1 shows the "punitive network security system" (hereinafter referred to as PCS) of the present invention, which is intended to provide a new Internet system or network server, or to implement an NSP and / or ISP with a network security protection device 190, or the Internet communication systems 110A, 110B and 110C of the present invention (a punitive satellite communication system including ground stations 171A, 171B and satellite 171C) and a wireless system (with cellular towers or base transceiver stations 150A and 150B). Each of the Internet communication systems 110A, 110B and 110C basically includes one of the Internet communication units 101A, 101B and 101C, which are connected to the ISP backbone network 105 at different locations and memory storage devices 102A and 102B in a multi-tasking manner. The memory storage devices 102A and 102B can also be used as servers, hosts or cloud computers / storages for hosting websites each containing multiple web pages and for storing data or providing cloud computing. The ISP backbone network 105 has multiple connections with Internet backbone network operator sites (usually at NSP / MAE / NAP 103 and deep sea data center / cloud storage 104). Most importantly, the punitive Internet communication systems 110A, 110B, 110C, 103 (NSP / MAE / NAP) and 104 (deep sea data center / cloud storage) all include network security protection devices 190.

[0027] in short, Figure 1 (FIG.1) depicts seven layouts for providing punitive cybersecurity protection from the global scale to the personal scale, including (i) PCS 100 as a global integrated system, (ii) each of NSP / MAE / NAP 103 and deep sea data center / cloud storage 104, (iii) each of the punitive Internet communication systems 110A, 110B and the punitive satellite communication system 110C, (iv) each of the Internet communication units 101A, 101B or 101C, (v) each of the network security protection devices 190, (vi) a small private server 131 connected to the LAN 111A, and (vii) each of the smartphones 134 and 135 and the computer 136 (connected to cellular data), which are generally referred to as personal communication devices.

[0028] Layouts (i) to (vi) are typical applications for providing punitive network security protection to protect "Internet data" stored on memory storage devices 102A and 102B such as servers, mainframes or cloud computers / storage, NSP / MAE / NAP 103 and deep sea data centers / cloud storage 104, and private servers 131, which will be accessed by various personal communication devices. On the other hand, layout (vii) is used to provide punitive network security protection to protect "personal data" stored on personal communication devices (such as computers 131, 133, 133H, 136, tablets 137, smartphones or mobile phones 134 and 135) for personal use.

[0029] Without the present invention, cyber criminals can act in concert as a group by deploying multiple computers 133, through Wi-Fi devices or routers 132, or can use a single computer 133H (for example) individually through a home LAN 111B, which is connected to a Tier 3 ISP that can access the network infrastructure of NSP / MAE / NAP 103 or deep sea data center / cloud storage 104 through a PoP, which establishes peer-to-peer connections around the world through IXPs (Internet Exchange Points) with a common foundation of IP networks, allowing participating ISPs to exchange data therein. Similarly, a portable communication device (such as a smart phone / cell phone or car phone 134) moved from cell area 160A to cell area 160B can be used as a hacking or fraud tool in conjunction with a Bluetooth keyboard and mouse (not shown). Without punitive network security systems or network security protection measures 190 such as 110A, 110B, 110C, traditional ISPs, private servers 131, website hosting providers, NSP / MAE / NAP 103, and deep sea data centers / cloud storage 104 may also suffer from continuous network attacks by cyber criminals for free.

[0030] The network security protection device 190 is used to collect device identification (or identity / identifier) ​​(hereinafter defined as "DI") information communication devices, store a list of disabled DIs for communication devices that are prohibited from accessing the network, and perform a disabling process based on the disabled DI list. The network security protection devices 190 are each located in an independent unit, and their functions are similar to independent security or security doors at the entrance of a company building. The isolation or separation of the network security protection device 190 from the Internet communication unit 101A, 101B or 101C and the NSP / MAE / NAP 103 or deep sea data center / cloud storage 104 provides special hardware-level network security protection for Internet data. Without isolation, malicious ransomware, malware, Trojans or viruses can spread and spread throughout the memory storage drive, NVMe module, solid-state drive and / or hard drive disk connected via the internal bus.

[0031] On the contrary, the isolation strategy will completely prevent the spread and proliferation while using the external communication connection device 180 (including wired network cables or wireless transmission between the network security protection device 190 and the Internet communication unit 101A, 101B or 101C). In addition to providing network security protection, the current isolation will further facilitate the backup process and thus restore when needed, because the amount of data on the banned DI list is negligible compared to the large amount of Internet data on servers, mainframes or cloud storage.

[0032] In the present invention, the DI information of a communication device refers to a set of device identification information, which may generally include an Internet IP (Internet Protocol) address and a MAC (Media Access Control) address. The MAC address is a unique identifier assigned to a network interface controller (NIC) by a device manufacturer and is used as a network address in communications such as mobile phones, Ethernet, Wi-Fi, NearLink, Bluetooth, NFC, and UWB. These addresses are hardware addresses burned in through a read-only memory or firmware mechanism. In addition, the DI information will include domain name addresses and / or URL (Uniform Resource Locator) address information to protect personal communication devices and data, which will be further described in the section “Punishment of network security protection for personal communication devices” and will be expanded to include other hardware and software, which will be combined in the section “Network security operating system for implementing DI communication” below. Figure 6 (FIG.6) for further discussion.

[0033] In addition, the term "DI information" as used in the present invention may also refer to any conversion or transformation of a device ID or serial number. The conversion or transformation may be derived from encoding, encryption, hashing, and any combination thereof. As long as the representation of the prohibited or allowed DI information is stored in the prohibited or allowed list, respectively, for comparison, the penalty measures of the present invention can be implemented.

[0034] A packet in IPv4 or IPv6 is a string of bits that may be a small segment of a larger message, including network interface identification, location addressing, and actual data. Each packet has a header string and a data string. The size of the header string (without the data) is at least 20 bytes for IPv4 (using 32 bits) and at least 40 bytes for IPv6 (using 128 bits). The present invention may use other lengths of bytes to contain the DI information described above and will be further described in the section entitled "Network Security Operating System for Implementing DI Communications". The information contained in the header string includes the Internet IP addresses of the source device (such as Wi-Fi device or router 132 and NearLink 132A, computer 131, 133, 133H, 136, tablet 137, smart phone or mobile phone 134 and 135) and the destination (such as a website hosted on server 131 or a website on NSP / MAE / NAP 103 and deep sea data center / cloud storage 104), as well as other fields to help properly route the packet. The data is the actual content of the request to access the personal communication device, which may consist of a string of letters or a portion of the target web page.

[0035] The present invention first introduces and defines the term "DI packet" as a protocol, which refers to at least one packet suitable for containing DI information selected from the group consisting of system DI, hardware DI, software DI, any conversion of them, and any combination of their respective component IDs, which will be combined in the section entitled "Network Security Operating System for Implementing DI Communication" below. Figure 6 (FIG.6) is explained in detail.

[0036] Reference again Figure 1 (FIG.1), when received via the communication link 180, the punitive network security system requires that at least one data packet sent from a remote or personal communication device (such as a Wi-Fi device or router 132 and NearLink 132A, computers 131, 133, 133H, 136, tablet 137, smartphones or cell phones 134 and 135) is a DI data packet containing DI information before any communication can be established.

[0037] In addition, the first main preferred embodiment of PCS100 can be implemented by (i) integrating the network security protection device 190 into the Internet communication system 110A, 110B or 110C, or (ii) installing the software program or operating instructions of the present invention into a website hosting provider or network hosting service, such as an ISP, NSP / MAE / NAP 103, data center 104, Internet communication unit 101A, 101B or 101C, memory device 102A or 102B, or any combination thereof.

[0038] The Internet communication unit 101A, 101B or 101C and the network security protection device 190 are mainly used to provide large-scale or even global punitive network security protection. They each include their own storage device, a control system with a microprocessor, a communication device and operating instructions. Exemplary implementations include a single integrated circuit board (i.e., a system on a chip SoC) or a device unit assembled from various components that integrate communication circuits, storage circuits or memories, firmware, ROM, embedded chips, multi-function memories, SRAM (static random access memory) chips or modules, instruction sets, applications, platforms, operating systems and / or any combination thereof. On the other hand, the personal communication devices mentioned in the above layouts (vi) and (vii) (e.g., computers 131, 133, 133H, 136, tablet computers 137, smart phones or mobile phones 134 and 135 of remote Internet communication devices) will be internally implemented by installing the application of the present invention. Punitive network security protection for Internet communication equipment

[0039] The following description is assigned to the Internet communication devices of the arrangements (i) to (vi). Each unit of the network security protection device 190 includes a communication device 191, a storage device, an operation instruction, and a control system. The storage device stores a prohibited DI list of remote personal communication devices prohibited from online access. The control system includes at least one microprocessor in communication with the storage device for executing the operation instruction and controlling the operation of the communication device 191. The storage device also stores operation instructions for use by the control system for (i) allowing, the communication device 191 responding to an incoming signal from a remote personal communication device requesting online access to initiate a first stage of communication; (ii) promoting, if it is determined that a DI data packet from the incoming signal is received and is not included in the prohibited DI list, the remote personal communication device is promoted to the second stage of communication that allows online interaction on the web page, wherein the DI data packet includes device identification (DI) information of the remote personal communication device; (iii) implementing, if it is detected that the online interaction involves bad activities on the web page, then implementing penalty measures by not allowing the remote personal communication device to continue the online interaction; and (iv) updating, using the DI information of the remote personal communication device identified as participating in bad activities to update the prohibited DI list.

[0040] Unwanted activity generally refers to any cyber attack or any unauthorized, fraudulent, malicious, hacking, phishing or scam activity, and / or the use of adware, viruses, worms, ransomware, bots, Trojans, keyloggers, rootkits, spyware or crypto-mining malware, and / or uploading / sending cyber attack files to the Internet as bait. These viruses and malware may be present in certain file types and extensions that are recognized by some antivirus software programs (such as Microsoft Defender, McAfee, Norton, etc.).

[0041] The communication device 191 includes a communication circuit connected to the Internet via wireless data transmission (e.g., via cellular tower 160A or 160B) or wired data transmission (e.g., communication connection device 180). The communication circuit can multitask to initiate the first stage communication to process multiple DI data packets sent from multiple remote personal communication devices, and selectively upgrade the communication to the second stage to allow online access.

[0042] Preferably, the communication circuit is capable of multitasking establishing communications through an external communication connection device 180, wherein the external communication connection device 180 is selected from the group consisting of at least one cable, at least one optical fiber, at least one hybrid fiber coaxial cable, at least one cellular telephone channel, at least one satellite communication channel, at least one wireless communication channel and any combination thereof, and establishing multiple first-stage communications in response to multiple incoming signals for determining the presence of DI data packet information.

[0043] The term "phase" in the present invention can express a communication state. At the beginning, the initially received incoming signal will be temporarily in a pending state to verify whether the received signal has a DI data packet and whether the DI information contained in the DI data packet is included in the disabled DI list. When a DI data packet is included and its DI information is not included in the disabled DI list, the incoming signal will enter the allowed state, that is, flow through the network security protection device 190 and allow its online access request. As an example, the communication of the first phase and the second phase can be processed by the same communication circuit.

[0044] On the other hand, "stage" can refer to a physical stage or level when the communication device 191 includes another communication circuit, which is used to separately process the DI data packets entering the second stage communication by routing, forwarding or linking so as to establish another multiple outgoing communication links to the Internet data, while the DI data packets initially received in the first stage communication are processed by the first communication circuit.

[0045] In short, the network security protection device 190 combined with the processing of the incoming signal, referred to above as an independent security guard or security gate, will prevent cyber criminals from getting any chance to attack Internet data.

[0046] For the purpose of illustration, the network security protection device 190 in communication with the memory storage device 102A is adapted to be used as a central network security system, wherein its central banned DI list will preferably be updated in real time and synchronized with other network security protection devices 190, each of which has its own banned DI list, due to encountering various network attack activities. When updated and synchronized globally, the central banned DI list will implement the penalty measures of the present invention to prohibit, disallow, block or ban any network criminal's device from accessing any web page, including any popular search engine, such as Google, Yahoo, Bing, etc., financial institutions, banks, stock, futures and cryptocurrency trading platforms, webmail, mobile text messages and digital phones, applications downloaded from Google Play and Apple stores, as buyers or sellers on Amazon and other e-commerce stores, government and other high-security websites. Punitive cybersecurity protection for personal communication devices

[0047] Described now is the punitive network security protection in arrangement (vii), involving personal communication devices such as computers 133, 133H, 136, tablet computers 137, smartphones or cell phones 134 and 135, each of which will have the application of the present invention installed therein.

[0048] Instead of attacking Internet data or online networks through personal computers, cybercriminals may also use computers 133H as servers to host websites with decoy content to lure personal communication devices as target victims, thereby making illegal profits. Cybercriminals often repackage ransomware or malicious viruses and upload them to BitTorrent networks or seed web pages disguised as well-known software programs, waiting for victims to take the bait. Alternatively, smartphones 134 may be used as cyber attack tools to directly send bait through bulk fraud emails, text messages, or digital voice calls. Cybercriminals may further purchase advertisements on other websites to post bait advertisements in the form of pop-up links.

[0049] The phishing content may be bundled with fake software, adware, and may create a webpage with a fake antivirus pop-up alert scam, such as "Warning - Your computer is infected! Virus activity has been detected. Click here to scan." Fake error messages are a scam that pretends to be a legitimate product from Microsoft or other well-known antivirus companies to trick the target victim into thinking that a virus has been detected on their computer. This causes the target victim to panic and download and install unwanted or even malicious programs on their computer. The software or "free scan" offered in the pop-up alert often does not work or actually infects the computer with a bundled dangerous program instead of providing the protection it claims to provide. This scam is mainly aimed at obtaining personal credentials. Once the computer is infected, the scammers usually collect personal information to steal the target victim's credential information or sell it to other criminals. The fake software may also be a deadly ransomware or malicious crypto-mining malware. Once mistakenly executed, this deadly ransomware will lock all files on all connected memory storage (including memory storage or NVMe modules, hard drives, and SSDs) until the required ransom is paid using cryptocurrency.

[0050] Malicious cryptocurrency mining software will hijack the affected computer's resources to mine cryptocurrency, where the CPU and GPU power of the affected computer will be completely drained to 100% at all times, rendering the computer owner useless. While ransomware has no other remedy other than paying the demanded ransom, other fake antivirus, malware, adware, and cryptocurrency mining malware are notorious for being impossible to cleanly or successfully uninstall.

[0051] The network security protection can be applied to wireless communication devices. Smartphone 135 can be regarded as network security protection device 190, including a communication connection device externally connected to the Internet (for example, wireless data transmission through cellular tower 160A or 160B) for data traffic to flow therewith. Smartphone 135 is provided with communication circuit, storage device, operation instruction and control system. The storage device stores a list of banned DIs of Internet web pages or websites hosted by the Internet server of cyber criminals. Cyber ​​criminals may (i) host web pages or websites on phishing servers, (ii) send bulk emails or text messages, short message service (SMS), multimedia message service (MMS) or video messages, each message usually contains a link or attachment containing a fake login page of any seemingly credible website (such as bank, antivirus subscription, online merchant, transportation company), and (iii) fraudulent phone calls (to be further described in the fifth main preferred embodiment).

[0052] The network security protection is also applicable to personal communication devices, see computers 131, 133 and 136. The control system of the personal communication device controls the operation of the communication circuit and the storage device by installing the operation instructions of this embodiment, thereby achieving network security protection. The operation instructions specifically stored in the storage device and available to the control system are used to (i) allow the communication circuit to establish a first-stage communication in response to an incoming signal sent from a remote Internet communication device, wherein the first-stage communication is to detect the incoming signal and determine whether the incoming signal has a DI data packet; (ii) promote, only when a DI data packet is received and it is determined that it does not contain DI information included in the prohibited DI list, promote the incoming signal of the remote Internet communication device to the second-stage communication to allow the reception of calls / videos / text messages / files; (iii) allow, if the received calls / videos / texts / files are determined to involve the implementation of network attacks, phishing or fraudulent activities, allow the personal communication device to submit the DI information of the Internet communication device (for example, the computer 133H used as a network attack tool by cyber criminals) to the remote central network security system with the central prohibited DI list; and (iv) update and / or synchronize, update and / or synchronize the prohibited DI list with the remote central network security system, and then synchronize with other personal communication devices participating in network security protection to fully implement the punishment measures. Please note that the "DI information" of the communication device to be disabled refers to multiple DI information sets.

[0053] In addition to being resident on a third-party server system, the remote central prohibited DI list may also reside on Internet communication devices such as the punitive Internet communication system 110A, 110B, 110C implemented by the present invention or a network security protection device 190, a conventional ISP, a private server 131, a website hosting provider, a cloud computer, NSP / MAE / NAP 103, a deep sea data center / cloud storage 104, and other Internet communication devices. Internet Data Security Punitive Network Security Operation Method

[0054] Now, Figure 2 (FIG.2) Further elaborated, the network security protection device 190, as the second main preferred embodiment of the present invention. More specifically, a punitive network security operation method or process 200 is described, which is to be implemented to the network security protection device 190, the Internet communication device / system or the personal communication device defined previously. The punitive network security operation method can be in the form of an operating system, platform, application, software program, instruction set and / or process for installation or implementation. It can be installed / loaded on a memory storage and executed by a microprocessor to implement the embodiment.

[0055] The punitive network security operation method 200 will be described as a flowchart including steps, instructions or processes. The term "network security system" hereinafter generally refers to the network security protection device 190, the Internet communication unit 101A, 101B or 101C, and the arrangements (i) to (vii) implemented using the punitive network security operation method, which will be described in Figure 1 (FIG.1) refers to the multitasking execution on the main RAM circuit of the network security system. Please note that "S" in the following text stands for "step".

[0056] Method 200 begins with step S201 (START), in which the network security system always provides a first-stage communication to the remote personal communication device to send an incoming signal in the form of a data packet in the form of bits. Whether in IPv4, IPv6 or newer protocols, at least one data packet will be presented as containing DI information. Traditional browsers that rely on encryption such as HTTPS (Hypertext Transfer Protocol Secure) cannot provide the penalty measures of the present invention. In order to implement the penalty measures, if the initially received data packet is not a DI data packet, S202 (DI signal detected?) is adapted to continue to query the remote personal communication device for a response of at least one DI data packet. Alternatively, when a personal communication device initiates a browsing request, a new web browser or protocol can be evolved to automatically format at least one data packet as a DI data packet of the present invention. In short, S202 will detect or determine whether a DI data packet exists in the incoming signal submitted from the personal communication device.

[0057] S203 (accessing SW detected?) detects or determines whether the incoming DI signal involves accessing a protected web page. Figure 2 (FIG.2) and shown as "SW" hereinafter. SW detection can occur when accessing a web page. S240 (create / update SW list) creates / updates / provides a SW list of Internet web pages and websites with SW properties. The SW list is preferably a table or registry of Internet IP addresses or URL address information of SW web pages stored on the network security protection device 190 (isolated from SW data), thereby preventing network attacks at the earliest stage or even before providing any access opportunity to the SW web page.

[0058] When SW access is detected, S204 (banned list existed?) further checks whether there is a banned DI list. The banned DI list contains a list or registry of communication devices that have previously denied SW access. By searching the banned DI list, S206 (banned DI matched?) can easily determine whether the incoming signal contains DI information that matches an entry in the banned DI list. If the DI information does not match the banned DI list, the incoming signal will be promoted to the second stage of communication, that is, access to the SW website or web page is granted to continue the login process, S207 (logging in correctly?). If logged in correctly, the user will be further granted access to other SW web pages of the website, S210 (access granted). If not, S208 (flag an alert) marks an alert to further monitor the user's subsequent login activities. The number of allowed login failures can be set by the SW website or a preset value in S208. If the final login step in S209 (final logging succeeded?) is determined to be successful, access is granted. If not, S211 (update banned DI list) will add the DI information of the incoming signal to the banned DI list and update it, and then deny access S220 (access denied). The updated banned DI list will be fed back to S206 for use, so that the banned DI list will be applied to other SW websites.

[0059] Preferably, the updating includes synchronizing the forbidden DI list with the central forbidden DI list located in the central punitive network security system. Therefore, the forbidden DI list will implement the punitive measures of the present invention by completely prohibiting the identified communication device from accessing any SW web page on the Internet.

[0060] If there is an error in the user login activity, S230 (rectification) provides a rectification step to remove the entry of the erroneously rejected DI information set from the prohibited DI list at S211. The rectification step S230 should be initiated by the erroneous user by manually contacting (mostly by phone) the relevant website administration for an internal verification process. The rectification process S230 does not cause any additional effort to the erroneous user, as it usually requires a call to a credit card customer service representative who authorizes the issuance of the rectification request from S230 to S211. Alternatively, a digital rectification process can be used by linking the known identity information of the erroneous user in the file (such as an email address / account or a digitally contactable mobile phone and other credential questions and answers) to proceed with the verification confirmation. Punitive Cybersecurity Operation Methods for Public Internet Data

[0061] Figure 3 (FIG.3) describes in detail a network security operation method 300, in which the communication device of a cyber criminal will be prohibited from accessing the Internet system or using the layout (i) to (vi) implemented in this embodiment, even on non-secure websites or web pages. Starting from step S301 (START), method 300 provides a first-stage communication to receive an incoming signal from a remote personal communication device requesting access to the Internet system to obtain DI information. S302 (incoming DI signal detected?) is to determine whether the incoming signal contains a DI data packet. If not, it will continue to request DI data packets from the remote personal communication device. During the initial implementation of this embodiment, a banned DI list will be created by activating S303 (banned DI list exists) and S304 (create banned DI list). The banned DI list can be obtained by downloading a copy from a remote central network security system. Another exemplary process for building / creating a DI list will be given later in the section entitled "Network Security Operation System for Enabling DI Communication". Any incoming DI data packet will be checked to see if its device identification information matches the forbidden DI list S305 (incoming DI matched?). Any Internet access request from a remote personal communication device that matches the forbidden DI list will be rejected at S320 (access denied).

[0062] If there is no match at S305, the remote personal communication device will upgrade to the second stage communication, which can illustratively follow step S306 (logging in correctly?) to determine whether it has logged in to the secure website or web page correctly. If not, S307 (flag an alert) marks the alert, and then S308 (final logging succeeded?) monitors its subsequent login attempts. If the login is correct, access permission will be granted S309 (access granted). If it fails at S308, S310 (update banned DI list) will be used to update the new entry of DI information to the banned DI list. If an error occurs when the user logs in, a correction step S330 (rectification) is also provided. Therefore, any new cyber criminal's communication device, once identified at S308 and updated at S310, will feed back the latest banned DI list to S305 to prohibit access to any other public web pages. In essence, method 300 will completely deprive the cyber criminal's communication device of Internet access capabilities.

[0063] Figure 3(FIG.3) The prohibited DI list created in S304 for the communication device to be prohibited is preferably DI information, including (i) Internet IP address, domain name and MAC address of the server or Internet web page deployed by the network attacker, (ii) embedded hardware device identification (hereinafter referred to as "hardware DI") or serial number, such as system product ID, UUID (universally unique identifier), machine ID, CPUID, wired and / or wireless circuits, such as routers, Ethernet, Wi-Fi, NearLink, Bluetooth, NFC and UWB, basic input / output system firmware chip (BIOS, EFI or UEFI), motherboard or baseboard / system board / motherboard, system product, GPU (video or display), RAM memory module, memory storage drive (or disk drive), NVMe module, video, monitor, communication DI, such as mobile phone or mobile device IMEI / IMEISV / ICCID / IMSI / mobile broadband service card number; (iii) software DI, such as device OS (operating system) installation ID, OS license ID, OS activation key, software program serial key, or (iv) any combination thereof.

[0064] In brief, the third embodiment describes a punitive network security operation method for providing network security protection, including: (a) establishing, a prohibited DI list to prohibit a communication device from providing online access rights; (b) obtaining, in response to an incoming signal sent from the communication device, obtaining DI information of the communication device; (c) allowing, allowing online access on a web page of an Internet system only when the DI information is obtained and the DI information is not included in the prohibited DI list; (d) prohibiting, prohibiting online access if it is detected that the communication device has participated in bad activities on the web page; and (e) Add, add the DI information of the communication device involved in the bad activities to the prohibited DI list.

[0065] The above-mentioned punitive network security operation method is used to provide network security protection for an Internet system that hosts multiple accessible websites. The updating step of S310 also includes synchronizing the banned list to other Internet systems participating in the network security protection. Therefore, any communication device with its DI information, once identified as participating in bad activities on one Internet system, will be completely banned by all other Internet systems as a punitive measure.

[0066] In short, method 300 will deprive the cybercriminal's communication device of Internet access. As mentioned above, DI information includes Internet or public IP addresses, domain names and / or specific URL address information available when the cyber attacker deploys a server or Internet web page, which is summarized as system DI, hardware DI, software DI, any of their conversions, and any combination of their respective component IDs. Once the cybercriminal's server is identified, it will not be able to access the Internet. In addition, once it is included in the banned DI list, the punishment measures will further deprive its hardware equipment and the operating system of each machine of the reconfigurable usability.

[0067] Through the DI information, the network security operation method 300 is also applicable to personal communication devices, such as computers 131, 133, 133H, 136, tablet computers 137, smart phones or mobile phones 134 and 135, such as Figure 1 As shown in (FIG.1), it provides cybersecurity protection for personal use against phishing or scam servers hosted by cyber criminals that host fraudulent Internet websites or fake software, waiting to take the bait.

[0068] In addition to monitoring cyber attack activities on secure web pages as one of the harmful activities, method 300 may also include another step for detecting whether the personal communication device has uploaded a file bundled with malicious programs (such as adware, viruses, worms, ransomware, robots, Trojan horses, keyloggers, rootkits, spyware and crypto-mining malware). DI-Members-Only Network’s Punitive Cybersecurity Operational Methodology

[0069] Now mentioned Figure 4 (FIG.4), the fourth preferred main embodiment is a network security operation method 400, which provides a secure / closed / enclosed private network with flexibility beyond traditional practices. In traditional Internet networks, the term "private network" is defined as a computer network that utilizes a private address space of IP addresses, which is used for local area networks (LANs) commonly found in residential, office, and enterprise environments. Both IPv4 and IPv6 specifications define specific narrow ranges for private IP addresses. However, traditional private networks are limited to specific nearby locations and must be connected locally. In contrast, the present embodiment develops a "DI-members-only" network, which refers to a "members-only" network based on device identification.

[0070] The DI-member-only network restricts its online access to communication devices with DI information predefined, pre-selected or pre-registered in the network to establish device ID-member-only security. Compared with private networks, DI-member-only networks do not rely on traditionally defined private address spaces. Therefore, communication devices participating in the DI-member-only network may be located in remote sites, cloud storage, or traveling / moving. Therefore, their network connection can be achieved through the Internet instead of relying on the physical infrastructure of local LAN cables used in traditional private networks. Therefore, each communication device in the DI-member-only network can access the Internet and establish a secure / closed / closed private network with each other on it.

[0071] An exemplary application is to securely access a DI member's private network (including servers or cloud storage) from a home office or any different ISP while traveling or on the move in order to establish secure / closed / closed private communications for military or civilian applications, secure group meetings or video conferences, and data or document transfers, as long as DI member-specific communication equipment is used.

[0072] The DI-member-only operation method 400 starts from S401 (START) and always allows the first stage communication to receive the incoming DI signal S402 (incoming signal received?). If there is no DI-member-only list in S403 (DI-Member-Only list?) before the initial setup of method 400, it will allow the authorized administrator to create a list in S404 (create DI-Member-Only list) according to the communication device to be encapsulated. The DI-member-only list S403 includes the DI information of the communication devices that are predefined, preselected or pre-registered for the secure DI-member-only network application (described above). In essence, matching with the DI information is a prerequisite for any communication device to access or establish a DI-member-only network connection.

[0073] Figure 4The incoming signal S402 in (FIG.4) also needs to include at least one of the above-mentioned DI packets. S403 determines whether the DI information of the incoming DI packet signal matches the DI-member-only list. If there is no match at S405 (incoming DI matched), any attempt to access the DI-member-only network will be rejected S420 (access denied). If it matches, the communication device is allowed to communicate in the second phase, including general or public access S406 (general access) within the DI-member-only network, or directly access a personal account. A login step is also provided, including S407 (logging in correctly) to determine whether the login is correct, S408 (flag an alert) to flag an alert if necessary, and S409 (final login succeeded?) to determine whether the final login is successful, so as to further enhance network security protection in the event that the DI-member-only communication device is lost or stolen, and to achieve other purposes, such as obtaining elevated permissions in a higher level of security access or restricted group access S410 (DI-Member-Only access) DI-member-only access. A correction step S411 (rectification) is optionally provided. The DI-member exclusive list S403 can also be updated S412 (update allowed DI list) to allow new communication devices to be added or deleted.

[0074] In the DI-member exclusive network, DI-member exclusive connections are established for applications such as Web or Hypertext Transfer Protocol (http and https), email (SMTP, POP, IMAP), file transfer (FTP), remote login host or remote terminal (Telnet, secure shell), mobile device ID (IMEI / IMEISV / ICCID / IMSI / mobile broadband service card number), video and audio transmission. In essence, the fourth major preferred embodiment excludes any online access from unknown communication devices, thereby eliminating any potential network attacks through the delivery of bulk spam, attached Trojan viruses or malware. The embodiment of the DI-member exclusive network is particularly suitable for applications that require control of confidential information and absolute network security protection, which require government, military, intelligence, top-secret research organizations, financial institutions, inter-bank conversion, cryptocurrency conversion, sensitive internal company files and personal secrets in the cloud. Cybersecurity protection against scam calls and text messages

[0075] Figure 5(FIG.5) shows a fifth preferred main embodiment, which is intended to handle fraudulent calls and messages. Without the present invention, a conventional smartphone would immediately enter its active mode, at least displaying a visual notification, even when receiving a fraudulent incoming call signal. If a fraud protection application is installed, the conventional practice is to block all fraud-like calls and pop up a visual notification in the active mode, showing "Fraud-like call has been blocked", wherein the owner of the conventional smartphone is unnecessarily alerted and cannot determine whether this is a mistakenly blocked call.

[0076] This embodiment may also use two-stage communication, but uses a different arrangement: (i) the first stage communication uses the silent mode defined below to process the incoming signal of the phone call without any audio / visual / vibration notification, where the first stage also includes making a decision to temporarily process the incoming signal, and (ii) the second stage communication uses the active mode defined below to indicate audio / visual / vibration notifications (including any combination thereof) that should be paid immediate attention to while the incoming signal persists.

[0077] Figure 5 In FIG. 5, the dashed boxes S501 to S511 represent the first stage of silent mode communication, and the solid boxes S512 to S514 represent the second stage of active mode communication. This embodiment does not require any remote assistance or management from a central system or a third-party central server, and can be implemented by simply installing the application of this embodiment on each smart phone.

[0078] On the smartphone implementing this embodiment, method 500 starts from S501 (START) silent waiting for use, and when the smartphone receives an incoming call or message, it enters S502 (incoming signal detected?) the first stage communication or silent mode.

[0079] In the fifth preferred embodiment, the signal suitable for smartphones also includes any incoming radio frequency, such as NFC (Near Field Communication) operating at 13.56MHz. Hackers can modify various hacking tools on the market to hack into NFC-enabled smartphones to make illegal profits. Therefore, any incoming signal received at S502 without ID information will be automatically rejected and returned to the Figure 5 (FIG.5) starting step S501.

[0080] If the incoming call signal carries the caller or SMS sender ID, then S503 (contacts list exists?) will be performed to check whether there is a contact list on the smartphone. The contact list includes phone numbers and ID (identification) information, such as names, phone numbers, email addresses, social network media accounts and / or strings contained in smartphone contacts. During the initial installation of the application, a contact list will be created by importing the phone numbers or ID information of the contacts in step S504 (create contacts list) to facilitate the operation of the application.

[0081] Following S503, a sequential comparison will be performed to see if it matches the following items: (i) a contact list S505 that is always allowed (contacts list matched?), (ii) an allowed list S506 that contains contact list S505 and other contacts in disallowed contacts (allowed list matched?), (iii) a disallowed forbidden list S507 (disallowed list matched?), (iv) a banned DI list S508 that is always banned (banned listmatched?), where any twice banned incoming call signals / calls will be moved to the banned list S508, and (v) a repeated list S509 (repeated incoming signal detected?) that is conditionally processed together with the banned list to change the original ban of its incoming calls.

[0082] The banned list S507 may be created or updated by the owner of the smartphone, or synchronized by a remote central system. The IDs of unwanted calls and / or messages that are primarily used to promote commercial advertisements will be added to the banned list S507. When a signal / call / message ID is banned twice by the same smartphone owner, or appears at least twice in different smartphone owners, and is reported to the central system, it has a bad reputation and will be moved to the banned list S508. Alternatively, the central system may verify the banned list received from the smartphone. The banned list S508 refers to IDs associated with scammers and / or phishers to be permanently banned. Unlike commercial advertisements, scam / phishing calls and / or messages are intentionally fraudulent and malicious, which is becoming increasingly rampant in Asian countries. Scammers / phishers may also use artificial intelligence to replicate the voice and video of the victim's friends or relatives to conduct video call scams or phishing.

[0083] The duplicate list in S509 refers to the incoming call DI information, including caller or SMS sender IDs that appear at least twice. If the answers to S505 to S509 are all no, it means that the incoming call or SMS ID is not from a strange, but not banned and unbanned repeater. Therefore, the next step is the voicemail / text step S510 (voicemail / text in mutemode), which is used to leave a voice recording or text message in mute mode even when the traditional time-related "Do Not Disturb" is turned off during the day. The voicemail / text step S510 generated by S505 to S509 will allow kind but unfamiliar people to leave messages selected from the group consisting of voicemail, text message, multimedia message, video message and any combination thereof. Scammers are usually reluctant to leave traceable phone number or ID information on voicemail or text messages for verification.

[0084] When matching with the forbidden list at S507, it will be further determined whether the incoming signal is included in the forbidden list S508. If included in the forbidden list S508, S511 (communication declined) will be activated to reject the communication request. Based on the repeated list, S509 allows the incoming signal that was banned once but repeated, providing an opportunity to leave a voicemail or text message. In this way, the owner of the smartphone can determine whether to move it from the forbidden list to the forbidden list or the allowed list.

[0085] In short, the first stage of communication will automatically and selectively enter silent mode or even time-independent Do Not Disturb mode, even when the traditional time-related "Do Not Disturb" is turned off during the day, including (i) an ID verification step of all incoming call signals received at S502, which will reject (ii) C / A / D / B / R (Contact / Allowed / Not Allowed / Banned / Repeat List) classification steps S505 to S509, (iii) a voicemail / text recording step S510 for processing non-repeated incoming call signals from any unfamiliar but non-banned ID (referring to those not listed in the banned ID below) or any ID that has been banned once but not banned, (iv) a voicemail / text recording step S510 for processing calls that have been banned once but are repeated, and (v) a rejection or refusal step S511 for barring calls included in the banned list.

[0086] When the caller ID matches with (i) the contact list S505, (ii) the allowed list S506, and (iii) the duplicate list (excluding the banned list S509), the second stage of active mode communication S512 (voice / text in active mode) will issue an audio / video / vibration notification to alert the caller or leave a text message or voicemail through audio / video / vibration notification. When the same stranger dials in twice, it indicates an emergency call from the repeat caller, which is usually not from a scammer. S513 (update C / A / D / B / R lists needed?) and S514 (update C / A / D / B / R lists SYNC bannedlists) allow the smartphone owner to update or edit the C / A / D / B / R lists (referring to contacts, allowed, banned, prohibited and duplicate lists) manually or automatically through the application. Based on the voicemail or text left in silent mode S510, the smartphone owner can adjust the disallowed but duplicate identity information back to the allowed list for future entry into active mode, or move it to the banned list for banning in S511. Finally, method 500 will return to S501 and S502 to wait for processing another incoming signal.

[0087] This embodiment is also applicable to the case where the incoming call signal in S502 is a text message, short message service (SMS), multimedia message service (MMS) or video message. The voicemail / text step in S510 caused by S505 to S509 will allow the message to be placed in silent mode for (i) unfamiliar but not banned IDs and / or (ii) banned once but not banned (hereinafter referred to as unlisted banned IDs) and repeated IDs. On the other hand, in active communication mode S512, when the incoming call text message is sent by a person (or smart phone or computer) with an ID that matches the address book S505, the allowed list S506 or the repeated list S509, the smart phone will send an audio / video / vibration notification.

[0088] Further, step S514 is used to update and synchronize the banned list on the smartphone with the central banned DI list on the central system of the provider or third-party central server, which will verify the validity of the banned DI information to be added received from the smartphone. The central banned DI list will be further synchronized with other smartphones that implement this embodiment. Therefore, this embodiment provides network security protection to prevent any fraudulent calls or fraudulent messages initiated by any identified communication device from being sent to other smartphones that implement network security protection, thereby achieving comprehensive punishment measures.

[0089] Unlike this embodiment, the conventional method is that at night, the smartphone must be in the "Do Not Disturb Mode", and during the day, the smartphone must turn off the "Do Not Disturb" mode to operate normally. Obviously, the conventional method cannot automatically enter the silent mode of this embodiment during the day.

[0090] In summary, this embodiment will enable the smartphone to automatically and conditionally selectively be in active mode and silent mode during normal work during the day, which can replace the traditional "do not disturb" mode executed at night. In particular, this embodiment can allow timely attention at night to avoid missing any emergency calls in the contact list. Network-safe operating system for DI communication

[0091] Figure 6 (FIG.6) shows an exemplary diagram of the sixth preferred main embodiment, in which a DI operating system 600 is shown, which provides network security protection by establishing DI communication 601 between Internet communication devices 620 (providing Internet data to be accessed) and personal communication devices 630 (accessing Internet communication devices or browsing Internet data), thereby inflicting punitive damages on cyber criminals and cyber terrorists.

[0092] DI communication 601 is more specifically used to bridge (i) the Internet 610, (ii) Internet communication devices 620, and (iii) Personal communication devices 630 installed with DI operating system 600. Internet communication devices 620 each include TPM 621, DI verification 622, and DI database 623, which are used to provide punitive network security protection for Internet data 625 via DI communication 601. TPM 621 may refer to other security architectures, such as a Trusted Zone Address Space Controller (TZASC) for a single integrated circuit board or a so-called System on Chip SoC.

[0093] Personal communication device 630 is an integration of non-communication and communication devices 640, including (i) hardware devices or components microprocessor / MPU / CPU, GPU, RAM, memory circuit or storage, firmware, ROM, TPM, embedded chip; and communication devices, such as communication circuits of routers, Ethernet, Wi-Fi, NearLink, NFC and mobile devices (including IMEI / IMEISV / ICCID / IMSI / mobile broadband service cards), and (ii) software, such as operating instructions, applications, platforms and / or operating systems.

[0094] In short, three main DI information are described in the personal communication device 630: (i) system DI 635, (ii) hardware DI 650 and (iii) software DI 660.

[0095] The System DI 635 illustratively includes a csproduct (Computer System Product) ID or UUID (Universally Unique Identifier) ​​635, ClientMachineID, ProductID, and MachineID, which are either embedded or assigned during OS installation. With elevated administrator privileges, the cmd prompt "wmic csproduct getidentifyingnumber,uuid" will display the csproductID and UUID 635. Other exemplary cmd prompts are (i) "Get-CimInstance -ClassName SoftwareLicensingService" to retrieve the ClientMachineID; (ii) "wmic os get serialnumber" to display the ProductID; and (iii) "reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient / v MachineId" to display the MachineID.

[0096] Hardware DI 650, representing a collection of hardware device information, may be revealed through various utility applications, such as HwiNFO, System Information (from Windows Manager), or by executing "msinfo32" or various command lines using Windows as an exemplary operating system. Figure 6The retrievable core hardware DI 650 shown in (FIG.6) includes (i) "wmic bios get SerialNumber" for obtaining the BIOS serial number; (ii) "wmic baseboard getserialnumber" for obtaining the serial number of the motherboard or baseboard / system board / mainboard; (iii) "wmic cpu get processorID" is used to obtain the microprocessor / MPU / CPUID; (iv) "wmicmemorychip get serialnumber" is used to obtain the serial number of the RAM memory module; (v) "wmic diskdriveget SerialNumber" is used to obtain the serial number of the memory storage drive or NVMe module; (vi) "wmic nic getMACAddress" is used to obtain Ethernet and Wi-F MAC addresses; (vii) "Get-TpmEndorsementKeyInfo-HashSha256" is used to obtain TPMID, such as TpmEndorsementKey, publicKeyHash, serial number and fingerprint; and (viii) "netsh mbn sh interface" is used to obtain mobile broadband services.

[0097] In short, hardware DI 650 may include Internet IP addresses, domain names, URL address information, MAC addresses of wired and / or wireless circuits (e.g., routers, Ethernet, Wi-Fi, NearLink, Bluetooth, NFC, and UWB), mobile device IDs (e.g., IMEI / IMEISV / ICCID / IMSI / Mobile Broadband Service Card Number), Phone Number, BIOS (Basic Input / Output System), Motherboard / Baseboard / System Board / Motherboard, Microprocessor / MPU / CPU, GPU / Graphics Processing Unit, RAM Module, Memory Storage Drive (or Disk Drive), NVMe Module, TpmEndorsementKey / TPM Module, and Monitor.

[0098] The well-known term "BIOS" used in the present invention generally refers to the architecture of platform firmware for components used to boot and interact with the operating system. It exemplarily represents not only the old BIOS, but also its successors, such as EFI (Extensible Firmware Interface), UEFI (Unified Extensible Firmware Interface), and other firmware in the same category. Examples of firmware that utilize modern UEFI specifications include AMI Aptio, Phoenix SecureCore, TianoCore EDK II, InsydeH2O, etc.

[0099] Software DI 660 preferably refers to a core software program or operating system with a software licensing service implemented on a per-device basis. The uniqueness of these serial numbers or activation keys on a per-machine basis for the operating system or core software program will further enhance punitive cybersecurity protections. Running "Get-CimInstance -ClassNameSoftwareLicensingService" in powershell will display the Windows licensing key and ClientMachineID. Another exemplary cmd prompt is "cscript slmgr.vbs / dlv > D:\slmgr.txt" to retrieve various Windows operating system licensing information such as the operating system license, activation ID, application ID, installation ID, and product key, saved to a file named slmgr.txt on the D drive.

[0100] The computer / device operating system licensing ID or activation key may also be part of the DI information, which may be stored in memory during the user's operating system installation process or embedded in the OEM's memory device. Another commonly used operating system anti-piracy method is to use a digital license linked to a Microsoft Account, iOS Apple ID, or other software developer's server. For example, newer Windows computers may have an OEM product key embedded in their BIOS (including legacy BIOS, EFI, or modern UEFI). The integration of software DI with software developer servers will facilitate the implementation of the present invention to fully implement punitive measures, further rendering any communication device (including computers, tablets, laptops, or servers) completely inoperable once it is determined to be involved in a cyber attack.

[0101] Punitive measures can be further implemented by sending and executing, for example, a Windows command prompt "TASKKILL / IM svchost.exe / F" to the cybercriminal's computer or personal communication device, thereby immediately triggering a Windows BSoD (Blue Screen of Death). As another punitive measure, the BSoD will suddenly and unexpectedly crash the cybercriminal's network activities, undoing the cybercriminal's efforts in addition to causing punitive damages.

[0102] Also included in Software DI 660 is a digital key or unique serial number, such as a biometric data ID for authentication, which utilizes a person's unique biometrics by comparing live biometric data (e.g., eye ID, face ID, fingerprint, voice ID, etc.) with biometric indicator data stored in a file (i.e., on an Internet communication device) for matching. A personal communication device or PC does not need to have a hardware biochip for detecting live biometric data, as long as the digital key is "uniquely" created and / or encrypted and bound to its communication device. This is similar to TPMTpmEndorsementKey, publicKeyHash, serial number, or Thumbprint, whether encrypted or not.

[0103] In short, software DI 660 may include device OS licensing information, such as OS license, serial number, activation key, activation code, application ID, installation ID, digital license linked to software developer server (such as Microsoft account, macOS Apple ID, Google account, HarmonyOS, Baidu account, WeChat, Facebook, Twitter, etc.), client machine ID, machine ID, product ID, user account linked to software developer server for account verification (such as email account, phone number, virtual phone number and password), social network media account, digital key, biometric data (such as fingerprint, voice ID, eye ID and face ID) and any combination thereof. These also apply to other operating systems, such as HarmonyOS, macOS, Linux and Android.

[0104] The above explains the DI information, and the following will clearly explain Figure 6FIG. 6 shows the operation of the DI operating system 600. The DI operating system 600 is mainly used to implement DI communication 601, including establishing a DI database 623, setting a DI formation 670 to specify the DI information to be received and / or included, performing a DI packet formatting 671, and transmitting a DI packet 605. For ease of explanation, the DI formation 670 and the DI packet formatting 671 are exemplarily shown on a personal communication device 630. Both the DI formation 670 and the DI packet formatting 671 can be implemented by installing the application of the present invention, an additional extension (to an existing browser), or a new browser to the personal communication device 630. Alternatively, operating instructions can be installed on both the Internet communication devices 620 and the personal communication device 630 to perform DI communication. The DI information of the personal communication device 630 is allowed to be retrieved through the Internet communication devices 620 or submitted to the Internet communication devices 620, which is a prerequisite for the Internet data 625 to be accessed without being maliciously attacked by cyber criminals.

[0105] DI formation 670 will construct a set of DI information for a communication device, which may be selected from any combination of (i) various IDs mentioned in system DI 635, such as csproductID or UUID, ClientMachineID, ProductID and MachineID, (ii) hardware DI 650 and (iii) software DI 660. If it is detected that the personal communication device of a cyber criminal is involved in a cyber attack, the maximum number of DI formations 670 will render the personal communication device of the cyber criminal, all its hardware components and device software programs completely inoperable.

[0106] DI information is assigned an index ID. ClientMachineID or UUID can be used as the index ID. Alternatively, the index ID of the communication device can be selectively derived from the group consisting of its InternetIP address, domain name, MAC address, system product ID, UUID, machine ID, microprocessor ID, OS license ID, OS activation ID, and client machine ID. Below the index ID are detailed system DI 635, hardware DI 650, and software DI 660 in the database.

[0107] In particular, invalidation of the OS license ID, activation code, digital license or product key or ClientMachineID will cause the cybercriminal's personal communication device 630 to lose OS functionality and even lose transferability to other new communication devices.

[0108] In addition to the unencrypted Internet Protocol form, the DI packet formatting 671 may also include a conversion process selected from the group consisting of encoding, encryption, hashing and any combination thereof, for formatting at least one DI packet into a bit string as a digital fingerprint of the specified DI information determined by the DI formation 670.

[0109] Register all hardware DI 650 to Figure 1-6 Each non-communication device or component will be deprived of any potential reusability, Figure 6 (FIG.6) lists these non-communication devices or components by way of example, such as Internet IP addresses, domain names, MAC / router / Ethernet / Wi-Fi / NearLink / Bluetooth, mobile devices (IMEI / IMEISV / ICCID / IMSI / mobile broadband service card number), basic input / output system firmware chips (BIOS, EFI or UEFI), motherboards, CPUs, GPU / graphics processing units, RAM modules, memory storage drives (or disk drives), NVMe modules, TPM modules, and monitors, so as to be reused when rebuilding new communication devices.

[0110] The term "ID" above (detailing what is included in system DI 635, hardware DI 650 and software DI 660) refers to an identification / identifier / identity or serial number, which may include numbers, letters, characters and other printed symbols, or may consist entirely of a string of characters.

[0111] In short, the punitive measures created by the present invention to impose punitive damages on cyber criminals and cyber terrorists include (i) disabling the online or Internet access functions of their communication devices, (ii) weakening their basic OS operations, and (iii) depriving their hardware devices or components of the reconfigurable usability after being registered on the prohibited DI list.

[0112] Therefore, the punitive measures of the present invention will force cyber criminals to purchase completely new communication equipment and new operating systems, that is, each time a cyber attack activity is detected, punitive damages will be incurred financially.

[0113] In addition to punitive damages, when embodiments are implemented in partnership with, for example, Google (which provides a search engine and Google accounts linked to the Google Play Store and Google Cloud Drive), Microsoft (which provides a Microsoft account linked to operating system activation, the App Store, OpenAI, and web browsers), or Apple (which provides iOS and Apple IDs linked to browsers and the Apple Store), cybercriminals will be further forced to spend time and effort setting up new email addresses / accounts and mobile phone numbers. Others that may be prohibited include social networking media accounts (such as Twitter, Facebook and its related Messenger, WeChat, Line, ShareChat, Instagram, QZone, Weibo, VK, Tumblr, Baidu Tieba, and LinkedIn), brokerage accounts for trading stocks or equity, bank accounts, credit card accounts, cryptocurrency accounts, online shopping accounts (such as Amazon and eBay), tax services, government services, social security account services, health care services, and other services that rely on email or phone number verification requirements.

[0114] DI packet formatting 671 will combine the DI information described in the above exemplary embodiments to form at least one DI packet, which refers to a string of bits, which may be a small segment of a larger message. The purpose of DI packet formatting 671 can be achieved by using a new type of browser or an extension combined with an existing browser to generate a DI packet to be sent to an Internet web page on the Internet communication device 620. The DI information can be carried in the payload field of the DI packet, where the length field size of IPv6 (and IPv4) is 16 bits, which is sufficient to specify a maximum length of 65535 octets to contain the DI information without involving a jumbo payload option. Optionally, DI packet formatting 671 can utilize a portion of the source address header or header extension of the communication device Personal communication device 630 to include an index ID of the device title assigned to represent the DI information set of the personal communication device Personal communication device 630.

[0115] When the Internet communication device 620 receives an incoming signal of an online access request from the personal communication device 630, the DI verification 622 will verify whether the incoming signal contains at least one DI data packet. If not, the online access permission is not granted. The DI operating system 600 will instruct the personal communication device 630 to re-execute the construction of the DI formation 670, the implementation of the DI data packet format 671, and the transmission of the new DI data packet 605.

[0116] The DI database 623 is adapted to include at least one list of various permission levels for a specific purpose or for accessing or controlling data. A prohibited DI list and a list limited to DI members are exemplarily listed below.

[0117] The prohibited DI list is constructed to include communication devices involved in network attacks, which are prohibited from providing any online access on the Internet communication devices 620. If the incoming signal contains an index ID, DI verification 622 compares the index ID with the prohibited DI list to see if there is a quick match. Carrying the index ID in the header or extension of the header on the source address will further help the Internet communication devices 620 to reject the Internet data access request even if the transmission of the Internet data access request is not performed. Therefore, it is best to organize the index IDs in the prohibited DI list, and each index ID includes its respective DI information set retrieved from the DI data packet received by the DI packet formatting 671. Even if there is no match, the detailed DI information set below the index ID will be further verified. In essence, the personal communication device 630 can access the Internet data 625 only when the DI data packet it sends is determined to meet the requirements of DI verification 622.

[0118] The process of DI database 623 may include building, updating and synchronizing. When the DI operating system 600 detects a network attack activity from a communication device, the prohibited DI list will be updated to include the identified DI information set. The updated DI database will be further synchronized with the central DI database residing on the central server and other DI databases on other Internet communication devices participating in network security protection.

[0119] If the Internet communication devices 620 need to have the highest level of network security protection, the DI-member exclusive list will be deployed. As mentioned above, the Internet communication devices 620 will act as a central server to provide a DI-member exclusive network to prevent unauthorized access by any unknown communication device. The DI-member exclusive network will enable DI-member exclusive communication devices to access the central server online from various geographical locations or different ISPs through URL, FTP, Telnet, SecureShell or other communication protocols. Once connected to the central server, it can further establish connections with other DI-member exclusive communication devices. Through the DI operating system 600, the central server will provide the network security protection of the present invention for the DI-member exclusive communication devices when surfing the Internet.

[0120] The DI-members-only network can also be integrated with a list of banned DIs so that the cybercriminal's communication device is not given any chance to request a connection in the first place.

[0121] Regarding the establishment of the DI database, the present invention will also use a web crawler to crawl web pages that may be attacked by malicious programs (such as adware, viruses, worms, ransomware, robots, Trojans, keyloggers, rootkits, spyware, and crypto-mining malware). Google, Bing, Yahoo or other search engines will be used to search for suspicious file extensions or specific words for analysis. In most cases, these search engines have indexed all URLs and web pages, which will help the web crawler of the present invention to establish the database. The web crawler will access these URLs indexed by the search engine, and by communicating with the web server that responds to these URLs, the web server will identify all hyperlinks in the retrieved web pages and download the files to the sandbox or isolated computer system of the present invention for analysis. The analysis shows that any URL (including domain name) or hyperlink containing fake or malicious programs deployed by network attackers will be added to the DI ban list.

[0122] Torrent is a method of distributing files on the Internet that operates through the BitTorrent protocol to facilitate so-called peer-to-peer (P2P) file sharing. One of the easiest and most effectively deployed schemes by cybercriminals is to exploit P2P file sharing by repackaging or renaming various malicious adware, viruses, worms, ransomware, bots, Trojans, keyloggers, rootkits, spyware, crypto-mining malware, etc. into various files with sizes and names similar to those of seemingly legitimate software programs. Once a torrent is created, cybercriminals upload and upload the torrent file, hash data, or magnet link to the BitTorrent network, torrent web pages, emails, or text messages as seeds waiting to be baited. In particular, cybercriminals may repack ransomware programs with special encryption keys to lock all data files on the victim's communication devices, including servers, computers, and internal connection networks.

[0123] The DI operating system 600 may also construct a warning DI list, which includes domain names, web pages, or URLs that host torrents with installable archives and / or compressed files, but have not yet been fully analyzed to determine whether they will invite a cyber attack. In short, the DI database may be adapted to include DI-member-only lists, banned DI lists, warning DI lists, and other lists for various purposes or various access or control permission levels.

[0124] Although the above description is mainly directed to establishing DI communication using an Internet browsing architecture, it is clear that the term "DI data packet" defined in the present invention is not limited to the format of the traditional term "data packet". Instead, the DI data packet of the present invention may be just a string of bits containing specific DI information of the communication device to be controlled, which may not be in an Internet browsing format, such as IPv4 or IPv6.

[0125] In essence, the DI data packet is equivalent to a digital key / fingerprint representing the DI information, wherein the DI information is selected from the ID obtained by the system DI, hardware DI, software DI, any conversion thereof, and any combination of their respective component IDs. The conversion or transformation may be obtained from encoding, encryption, hashing, and any combination thereof. The hash value or encrypted hash value used as the digital key / fingerprint in this embodiment may not need to be decrypted, as long as the representation of the DI information (including the conversion / transformation) is stored for comparison.

[0126] The present invention may use hashing algorithms, such as MD5 (Message Digest 5) or SHA (Secure Hash Algorithm) to provide privacy for user accounts, passwords and / or OS license IDs when necessary. The hash is the output of the hashing algorithm and once created, will be stored as permanent hashed DI information on the personal communication device 630 for DI formation 670 and DI packet formation 671. When a cyber attack activity is detected, the Internet communication devices 620 will store the hashed DI information of the cyber criminal communication devices identified to the banned list on the DI database 623 to impose the punitive damages described above.

[0127] Therefore, the present invention is applicable to provide DI-based network security protection for other communication platforms, such as FTP (File Transfer Protocol), Telnet, SecureShell or other communication protocols, which traditionally rely on the use of user account and password platform login to access the host or remote terminal. With the emergence of artificial intelligence and quantum computing, user account and password platforms will become more vulnerable to attacks by cyber criminals. DI chip for trusted inbound and outbound communication

[0128] The present invention can also be implemented by a DI chip (module or firmware) that can implement trusted DI communication and provide network security protection for inbound and outbound communications. Figure 7 The Trusted DI module 733 and Figure 8 The DI chip 800 shown is roughly a miniature of the network security protection device 190 described above.

[0129] Figure 7FIG. 7 shows a block diagram of the location of the DI module (Trusted DI module) 733 on the motherboard 700, which has a core logic chipset architecture of the chipset 710, which is basically composed of a northbridge 720 and a southbridge 730. The northbridge (memory controller hub) 720 is directly connected to the CPU 721, DRAM 722 and GPU 723 through the front-side bus (FSB) 701 to handle high-performance tasks. The southbridge (I / O controller hub) 730 handles I / O functions, providing (i) an LPC (low pin count) bus 702 for system BIOS 731, super I / O 732, DI module (Trusted DI module) 733, and TPM 734, and (ii) a PCI / PCIe bus 703 for connecting NVMe / SATA / Wi-Fi / LAN / audio codec / USB 735.

[0130] The DI module (Trusted DI module) 733 is preferably embedded or soldered to the mainboard 700. Figure 7 (FIG.7) In addition to showing that the hardware components or parts are detachably assembled above, the main board 700 can be in the form of a single integrated circuit board, namely the so-called system-on-chip SoC used in smartphones.

[0131] When the motherboard 700 starts, the CPU 721 pins are reset, and the register jumps to the BIOS 731 address to perform POST (power-on self-test), and initialize the BIOS 731, chipset 710, system bus 701-703 and other hardware devices, such as DRAM 722, GPU723, super I / O 732, DI module (Trusted DI module) 733, TPM 734, NVMe / SATA / Wi-Fi / LAN / audio codec / USB 735, etc. During the initialization process, the BIOS 731 will interactively connect, collect and provide the initialized hardware DI information to the DI module (Trusted DI module) 733 for storage, so as to cooperate with the network security protection measures of the present invention.

[0132] The hardware DI information may be selected from the group consisting of a computer system product ID, a universally unique identifier (UUID), a product ID, an Internet IP address, a MAC address of a wired and / or wireless communication circuit, a mobile device ID, a phone number ID, a basic input / output system firmware ID, a motherboard ID, a microprocessor ID, a graphics processing unit ID, a RAM module ID, a memory storage ID, a TPM module ID (including generated IDs), a monitor ID, and any combination thereof.

[0133] Figure 7 The importance of (FIG.7) is that once the basic input / output system is started, the functions of the DI module (Trusted DI module) 733 will begin to operate, thereby providing the same level of network security protection as the TPM 734 before the OS is loaded. The DI module (Trusted DI module) 733 includes a control firmware having instructions and memory circuits. The instructions are used to (i) set the content of the ID to be focused and selected and / or included to form DI information; and (ii) format the DI information into a form suitable for transmission so as to enable trusted DI communication with the motherboard 700 for inbound connections and remote communication devices for outbound connections. The memory circuit includes a persistent / non-volatile memory module for storing DI information for use as a device fingerprint of the hardware components and the motherboard 700.

[0134] Figure 8 (FIG.8) further shows that the DI chip 800 is in circuit communication with an integrated chipset 810 having a memory and I / O controller hub, via a PCI / PCIe bus 703 connected to NVMe / SATA / audio codec / USB 835, where the NVMe / SATA / audio codec can be replaced by a memory circuit (an integrated motherboard SoC used in a smartphone) or a flash card and audio codec firmware. Figure 7 (FIG.7) Similarly, LPC bus 702 is used to connect system BIOS 731, super I / O 732 and TPM 734.

[0135] The DI chip 800 has an input / output bus 820 that is electrically connected to the PCI / PCIe bus 703. Figure 7Unlike the DI module (Trusted DI module) 733 in (FIG.7), the DI chip 800 integrates a communication circuit Wi-Fi Ethernet 840, including a wireless communication circuit (such as Wi-Fi 841) and a wired communication circuit (such as Ethernet 842) for receiving incoming signals from the outside. The DI chip 800 also includes a DI coprocessor (DI coprocessor) 850, a persistent memory Persistent memory 860, a versatile memory 870, an encryption processor (encryption coprocessor) cryptoprocessor 880 and a power detection power detection 890. The persistent memory Persistent memory 860 is non-volatile and is used to store a DI fingerprint (DI fingerprint) 861 and a DI database pointer (DI database pointer) 862, while the versatile memory 870 provides the memory required for the DI chip 800 to be initialized and run.

[0136] When the communication device implemented using this embodiment is started, it will ensure that the DI chip 800 works properly through power detection 890 and BIOS 731 initialization. DI coprocessor 850 includes instructions that can be executed by comparison algorithm 851, control algorithm 852, DI interfacing algorithm 853 and DI formation algorithm 854. DI interfacing algorithm 853 is used to interface with BIOS 731 (also EFI or UEFI) to obtain the DI chip 800 at the time of initialization. Figure 6 (FIG.6) system DI 635, hardware DI 650 and embedded software DI 660. After loading the device OS, the DI interfacing algorithm 53 will further obtain the software DI 660 from the installation, such as the software program serial key based on each machine, especially the OS license information. The obtained DI information will be stored in the persistent memory 860 as a DI fingerprint (DI fingerprint) 861.

[0137] DI formation algorithm 854 will continue Figure 6 DI formation 670 and DI packet formatting 671 as described in FIG. 6. DI information obtained from system DI 635, hardware DI 650 and software DI 660 can be completely retained for storage in persistent memory 860 and / or formatted by DI formation 670 as specified or core DI information, consistent with the six main preferred embodiments described above. DI packet formatting 671 can form DI information into a bit string in an Internet protocol format for accessing the Internet, or a communication protocol (such as FTP, Telnet, Secure Shell) or hashed DI information in conjunction with an encryption processor 880. DI formation 670 can further select and format DI information into a specific size, such as 256-1024 bits, or if SRK (RSA) is used, the format is suitable for an upper limit of 2048 bits, or a larger size defined in the future.

[0138] The DI formation algorithm 854 may also be adapted to set a portion of each ID to be focused and selected (from the system DI, hardware DI and / or software DI) in a format of a bit string of a predefined size suitable for transmission to a remote communication device, thereby enabling an outbound connection to the DI communication.

[0139] Bits are the most basic unit of information in computing and digital communication. In practical applications, binary bits may be grouped into bytes (eight-bit bytes or octal numbers) or hexadecimal numbers when receiving conversions.

[0140] The control algorithm 852 may also be adapted to construct a DI database to enable the DI chip to control whether an online access request from a remote communication device should be granted, wherein the DI database includes DI information of the remote communication device to be controlled, and the DI information is selected from the group consisting of any combination of the aforementioned IDs and their respective component IDs. The DI coprocessor 850 may also be adapted to construct a database to include a banned DI list for the remote communication device to which punitive damage is to be imposed, wherein the banned DI list includes DI information selected from the group consisting of the IDs to be banned and any combination thereof, and the punitive damage is adapted to prevent the IDs in the banned DI list from obtaining Internet and / or online access. The control device may also be adapted to synchronize the banned list with a central banned list located on a remote central system when the banned list is modified and / or needs to be updated from the central banned list.

[0141] The DI fingerprint 861 may include all available DI information obtained from the DI interfacing algorithm 853 , specific / selected / core DI information derived from the DI formation algorithm 854 , and hashed DI information encoded by a hash generator contained in the encryption processor 880 .

[0142] The persistent memory 860 also stores a DI database pointer 862 for pointing to a physical location on a memory storage device (e.g., NVMe / SATA) represented by the NVMe / SATA / Audio Codec / USB 835. The DI database associated with the DI database pointer 862 includes the DI information of the remote communication device to be controlled as described above, which may include the DI-member exclusive list, the allowed DI list, the prohibited DI list, and / or the warning DI list as described above.

[0143] In conventional practice, the TPM 732 includes a secure cryptographic processor that (i) generates and stores security information (e.g., user credentials, keys, passwords, fingerprints, or certificates), and (ii) performs cryptographic operations (e.g., asymmetric encryption, decryption, and cryptographic hashing). The secure cryptographic processor also needs to include a random number generator, a key generator, and a hash generator for generating public and private keys.

[0144] In contrast, the combination of IDs selected from the system DI 635, hardware DI 650, and software DI 660 described in the present invention will form a string of bits that is inherently unique enough without the need for any random number generator, key generator, or hash generator that the TPM relies on. Even if hashing is performed to meet privacy issues, the hashed or encrypted DI information of the present invention is still unique enough to function with the TPM 734 and will provide a root of trust for remotely proving the hardware DI and software DI of the present invention specified by the computer. In particular, the hardware DI of the present invention can be specified to include a detailed level of individual hardware components, a fact that cannot be achieved by the TPM. In addition, the DI chip 800 will provide a DI fingerprint (DI fingerprint) 861 stored in the persistent memory 860 for implementing trusted DI communications with network security protection without the need for decryption, such as Figure 4 (FIG.4) and the DI-member exclusive network described in detail in the fourth major preferred embodiment. Most importantly, the purpose of the DI chip 800 is completely different, that is, in addition to enabling trusted inbound and outbound communications, it also provides network security protection and imposes punitive damage on the communication equipment of cyber criminals and cyber terrorists.

[0145] Figure 8Another prominent embodiment of (FIG.8) stems from the integration of a communication circuit Wi-Fi Ethernet 840, which includes a wireless communication circuit (shown as Wi-Fi 841) and a wired communication circuit (shown as Ethernet 842) for receiving incoming signals from the outside. The DI coprocessor 850 will derive DI information upon receiving an incoming signal from a remote Internet communication device. A comparison algorithm 851 will be performed to verify the DI information derived from the communication circuit Wi-Fi Ethernet 840, combined with a DI database pointer 861 pointing to a database stored in NVMe / SATA, which may include an allow list, a prohibit list, and / or a warning DI list. If a communication request should be established for an incoming signal from a remote Internet communication device, the DI coprocessor 850 will allow or prohibit it. Therefore, network security protection for inbound communication is achieved, as described in the previous embodiment, where the DI chip 800 is used as a microcosm of the isolated network security protection device 190 to protect personal communication devices. If matched with the ban list, any link (e.g., Internet IP address, domain name, URL address) from the incoming signal (from the Internet server of the cyber criminals) will be automatically banned from browsing. Therefore, any virus will not be able to enter the NVMe / SATA further. The cyber attack will be eliminated from the beginning, thus ensuring the cyber security protection of the personal communication device. On the other hand, the DI fingerprint (DI fingerprint) 861 stored in the persistent memory 860 will be immediately available and transmitted to the remote Internet communication device as a device certificate to provide trusted outbound communication.

[0146] Essentially, the DI chip 800 will block any inbound network attacks from entering the device memory storage NVMe / SATA, and will provide the DI fingerprint as a trusted certificate for outbound communications. Although the above description is exemplarily directed to personal communication devices, the DI chip 800, which is similar in function to the network security protection device 190, is also suitable for implementation to an Internet server to achieve network security protection for punitive damages as described above. For example, when the DI database stored on the memory storage NVMe / SATA includes a DI-member exclusive list, the DI chip 800 will enable the DI-member exclusive network described above. In addition, the prohibition list will prohibit the cybercriminal communication device from accessing any Internet.

[0147] In summary, the seventh main preferred embodiment provides a DI chip for implementing trusted inbound and outbound communications, including: (a) an input / output device for establishing a circuit connection with a hardware component; (b) a DI mutual communication device for circuit communication with the input / output device, used to obtain information from a computer system product ID, a universally unique identifier (UUID), an Internet IP address, a domain name address, a URL address, a MAC address of a wired and / or wireless communication circuit, a mobile device ID, a phone number ID, a basic input / output system firmware ID, a motherboard ID, a microprocessor ID, a graphics processing unit ID, a RAM module ID, a memory storage ID, a TPM module ID (including a generated ID), a monitor ID, a device OS license ID, an activation code , installation ID, digital license ID, client machine ID, machine ID, VPNID, user account ID linked to a software developer server for account verification, virtual phone number ID, social network media account ID, digital key ID, biometric data ID and any combination thereof; wherein ID refers to an identification, identifier, identity, serial number and / or address selected from the group consisting of numbers, letters, characters, printed symbols and any combination thereof; (c) a control device, including a coprocessor and instructions or algorithms for (i) setting the content of the ID to be focused and selected and / or included to form the DI information; and (ii) formatting the DI information into a form suitable for transmission so as to provide trusted DI communication to a remote communication device.

[0148] The DI chip also includes a persistent memory circuit for storing DI information as a device fingerprint to enable trusted inbound and outbound communications. The DI chip may also include a cryptographic processor for encoding, encrypting and / or hashing the DI information as a device fingerprint to enable outbound connections with DI communications. The DI chip also includes a communication circuit for receiving and controlling the flow of incoming signals from a remote communication device to prevent any inbound network attacks from entering the device memory. The DI intercommunication device may be an embedded firmware, instruction, algorithm or coprocessor for retrieving DI information from a basic input / output system firmware.

[0149] The control device may also be adapted to set a portion of each ID to be focused and selected to be formatted as a bit string of a predefined size suitable for transmission to a remote communication device to enable an outbound connection to the DI communication. The control device may also be adapted to construct a DI database for the DI chip so as to be able to control whether an online access request from a remote communication device should be granted, wherein the DI database includes DI information of the remote communication device to be controlled. The DI information may be selected from the group consisting of the above-mentioned IDs and any combination thereof. The control device may also be adapted to construct a database to include a disabled DI list of remote communication devices to which punitive damage is to be imposed, (i) wherein the disabled DI list includes the communication device to be disabled, and (ii) wherein the punitive damage is adapted to make the ID in the disabled DI list unable to obtain Internet and / or online access, and the device OS is invalid. The control device may also be adapted to synchronize the disabled list with other Internet systems participating in network security protection, so that any communication device once identified as participating in harmful activities on one Internet communication device will be comprehensively disabled by all other Internet communication devices as a punitive measure.

[0150] In essence, the present invention provides ready-to-use DI-based network security protection that is also suitable for enhancing traditional communication platforms, such as the Web or Hypertext Transfer Protocol (http and https), email (SMTP, POP, IMAP), FTP (File Transfer Protocol), Telnet, Secure Shell, or other communication protocols that traditionally rely on platform login using user accounts and passwords to access a host or remote terminal.

[0151] Traditionally, there have also been improved secure communications based on encryption keys, TPMs, and two-step verification methods. However, the recent advent of artificial intelligence and quantum computing will make user account and password platforms, encryption keys, and TPM methods vulnerable to cybercriminals. Similarly, cryptocurrencies will become vulnerable in the face of the power of quantum computing unless implemented using the present invention's DI communications.

[0152] Furthermore, cyber attackers can gather enough information to recover the keys that underpin the security and confidentiality of encryption algorithms by carefully monitoring characteristics such as power consumption, sound, electromagnetic radiation, or the time required for encryption key operations. On the other hand, two-step verification is not practical when waiting time is not allowed in military applications or emergency situations, when the smartphone is lost, cannot be used for verification, or has no signal, or when the linked email account cannot be opened for various reasons (e.g., blocked by country or geographic location).

[0153] Scam / phishing calls and / or messages are particularly rampant in Asian countries, causing many helpless victims, as cybercriminals can commit cybercrimes at no cost to make huge illegal profits. In particular, scammers / phishers are now able to deploy artificial intelligence to copy the voice and video of the victim's friends or relatives to conduct video call scams or phishing.

[0154] In order to overcome the main shortcomings of the cybersecurity protection provided by traditional concepts, the present invention provides DI communication for proactively inflicting punitive damages on cybercriminals and cyberterrorists by making their communication devices and hardware components reconfigurable once they are identified as participating in malicious activities, making it impossible to use the Internet and / or the network in the future. When the present invention is implemented by operating system developers such as Microsoft, Apple, Google, Harmony, etc., the operating system of the communication devices deployed by cybercriminals and cyberterrorists can be rendered ineffective. Therefore, for the first time, no cybercriminal can commit any malicious cybercrime without facing the risk of punitive damages. Equally important, the characteristics of the DI chip, communication device, smartphone, system and operating system of the present invention will not be attacked by artificial intelligence or quantum computing, and will make DI communication with cybersecurity protection immediately available without waiting for two-step confirmation. In particular, the implementation of DI-member exclusive networks is particularly suitable for applications that require control over confidential information and absolute cybersecurity protection.

[0155] Finally, it should be clear that these embodiments are given only to provide illustration and example and should not be considered as limiting, as those skilled in the art may conceive of many changes, modifications, omissions, adjustments and / or changes, combinations and substitutions without departing from the invention herein. In addition, the steps of the processes and / or methods disclosed in the embodiments may be modified in any way, including by reordering steps and / or inserting or deleting steps. Therefore, the present invention is limited only by the spirit and scope of the appended claims.

Claims

1. A method of enabling a communication device to perform device identification (DI) communication, comprising: (a) establishing a DI database, the database comprising the IDs of the hardware components and / or stand-alone software contained within the communication device, wherein the ID refers to an identification number, an identifier, an identity number, a serial number and / or an address embedded in the hardware component and / or bound to the stand-alone software, wherein the number may include letters, printed symbols and / or an entire string of characters; (b) setting at least one of the following: the ID of the hardware component and the ID of the stand-alone software as the required DI information; (c) communicating the ID embedded in the hardware component and / or bound to the stand-alone software through a system bus of the communication device; (d) obtaining the DI information from the mutual communication; (e) formatting the DI information into a bit string as a digital fingerprint of the communication device; and (f) transmitting the bit string to the Internet system to be accessed to provide the digital fingerprint and realize the DI communication.

2. The operating method according to claim 1, wherein the ID is selected from at least two of the following groups: system product ID, universal unique identifier, Internet IP address, domain name address, URL address, MAC address of wired and / or wireless communication circuit, mobile device ID, phone number ID, basic input / output system firmware ID, motherboard ID, microprocessor ID, graphics processing unit ID, RAM module ID, memory storage ID, TPM module ID (including generated ID), display ID, device OS license ID, activation ID, installation ID, digital license ID, machine ID, program serial key based on each stand-alone software, digital key ID, biometric data ID, VPN ID, virtual phone number ID and any combination thereof.

3. A method for operating device identification (DI) communication to enable an Internet system to implement network security protection, comprising: (a) establishing a DI database, which includes a prohibited DI list of telecommunication devices prohibited from accessing the Internet system, wherein the prohibited DI list includes the ID of each hardware component and / or stand-alone software-based internally contained in the prohibited telecommunication devices, wherein the ID refers to an identification number, identifier, identity number, serial number and / or address embedded in the hardware component and / or bound to the stand-alone software; (b) setting at least one of: the hardware component and the ID of the stand-alone software as the required DI information; (c) responding to an incoming signal from a communication device to communicate with the ID of the communication device embedded in its hardware component and / or bound to its stand-alone software; (d) obtaining DI information from the mutual communication as a digital fingerprint of the communication device; and (e) Only when the digital fingerprint is obtained and verified to be not included in the prohibited DI list, the communication device is allowed to access the web page of the Internet system online.

4. The operating method according to claim 3, wherein the ID refers to at least one of the following groups: system product ID, universal unique identifier, Internet IP address, domain name address, URL address, MAC address of wired and / or wireless communication circuit, mobile device ID, phone number ID, basic input / output system firmware ID, motherboard ID, microprocessor ID, graphics processing unit ID, RAM module ID, memory storage ID, TPM module ID (including generated ID), display ID, device operating system license ID, activation ID, installation ID, digital license ID, machine ID, software program serial number based on each stand-alone machine, digital key ID, biometric data ID, VPN ID, virtual phone number ID, any part of any of the IDs, any of their conversions, and any combination thereof; wherein the conversion is derived from the group consisting of encoding, encryption, hashing and any combination thereof.

5. The operating method according to claim 3, wherein the ID comprises a MAC address of the communication circuit and at least one selected from any of the following groups: a system product ID, a universal unique identifier, an Internet IP address, a domain name address, a URL address, a mobile device ID, a phone number ID, a basic input / output system firmware ID, a motherboard ID, a microprocessor ID, a graphics processing unit ID, a RAM module ID, a memory storage ID, a TPM module ID (including a generated ID), a display ID, a device operating system license ID, an activation ID, a machine ID, a software program serial key based on stand-alone software, a digital key ID, a biometric data ID, a VPN, a user account ID connected to a software developer's server for account verification, a virtual phone number ID, a social network media account ID, any part of any of the IDs, any conversion thereof, and any combination thereof; wherein the conversion is derived from a group consisting of encoding, encryption, hashing, and any combination thereof.

6. The operating method of claim 7, wherein the ID of each of the remote communication devices is adapted to include an index ID, the index ID being selectively derived from any group consisting of an Internet IP address, a system product ID, a UUID, a MAC address, an operating system authorization ID, an operating system activation ID, and a machine ID. wherein the conversion is derived from a group consisting of encoding, encryption, hashing, and any combination thereof.

7. A network security operation method exclusively for DI (device identification) members, comprising: (a) establishing a list of allowed DIs for pre-registering communication devices that are allowed to access the DI member private network, wherein the list of allowed DIs includes the IDs of the hardware components and / or stand-alone software contained in each of the pre-registered communication devices, wherein the ID refers to an identification number, identification symbol, identification number, serial number and / or address embedded in the hardware component and / or bound to the stand-alone software; (b) setting at least one ID of the hardware component and the stand-alone software as the selected DI information; (c) responding to an incoming signal from a communication device and interacting with the ID embedded in a hardware component of the communication device and / or bound to a stand-alone software thereof; (d) obtaining the DI information from the mutual communication as a digital fingerprint of the communication device; and (e) Only when the digital fingerprint is obtained and verified to be included in the list of allowed DIs, the communication device is allowed to perform Online access to the DI members-only network.

8. The DI member-only network security operation method according to claim 7, wherein the ID refers to at least one of the following group: system product ID, universal unique identifier, Internet IP address, domain name address, URL address, MAC address of wired and / or wireless communication circuit, mobile device ID, phone number ID, basic input / output system firmware ID, motherboard ID, microprocessor ID, graphics processing unit ID, RAM module ID, memory storage ID, TPM module ID (including generated ID), display ID, device operating system license ID, activation ID, installation ID, digital license ID, machine ID, software program serial number based on each stand-alone machine, digital key ID, biometric data ID, VPN ID, virtual phone number ID, social network media account ID, any part of any of the above IDs, any conversion thereof, and any combination thereof; wherein the conversion is derived from the group consisting of encoding, encryption, hashing, and any combination thereof.

9. A chip for implementing DI (device identification) communication, comprising: (a) an input / output device for establishing a circuit connection with a hardware component including a motherboard, a microprocessor, a graphics processing unit and a memory, wherein the memory is installed with software including an operating system; (b) DI mutual communication device, which communicates with the input / output device in circuit, and is used to obtain the hardware component and / or the base ID for stand-alone software, where the ID refers to identification, identifier, identity, serial number and / or address; and (c) a control device, used for (i) setting which of the IDs is selected from the hardware component and / or the software as the DI information; and (ii) formatting the DI information into a form suitable for transmission.

10. A chip according to claim 9, wherein the ID of the hardware component and / or the software is at least one selected from the following groups: system product ID, universal unique identifier, Internet IP address, domain name address, URL address, MAC address of wired and / or wireless communication circuit, mobile device ID, phone number ID, basic input / output system firmware ID, motherboard ID, microprocessor ID, graphics processing unit ID, RAM module ID, memory storage ID, TPM module ID (including generated ID), monitor ID, device OS license ID, activation ID, installation ID, digital license ID, machine ID, stand-alone software program serial key, digital key ID, biometric data ID, VPN ID, virtual phone number ID, any part of any of the IDs, any conversion of them and any combination of them; wherein the conversion is derived from encoding, encryption, hashing and any combination of them.

Images