Self-powered forensics emergency help device, system and abnormality determination method

Abstract

The application discloses a self-powered forensics emergency help device, system and abnormality determination method, and belongs to the technical field of mobile communication, which comprises the following steps: the device is provided with a sentinel domain which is powered by temperature difference, photovoltaic or kinetic energy harvesting, and the power supply rail is independent; after the main battery is short-circuited, removed or the whole machine loses power, the sentinel domain still continuously writes the anti-disassembly state and time into a non-volatile forensics memory which can be read passively and periodically broadcasts an encrypted beacon; a piezoelectric element is powered by the mechanical energy of a destructive action and classifies the destruction type according to the pulse waveform. The cloud server distinguishes according to the heartbeat signaling carrying the dynamic latest deadline and the rolling digest value, and the authenticated normal stop signaling; when the sentinel beacon is received through relay forwarding, it is determined that the device is in an abnormal state of survival, and the digest truncation value carried by the beacon is used as the last anchor point to verify the evidence; only after the abnormality is determined, the background evidence managed by the threshold fragmentation decryption is decrypted by the destruction witness token.

Description

Technical Field

[0001] This invention relates to the field of mobile communication technology, specifically to a self-powered emergency assistance device, system, and anomaly detection method for evidence collection. Background Technology

[0002] Emergency assistance devices such as smartwatches are widely used for personal safety due to their wearable nature and ease of use for calling for help. Existing devices typically include functions such as calling for help, recording audio, location tracking, and data uploading. Some devices also incorporate tamper-proof detection structures (such as strap cut detection) and backup batteries to trigger alarms or complete data uploads in the event of device damage. Cloud servers generally use online status monitoring methods such as heartbeat signaling to track device status. Furthermore, some consumer electronics devices offer a "findable after shutdown" function, whereby the communication chip continues to broadcast location beacons using the remaining battery power after the device is powered off, and the location is relayed to nearby devices.

[0003] However, existing solutions still have the following unresolved technical problems: First, all the alarm and evidence collection capabilities mentioned above rely on battery power. Both the main and backup batteries have limited capacity and can be removed, short-circuited, or destroyed along with the device by the perpetrator. Similarly, solutions that rely on residual battery power after shutdown have a time limit of several hours; they become ineffective once the battery is physically removed or damaged. Furthermore, their beacons are only used for location tracking and do not carry any evidence. When both power sources fail, the device becomes completely silent, unable to emit any signals, and the evidence embedded within the device cannot be read. The cloud server can only observe an interruption indistinguishable from a normal disconnection. Second, if the perpetrator uses a signal jamming device to suppress the wireless link, the device may still be running but cannot upload data. The cloud server cannot distinguish between situations where the device is suppressed and situations where the device is destroyed—two fundamentally different scenarios. Third, the recordings and other evidence retrieved after the incident lack credible and complete verification evidence, and their authenticity and timing are easily questioned in subsequent handling; if the device is ultimately completely destroyed, the evidence and verification evidence embedded inside the device will also be destroyed. Fourth, the device sends heartbeats to the cloud server at fixed intervals. Short intervals result in high radio frequency power consumption and short battery life, while long intervals result in large delays in anomaly detection. Power consumption and delay are mutually restrictive. Summary of the Invention

[0004] The purpose of this invention is to provide a self-powered emergency assistance device, system, and anomaly detection method for evidence collection, in order to solve the above-mentioned technical problems.

[0005] The objective of this invention can be achieved through the following technical solutions:

[0006] A self-powered evidence-gathering emergency assistance device includes a watch case, a watch strap connected to the watch case, an openable back cover, and a main power domain disposed within the watch case. The main power domain includes a main controller, a cellular communication module, a storage module, and a main battery. It also includes a sentinel domain disposed within the watch case: the sentinel domain includes a sentinel controller, an energy harvesting unit, an energy storage capacitor, a non-volatile evidence-gathering memory, a near-field communication tag chip, a wireless beacon unit, an anti-tamper status monitoring circuit, and a real-time clock. The energy harvesting unit includes at least one of a thermoelectric generator, a photovoltaic unit, and a kinetic energy harvesting unit, and supplies power to the sentinel domain via the energy storage capacitor. The power supply between the sentinel domain and the main power domain is... The tracks are independent of each other, and information is transmitted bidirectionally between the two domains via an isolation interface. The isolation interface is configured to prevent overcurrent, overvoltage, or ground potential fluctuations on the main power domain side from being conducted to the sentinel domain, so that the power supply to the sentinel domain is not affected when the main battery is short-circuited, removed, or damaged. The main controller continuously calculates a rolling digest value for the evidence data temporarily stored in the storage module and transmits the rolling digest value to the sentinel controller via the isolation interface. The detection principle of the tamper-proof status monitoring circuit includes at least one of the following: continuity detection of the conductive circuit through the case and the strap, optical continuity detection of the fiber optic circuit, impedance or capacitance continuity characteristic detection of the tamper-proof path, and inference of the disassembly status based on the output of the motion sensor. The watch band and / or the clasp of the back cover are equipped with piezoelectric elements. These piezoelectric elements are connected to the energy storage capacitor via a rectifier energy storage circuit. When the watch band is cut or torn, or the back cover is pried open, the electrical pulse generated by the mechanical strain of the piezoelectric element flows into the energy storage capacitor and wakes up the sentry controller. The electrical charge is sufficient for the sentry controller to write the tampering event and time information into the non-volatile evidence storage memory. The tampering event signal output by the tampering status monitoring circuit is also transmitted from the sentry domain to the main controller via an isolation interface. In response to the tampering event signal, the main controller initiates a preemptive upload of the temporarily stored evidence data in the storage module. The sentry controller records the time information output by the real-time clock and the changes in the tampering status. The data is written to the non-volatile forensic memory and periodically broadcast as an encrypted sentinel beacon by the wireless beacon unit. The payload of the sentinel beacon includes device identification ciphertext, a monotonically increasing count, and a truncated value of the most recently received rolling digest value. After the main power domain completely fails, the energy harvesting unit and the energy storage capacitor maintain the above writing and broadcasting, and the broadcast uses the last received truncated value before the failure. The near-field communication tag chip is connected to or integrated with the non-volatile forensic memory and has a passive read interface. The data in the non-volatile forensic memory can be passively read by an external reading device through the near-field communication tag chip when the whole device is powered off.

[0007] In the above scheme, the sentry controller also collects the waveform characteristics of the electrical pulse. The waveform characteristics include at least one of rise time, peak amplitude, oscillation frequency and pulse train interval. Based on the matching result of the waveform characteristics and the pre-stored damage type feature template, the current tampering event is classified as one of cutting, prying or smashing. The classification result, together with the time information, is written into the non-volatile evidence memory and loaded into the sentry beacon broadcast subsequently.

[0008] Furthermore, the thermoelectric generator is attached to the skin-contacting surface of the device, and its output is also used as a basis for detecting the wearing status. When the output decays according to the set characteristics or does not conform to the thermal characteristics of the human body, it is determined that the device is no longer worn. The set characteristics include the characteristic that the output decays exponentially according to its thermal time constant after the device is no longer worn.

[0009] Furthermore, the main power domain also includes a backup power supply and a power switching circuit. When the main battery power supply is interrupted, the backup power supply takes over to complete the data upload. At least the main controller, cellular communication module, storage module and backup power supply are housed together in a thermally conductive potting compound. The thermally conductive potting compound contains a phase change heat storage body that is in thermal contact with the power amplification device of the cellular communication module.

[0010] Furthermore, it also includes a satellite communication unit connected to the main controller. When the main controller needs to upload evidence data first, it performs multi-level degradation transmission based on the remaining power and channel availability—full upload via cellular link, minimum distress data packet via satellite short message, low-power wireless relay forwarding, and sentry beacon broadcast in sequence. The capacity of the backup power supply is determined according to the power required to ensure the delivery of the minimum distress data packet.

[0011] This invention also provides an anomaly determination method for a self-powered emergency assistance device, applied to a cloud server, comprising the following steps:

[0012] The system receives heartbeat signals sent by emergency assistance devices during normal operation. These heartbeat signals carry the latest deadline for the next heartbeat, determined by the device based on local risk assessment results, and a rolling digest value continuously calculated by the device from its locally stored evidence data. The cloud server retains the rolling digest value and uses the latest deadline as the timeout criterion. The system also receives and authenticates normal shutdown signals sent by the device before normal shutdown. If, after the latest deadline expires and a buffer period has elapsed without receiving a new heartbeat signal, and no authenticated normal shutdown signal was received before the interruption, the system determines the device is abnormally disconnected and pushes a warning notification to the terminal corresponding to the emergency contact. During the heartbeat interruption or after determining abnormal disconnection, if the system receives a signal via a relay terminal... The encrypted sentinel beacon originating from the device's sentinel domain and powered by energy harvesting is verified by checking the device identifier and monotonically increasing count in the beacon payload to exclude replays. The device is determined to be in an abnormal survival state where the main power supply is failed or communication is suppressed but the device is still alive. This is handled differently from an abnormal disconnection. The approximate location trajectory of the device is updated according to the approximate location reported by the relay terminal. After the sentinel beacon disappears, the device status is changed to an abnormal disconnection state. The truncated value of the rolling digest value carried in the payload is extracted and compared with the retained rolling digest value to determine the last evidence anchor point. Evidence data delivered by any means afterward is verified for integrity and timing according to the retained rolling digest value and the last evidence anchor point. The verification results are sent out together with the early warning notification.

[0013] Furthermore, the latest deadline carried by the heartbeat signaling is a deadline value determined by the device after making a local risk assessment based on at least one of the following: motion state, time period, location information, and physiological parameters. It is shortened when the risk increases and extended when the risk decreases.

[0014] Furthermore, the method also includes receiving interference indication information reported by the device before the heartbeat signaling is interrupted. The interference indication information is generated by the device when it detects interference characteristics such as abnormal loss of network registration status accompanied by abnormal increase in radio frequency noise level. The cloud server uses it as a weighting condition for judgment.

[0015] Furthermore, the background evidence data that the cloud server retains was uploaded by the device when it was initially judged to be suspected of being damaged locally, and was only sent out with the early warning notification after the abnormal disconnection or abnormal survival status was determined and the integrity and timing were verified.

[0016] Furthermore, the cloud server receives and retains the encrypted evidence data uploaded by the device after encryption with the evidence key; the evidence key is split into at least three key fragments through threshold secret sharing, with the cloud server holding one of them and the rest held by the device and the terminal corresponding to the emergency contact respectively, and neither party alone is sufficient to decrypt it; the cloud server only combines the fragments submitted by the emergency contact terminal to decrypt after determining abnormal disconnection or abnormal survival status, so that evidence that is not normally visible is upgraded from platform commitment to cryptographic constraint.

[0017] As a further method that can be selected in specific implementations, the normal shutdown signaling includes low battery signaling and authorized shutdown signaling verified by identity. Each signaling can be signed with the device key and carry a monotonically increasing count to prevent forgery. Authorized shutdown can be executed through a two-phase handshake of shutdown request, shutdown token, and shutdown receipt. The device can also be set with a coerced shutdown credential. Upon receiving the credential, the device will exhibit the appearance of stopping operation and enter a silent evidence collection mode. The magnetic tamper-proof switch inside the device can be supplemented by a magnetic field sensor to identify external magnet spoofing. The above methods are all optional supplements to the solution of this invention.

[0018] This invention also provides a self-powered emergency assistance system for evidence collection, comprising an emergency assistance device, a cloud server, a relay terminal, and a terminal corresponding to an emergency contact, wherein:

[0019] The emergency assistance device is configured to encrypt locally stored background evidence in segments according to a forward security key chain and encode it into background evidence fragments through erasure coding, distribute the background evidence fragments opportunistically using sentinel beacons, and issue a destruction witness token containing the signature and time of the destruction event with its private key when a destruction event is detected.

[0020] The relay terminal is configured to forward the received background evidence fragments and the destruction witness token to the cloud server without decryption;

[0021] The cloud server is configured to retain the background evidence fragments but not decrypt them, wherein the key required to decrypt the background evidence fragments is split through threshold secret sharing, and the sum of the key fragments held by the cloud server and the terminal corresponding to the emergency contact is insufficient to reach the decryption threshold, and the destruction witness token carries one key fragment necessary for the threshold;

[0022] The cloud server is also configured to, only after determining that the emergency assistance device is in an abnormal survival state or an abnormal disconnection state, and after receiving the destruction witness token, use the key fragment carried by the destruction witness token, together with the key fragment submitted by itself and the terminal corresponding to the emergency contact, to synthesize a decryption key, decrypt and reconstruct the remaining background evidence fragments, and send the reconstructed background evidence before destruction to the terminal corresponding to the emergency contact along with the warning notification.

[0023] The three aspects of this invention—a self-powered forensic emergency assistance device, an anomaly determination method, and an emergency assistance system—share the same inventive concept: the last evidence anchor and destruction witness generated by a self-powered sentinel domain after a main power failure, and witnessed by a third-party relay terminal. Specifically, both the last evidence anchor and the destruction witness are products of the same self-powered sentinel domain. On the device side, the last evidence anchor carrying a rolling digest truncation value is continuously broadcast via sentinel beacons, and a destruction witness token is issued by the sentinel domain when a destruction event occurs. On the method side, the last evidence anchor witnessed by the relay terminal is used to distinguish between the device's abnormal survival state and abnormal disconnection state, and to verify the evidence. On the system side, the destruction witness token issued by the sentinel domain at the moment of destruction serves as a key fragment necessary for threshold decryption. Although the three aspects address different specific problems such as state differentiation and evidence decryption, they all cooperate with each other, centered on the same product generated by the self-powered sentinel domain after a main power failure and witnessed by a third-party relay.

[0024] The beneficial effects of this invention are as follows:

[0025] Firstly, the power that the energy harvester can provide at the wrist is only in the tens of microwatts, far from enough to support cellular communication. However, the load of the sentinel domain—real-time clock maintenance, anti-tamper event writing, and low-power wireless beacon broadcasting—is within this range. Based on this, the sentinel domain enables the device's alarm and evidence collection capabilities to no longer depend on the survival of any battery. After both the main battery and the backup power supply are destroyed, as long as any harvesting source exists, such as temperature difference, light, or movement, the device can record the anti-tamper status indefinitely and broadcast distress beacons. This is fundamentally different from a shutdown-based search solution that relies on the remaining battery power and has an hourly time limit.

[0026] Secondly, the piezoelectric element makes the mechanical energy of the destructive action itself the energy source for solidifying the destructive event. The more violent the destruction, the more sufficient the energy supply, and the avoidance path of cutting off power before destruction fails—the power outage is precisely when the sentinel domain takes over. Furthermore, the waveform of the electrical pulse itself is the sensing signal of the destruction mode. Cutting, prying, and smashing exhibit distinguishable waveform characteristics, and the classification and evidence collection of destruction types does not add any dedicated sensors or incremental power consumption.

[0027] Third, the thermoelectric generator uses the same device to perform both power supply and wear status detection functions, with zero incremental power consumption for wear detection.

[0028] Fourth, the phase change heat storage body in the thermally conductive potting compound absorbs the explosive heat of the cellular power amplifier device during the power outage and emergency power transmission by using the latent heat of phase change, thus resolving the heat dissipation contradiction between potting protection and full power transmission, and suppressing the temperature rise of the skin-contact surface.

[0029] Fifth, in addition to online, normal shutdown, and abnormal disconnection, a fourth state of abnormal survival is introduced by the sentinel beacon and relay terminal. This enables the cloud server to distinguish between devices that are still alive despite main power failure or signal suppression and devices that have been completely destroyed, making the handling more precise. Moreover, the continued existence of the sentinel beacon itself provides clues for post-event tracking of device location.

[0030] Sixth, the heartbeat signaling also anchors the rolling digest value of the evidence data, enabling the integrity and timing of evidence delivered through any means afterward, such as retransmission, passive reading, or device retrieval, to be verified. This solves the problem of evidence authenticity with almost zero additional power consumption. Furthermore, the truncated value of the rolling digest is synchronized to the sentinel domain via the isolation interface and continuously broadcast to the outside world with the sentinel beacon. Each beacon frame received by the relay terminal constitutes a miniature evidence anchor witnessed by a third party. Even if the device is subsequently completely destroyed and the non-volatile evidence storage cannot be read, the cloud server still holds the evidence commitment at the last moment before the incident (the last evidence anchor point) to verify the evidence copy delivered through any means afterward. The evidence chain no longer depends on the survival of the device wreckage.

[0031] Seventh, the latest deadline for heartbeats dynamically expands and contracts with local risk, thereby reducing equipment power consumption while shortening the detection delay of abnormal states in high-risk situations, and improving the mutually restrictive indicators of power consumption and latency.

[0032] Eighth, the decryption keys for evidence data are shared securely among the device, cloud server, and emergency contact terminal. The cloud server alone does not mathematically possess decryption capabilities, transforming the platform's self-regulatory commitment to not viewing evidence under normal circumstances and releasing it only when an incident occurs into a cryptographically enforced constraint, thus eliminating the risk of abuse by the custodian.

[0033] Ninth, the preemptive upload no longer relies on a single cellular link, but instead uses a step-by-step degradation method based on remaining power and channel availability, from full cellular upload, minimum distress data packet of satellite short message, low-power relay forwarding, sentinel beacon broadcast and passive debris reading, forming a dual resilience gradient of energy and channel. Even in the event of a combined attack of communication suppression and power outage, it can still ensure the delivery of distress information and key evidence elements to the minimum extent. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of the overall structure of an emergency assistance device for self-powered evidence collection according to the present invention.

[0035] Figure 2 This is a circuit connection block diagram of the main power domain and the sentinel domain in one embodiment of the present invention;

[0036] Figure 3 This is a flowchart illustrating the workflow of the sentinel domain after the main power domain fails in one embodiment of the present invention.

[0037] Figure 4 This is a flowchart of an anomaly determination method for a self-powered emergency assistance device according to the present invention.

[0038] Figure 5 This is a schematic diagram of the overall architecture of an emergency assistance system for self-powered evidence collection according to the present invention.

[0039] Figure 6 This is a timeline diagram of the forward preservation of background evidence and the unsealing of evidence through destruction, as shown in one embodiment of the present invention.

[0040] Explanation of reference numerals in the attached diagram: 1. Case; 2. Strap; 3. Back cover; 10. Main power domain; 11. Main controller; 12. Cellular communication module; 13. Storage module; 14. Main battery; 15. Backup power supply; 16. Power switching circuit; 17. Audio acquisition module; 18. Positioning module; 19. Power amplification device; 20. Sentinel domain; 21. Sentinel controller; 22. Energy harvesting unit; 221. Thermoelectric generator; 222. Photovoltaic unit; 2 23. Kinetic harvesting unit; 23. Energy storage capacitor; 24. Non-volatile forensic memory; 25. Near-field communication tag chip; 26. Wireless beacon unit; 27. Tamper-proof status monitoring circuit; 28. Real-time clock; 29. ​​Isolation interface; 31. Piezoelectric element; 32. Rectifying energy storage circuit; 33. Satellite communication unit; 41. Phase change thermal storage body; 42. Thermally conductive potting compound; 50. Cloud server; 60. Relay terminal; 70. Terminal corresponding to emergency contact. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] Example 1: Overall Equipment Structure and Main Power Domain. For example... Figure 1 , Figure 2As shown, the emergency assistance device (hereinafter referred to as the assistance device) in this embodiment is a safety watch, including a watch case 1, a watch strap 2 connected to the watch case 1, and an openable back cover 3. The watch case 1 is provided with a main power domain 10, which includes a main controller 11, a cellular communication module 12, a storage module 13, a main battery 14, a backup power supply 15, a power switching circuit 16, an audio acquisition module 17, and a positioning module 18. The main controller 11 can be a low-power microcontroller (such as the STM32L series or nRF52 series), the cellular communication module 12 can be a Cat.1 or NB-IoT module, the storage module 13 can be an SPI Flash storage chip, the audio acquisition module 17 continuously acquires audio and temporarily stores the data of the most recently set duration in the storage module 13 in a rolling over manner, and the positioning module 18 obtains its position via a global navigation satellite system. Both the main battery 14 and the backup power supply 15 (supercapacitor bank or independent backup battery) are powered by the main controller 11, storage module 13, and cellular communication module 12 via the power switching circuit 16 (an automatic switching circuit composed of isolation diodes or field-effect transistors) and are isolated from each other. When the main battery 14 is interrupted, the backup power supply 15 takes over the power supply, and the main controller 11 controls the storage module 13 and cellular communication module 12 to complete the retransmission of the temporarily stored evidence data. The charging path of the backup power supply 15 is also isolated from the main battery 14 by a unidirectional isolation device. When the main battery 14 is short-circuited, its short-circuit current will not affect the backup power supply 15 through the charging path. At least the main controller 11, cellular communication module 12, storage module 13, and backup power supply 15 are housed within a thermally conductive potting compound 42. The thermally conductive potting compound 42 uses a potting material doped with alumina or boron nitride thermally conductive filler (thermal conductivity can reach 1W / (m·K)~3W / (m·K)). A phase change heat storage body 41 is installed within the thermally conductive potting compound 42. This phase change heat storage body 41 uses a paraffin-based or hydrated salt phase change material with a phase change temperature of 45℃~55℃, and makes thermal contact with the power amplifier device 19 of the cellular communication module 12 via a thermal pad. Since the emergency transmission is a short-duration burst condition on the order of tens of seconds, the latent heat of the phase change of a few grams of phase change material can absorb most of the burst heat of the power amplifier device 19 during the emergency transmission, allowing the cellular communication module 12 to complete the emergency transmission at full power without thermal derating under complete potting protection, while simultaneously suppressing the temperature rise of the skin-contact surface.

[0043] Example 2: Sentinel Domain and its Power Consumption Budget. The term "sentinel domain" in this application refers to a circuit domain that is independent of the main power domain's power rails, continuously powered by the energy harvesting unit via energy storage capacitors, and continues to perform tamper detection, evidence writing, and beacon broadcasting even after the main power domain fails. This naming is consistent with the common usage of the term "power domain" in integrated circuits and embedded design, signifying a sentinel's long-term vigilance and immediate reporting of anomalies. For example... Figure 2 , Figure 3As shown, the watch case 1 also includes a sentinel domain 20, which comprises a sentinel controller 21, an energy harvesting unit 22, an energy storage capacitor 23, a non-volatile forensic memory 24, a near-field communication tag chip 25, a wireless beacon unit 26, an anti-tamper status monitoring circuit 27, and a real-time clock 28. The energy harvesting unit 22 includes at least one of the following: a thermoelectric generator 221 attached to the skin-contacting surface of the device, a photovoltaic unit 222 disposed on the edge of the dial or the surface of the strap 2, and a kinetic energy harvesting unit 223. There is usually a temperature difference of 1K to 3K between the human body and the environment. The thermoelectric generator 221 can output power in the tens of microwatts range. Under indoor lighting, the photovoltaic unit 222 can output tens to hundreds of microwatts. When the wearer walks, the kinetic energy harvesting unit 223 can output an average of tens of microwatts. Harvesting energy charges the energy storage capacitor 23 (a supercapacitor in the tens of millifarads range) via an energy harvesting power management circuit with low-voltage cold-start capability. When using a transformer-boosted cold-start circuit, the cold-start voltage can be as low as tens of millivolts; when using a switching-boost circuit, the cold-start voltage is typically several hundred millivolts. This embodiment selects one based on the open-circuit voltage of the chosen harvesting source. The load on the sentry domain 20 is as follows: the real-time clock 28 has a continuous power consumption of approximately 1 microwatt; the non-volatile forensic memory 24 uses ferroelectric memory with a single write power consumption in the nanojoule range; and the wireless beacon unit 26 uses Bluetooth Low Energy, consuming approximately 10 to 30 microjoules to transmit a single broadcast frame at 0 dBm. With a harvesting power of 30 microwatts, approximately 300 microjoules can be accumulated every 10 seconds, sufficient to support beacon broadcasts every few to tens of seconds with ample margin for event writing. Therefore, even after the failure of both the main battery 14 and the backup power supply 15, the sentinel domain 20 can operate indefinitely as long as any harvesting source—temperature difference, light, or movement—is present. Under extreme conditions such as darkness and stillness where the harvesting input approaches zero, the stored charge in the energy storage capacitor 23 can still sustain evidence writing and reduced-frequency broadcasting for several hours to several days after reducing the broadcast frequency. The detection principle of the tamper-proof status monitoring circuit 27 is not limited to one type. It can be any one or a combination of the following: continuity detection of the conductive circuit connecting the case 1 and the strap 2; optical continuity detection of the fiber optic circuit; impedance or capacitance continuity characteristic detection of the tamper-proof path; or tamper-proof status inference based on the output of the motion sensor. Under any principle, the detection result is provided to the sentinel controller 21 in the form of tamper-proof status change events. All of the above detection methods are equivalent to each other in this application and are all implementations of the tamper-proof status monitoring circuit 27.

[0044] The main controller 11 calculates the hash of the evidence data temporarily stored in the storage module 13 by time slice and iterates in a chain to form a rolling digest value. After each update, the rolling digest value is transmitted to the sentinel controller 21 via the isolation interface 29. The isolation interface 29 is configured to transmit information bidirectionally between the two domains while preventing overcurrent, overvoltage, or ground potential fluctuations on the main power domain 10 side from being transmitted to the sentinel domain 20: the rolling digest value is transmitted from the main power domain 10 to the sentinel domain 20 via the isolation interface 29; the tamper event signal output by the tamper status monitoring circuit 27 is transmitted from the sentinel domain 20 to the main controller 11 via the isolation interface 29 to trigger the main power domain 10 to preemptively upload the temporarily stored evidence data. To achieve the above isolation, the isolation interface 29 can employ optocouplers, capacitively isolated or magnetically isolated digital isolation devices to ensure that the two domains are not grounded and are coupled only through an isolation barrier. Alternatively, it can employ level conversion devices with current limiting, clamping, or isolation grounding measures to prevent power supply faults from being conducted. The power supply rails of the two domains are completely independent, and short-circuiting, removing, or destroying the main battery 14 will not affect the sentinel domain 20. The sentinel controller 21 is configured to broadcast encrypted sentinel beacons at a relatively long period (e.g., 60 seconds) under normal circumstances, and automatically shorten the broadcast period (e.g., shorten it to 2 seconds) after the tamper status monitoring circuit 27 detects a tamper event. Each change in tamper status is written to the non-volatile forensic memory 24 along with the time information of the real-time clock 28. The sentry beacon is encrypted with a pre-set device key. The payload includes device identification ciphertext, event type, monotonically increasing count, and a truncated value of the most recently received rolling digest value (e.g., the first 8 bytes of the rolling digest value) to prevent replay and anchor evidence. The broadcast address is randomized to prevent the beacon from being used to track the wearer. The sentry beacon can use extended broadcast bearer of Bluetooth Low Energy, or the field length of the device identification ciphertext and truncated value can be agreed upon accordingly to adapt to the length limit of the broadcast payload. After the main power domain 10 fails, the broadcast uses the last received truncated value before the failure, making the truncated value a continuous public display of the evidence status at the last moment before the incident. As a further reliability measure, if the energy storage capacitor 23 is completely depleted over a long period of time, causing the real-time clock 28 to lose absolute time, the sentry controller 21 switches to time base degradation mode: the absolute time is replaced by monotonic counting in the evidence record, and the time base degradation flag is set in the sentry beacon. After the cloud server 50 receives the beacon carrying the flag via relay, it uses the reception time reported by the relay terminal 60 as the reference to invert the absolute time of each evidence record.The near-field communication tag chip 25 uses an NFC tag chip with energy harvesting and a host interface, and is connected to or integrated with the non-volatile evidence storage 24 (i.e., its built-in non-volatile storage area also serves as the non-volatile evidence storage 24). The RF energy harvesting power supply domain of the near-field communication tag chip 25 is isolated from the power supply rail of the sentry domain 20 by a diode or load switch to prevent external readers from backfeeding power to the energy storage capacitor 23 or interfering with the operation of the sentry controller 21. When the near-field communication tag chip 25 and the non-volatile evidence storage... When device 24 is a discrete chip and only electrically connected, the non-volatile forensic memory 24 is powered separately by the power-harvesting domain obtained from the external reader's radio frequency field by the near-field communication tag chip 25 when the entire device is powered down. This power-harvesting domain is isolated from the power supply rail of the sentry domain 20, so it can be read by the radio frequency field when the entire device is powered down, without causing the external radio frequency field to backflow into the sentry domain 20. When the two are integrated (with the built-in non-volatile memory area of ​​the near-field communication tag chip 25 also serving as the non-volatile forensic memory 24), this path is naturally absent. After the entire device is powered down, rescue or law enforcement personnel can passively read the last forensic records stored in it by bringing a near-field communication-enabled reading device close to the device wreckage. The components of the sentry domain 20 are preferably encapsulated separately in an independent second potting body, or integrated with the thermally conductive potting body 42, with the circuits of the two domains still only electrically connected through the isolation interface 29, and placed deep inside the casing 1 to increase their survival probability during the destruction process.

[0045] Example 3: Evidence consolidation and classification of damage types powered by destructive actions. For example... Figure 1As shown, a piezoelectric element 31 (e.g., PVDF piezoelectric film) is embedded in the watch strap 2 along its length direction, and a piezoelectric element 31 in the form of a piezoelectric ceramic sheet is provided at the latch of the back cover 3; the piezoelectric element 31 is connected to the energy storage capacitor 23 through the rectifier energy storage circuit 32 (full bridge rectification and voltage limiting). When the watch strap 2 is cut or torn, or the back cover 3 is pried open, the intense mechanical strain causes the piezoelectric element 31 to generate electrical pulses ranging from tens of microjoules to millijoules. These pulses are fed into the energy storage capacitor 23 via the rectifier energy storage circuit 32 and wake up the sentry controller 21. To match the millisecond-level pulse width with the controller's wake-up delay, the rectifier energy storage circuit 32 first stores the pulse energy in the energy storage capacitor 23. After the sentry controller 21 is woken up, the power management output of the energy harvesting unit 22 and the output of the rectifier energy storage circuit 32 are fed into the energy storage capacitor 23 via isolation diodes or ideal diodes to prevent any input channel from backflowing power to the other channel. After the sentry controller 21 is woken up, it draws power from the energy storage capacitor 23 to complete the writing process. The piezoelectric element 31 is preferably located at the base of the strap 2 and near the buckle of the back cover 3. Its lead is directly introduced into the watch case 1 with a short path. The piezoelectric elements 31 on both sides of the strap 2 are connected in parallel to the rectifier energy storage circuit 32, so that when one side of the strap is cut, the lead on the other side can still deliver the electrical pulse. The rectifier energy storage circuit 32 has a voltage limiting and transient suppression clamp on the piezoelectric input channel where the piezoelectric element 31 is located. The harvesting input channels where the thermoelectric generator 221 and the photovoltaic unit 222 are located have voltage limiting and transient suppression clamps at the input end of the energy harvesting power management circuit, respectively. That is, each input channel of piezoelectric, thermoelectric and photovoltaic has a voltage limiting and transient suppression clamp at its respective input end before it is connected to the energy storage capacitor 23, so as to prevent the sentinel domain 20 from being damaged by high voltage reverse injection through the external lead of the casing. Sentinel controller 21 writes the type of tampering event and the time information of real-time clock 28 into non-volatile forensic memory 24 (the required energy is only nanojoules to microjoules, far less than pulse energy), and immediately sends out a sentinel beacon when the energy storage capacitor 23 has sufficient reserve. Further, after being woken up, sentinel controller 21 collects the waveform characteristics of the electrical pulse through a high-speed sampling channel: a shearing action is characterized by a single sharp pulse with a short rise time and high peak value; a prying action is characterized by a low-frequency pulse with a slow rise time and long duration; and a smashing action is characterized by a high-amplitude oscillating pulse train. Sentinel controller 21 matches the collected waveform characteristics such as rise time, peak amplitude, oscillation frequency, and pulse train interval with a pre-stored damage type characteristic template (which can be calibrated by prototype damage testing at the factory), classifying the tampering event as one of shearing, prying, or smashing. The classification result, along with the time information, is written into non-volatile forensic memory 24 and loaded into the subsequently broadcast sentinel beacon.Thus, the mechanical energy of the destructive action itself becomes the energy source for solidifying the evidence of the destructive event. The more violent the destruction, the more sufficient the energy supply. Its electrical pulse waveform itself also becomes a sensing signal of the destruction method. The classification and evidence collection of the destruction type does not require any special sensors. Moreover, the perpetrator cannot circumvent this by cutting off the power first and then carrying out the destruction. The power being cut off is precisely when Sentinel Domain 20 takes over.

[0046] In a more generalized implementation, the sentinel domain 20 may be powered solely by the energy harvesting unit 22 via the energy storage capacitor 23 and triggered by the tamper status monitoring circuit 27 for evidence writing without relying on the piezoelectric pulse for power. In a preferred implementation, a piezoelectric element 31 is further provided so that the mechanical energy of the destructive action itself serves as both the energy source for solidifying the destructive event and the sensing signal for classifying the type of destruction, with the two not being mutually exclusive.

[0047] Example 4: Thermoelectric generator also serves as a wear status detector. Thermoelectric generator 221 is attached to the skin-contact surface of the device. During normal wear, its output is stable. After the device is removed, the thermal gradient on the skin-contact surface disappears, and the output decays exponentially according to the device's thermal time constant. When disguised as wear using a prosthetic such as a hot water bottle, the temperature difference amplitude and fluctuation characteristics differ from those of a human body. The sentinel controller 21 or the main controller 11 determines the wear status of the device based on this information, and it can be cross-checked with photoplethysmography (PPG) detection. Since the thermoelectric generator 221 is already in a power-supplying state, the incremental power consumption for this wear detection is zero.

[0048] Example 5: Method for determining abnormal states of cloud servers. For example... Figure 4 , Figure 5As shown, the processing includes the following: First, lease-based heartbeat: The device determines the latest deadline for the next heartbeat based on the local risk assessment results and carries it with the heartbeat signaling. The local risk assessment comprehensively considers at least one of the following: motion status, time of day (e.g., late at night), location information (e.g., deviating from the usual area), and physiological parameters (e.g., abnormally high heart rate). When the risk is low, this deadline can be extended to tens of minutes and combined with the power-saving mode of cellular IoT or extended discontinuous reception deep sleep. When the risk is high, it is automatically shortened to tens of seconds. The cloud server 50 uses the expiration of the latest deadline carried by the most recent heartbeat and the absence of a new heartbeat signaling after a set buffer wait (to exclude temporary disconnection caused by signal blind spots) as the criterion for heartbeat interruption. Second, digest anchoring: The device calculates the hash of the locally rolled temporary evidence data such as recordings by time slice and forms a hash chain through chain iteration. Each heartbeat signaling carries the current chain head digest value (tens of bytes, with negligible additional power consumption). The cloud server 50 retains this along with the reception time. Third, authenticated normal shutdown signaling: The device sends corresponding signaling only under two normal shutdown conditions—a low battery signaling when the battery level is below a set threshold, and an authorized shutdown signaling when an identity-verified shutdown operation is executed (identity verification is at least one of shutdown password, biometrics, or a shutdown token issued by the cloud); each signaling is signed with the device key and carries a monotonically increasing count, and the cloud server does not accept signaling that fails to verify the signature or has an abnormal count. As an optional further method, authorized shutdown can be executed through a two-phase handshake of shutdown request, shutdown token, and shutdown receipt; the device can also set a coerced shutdown credential, which, upon receiving the credential, presents the appearance of shutdown and enters silent evidence collection mode. Fourth, abnormal disconnection determination: when the latest deadline has expired, the buffer wait has not been restored, and no normal stop operation signaling with authentication has been received before the interruption, the device is determined to be abnormally disconnected. The cloud server 50 pushes a warning notification to the terminal 70 corresponding to the emergency contact pre-bound to the device. The notification carries the last reported location information of the device, the retained background evidence data and its integrity verification results.Fifth, Abnormal Survival Status and Last Evidence Anchor Point: During the heartbeat interruption or after an abnormal disconnection is determined, if a relay terminal 60 with the corresponding application installed in the vicinity receives an encrypted sentinel beacon sent by the device sentinel domain 20 (the relay terminal 60 identifies the sentinel beacon type frame according to the pre-defined broadcast protocol characteristics, and does not need to and cannot decrypt its content), it forwards the beacon along with the approximate location of the relay terminal 60 to the cloud server 50 without decryption; the cloud server 50 verifies the device identifier and monotonically increasing count in the beacon payload to exclude replay, and thereby determines the device to be in an abnormal survival status of main power failure or communication suppression but device survival, which is different from the abnormal disconnection handling: extract the truncated value of the rolling digest value carried in the payload, compare it with each remaining rolling digest value, and determine the matching value as the last evidence anchor point; continuously update the approximate location trajectory of the device according to the relay report, and prompt the terminal 70 corresponding to the emergency contact that the device is still sending beacons; when the sentinel beacon subsequently disappears, the status changes to an abnormal disconnection status. When the device detects interference characteristics such as abnormal loss of network registration status accompanied by abnormal increase in radio frequency noise level, it reports interference indication information to the cloud server 50 before the communication is interrupted. The cloud server 50 uses the interference indication information received before the interruption as a weighting condition for the above determination. Sixth, verification and release: Background evidence data uploaded by the device when it is initially judged to be suspected of being damaged locally is stored by the cloud server 50 and will not be sent to other terminals until it is determined to be an abnormal disconnection or abnormal survival status; Afterwards, regardless of whether the evidence is transmitted in advance, read in passive near-field communication and then entered, or exported with the retrieved device, the cloud server 50 will verify its integrity and timing according to the stored rolling summary value and the last evidence anchor point. The verification result will be sent along with the warning notification for emergency contacts and subsequent handling to confirm that the evidence has not been tampered with; Since the last evidence anchor point has been relayed to the cloud server 50 by the third party witnessed by the relay terminal 60 before the device is damaged, even if the device is eventually completely destroyed and the evidence collection record cannot be read from the wreckage, the evidence copy that appears through any means afterward can still be verified against the anchor point.

[0049] Seventh, the diversion of background evidence availability and minimum safeguards (such as...) Figure 4As shown): After determining that the device is in an abnormal survival state or an abnormal disconnection state, the cloud server 50 will handle the case according to the actual evidence obtained. If the device has successfully decrypted and reconstructed the background evidence before the destruction by using the destruction witness token from the sentinel domain 20 along with the key fragments held by the threshold (corresponding to Example 9), or if the device has previously obtained complete background evidence by cellular or satellite short message transmission, the background evidence, along with the last evidence anchor point, the last reported location of the device, and the integrity verification result, will be sent to the terminal 70 corresponding to the emergency contact along with the warning notification. If neither of the above two situations is achieved in time, that is, the background evidence is not preserved, the minimum protection will be implemented. Only the last reported location information of the device, the last evidence anchor point, and the destruction fact alarm will be sent along with the warning notification, and the background evidence will be marked as missing. When the background evidence is delivered by any means such as transmission, passive reading through near-field communication, or device retrieval, it will be verified and resubmitted according to the retained rolling digest value and the last evidence anchor point. Therefore, regardless of whether the background evidence is ultimately preserved in a timely manner, the cloud server 50 can at least deliver the last reported location of the device and the alarm of the damage to the emergency contact, which constitutes the minimum guarantee baseline of this method.

[0050] Example 6: Threshold-based evidence escrow, which can be implemented in conjunction with the aforementioned examples. The help-seeking device generates a random evidence key for each recording time slice, and encrypts the locally rolled audio data using a symmetric encryption algorithm (e.g., AES-GCM or SM4). The ciphertext is uploaded with the help-seeking request or the request for assistance and is stored in ciphertext form by the cloud server 50. The evidence key is split into three key fragments using a threshold secret sharing algorithm (e.g., the Shamir threshold scheme, with a threshold value of two and a fragment number of three). These fragments are held by the secure storage area of ​​the help-seeking device, the cloud server 50, and the terminal 70 corresponding to the emergency contact (distributed when binding the emergency contact). The fragment held by any single party is insufficient to recover the evidence key. Cloud server 50 only requests the fragments from terminal 70 corresponding to the emergency contact after determining an abnormal disconnection or abnormal survival status according to the aforementioned embodiments. These fragments are then combined with cloud server 50 to form a recovery evidence key, decrypt evidence data, and send it along with the warning notification. As a supplement, the fragments stored on the device receiving assistance are only entered into cloud server 50 by the handling party's terminal after the device wreckage is passively read via near-field communication, to cover situations where terminal 70 corresponding to the emergency contact is unavailable. These fragments are not uploaded in plaintext along with the data to prevent cloud server 50 from unilaterally collecting both key fragments and violating the threshold constraint. Thus, the platform's self-regulatory commitment to not review evidence under normal circumstances and only release it after an incident is upgraded to a cryptographically enforceable constraint.

[0051] Example 7: Multi-layered degraded transmission with joint energy and channel scheduling can be implemented in conjunction with the aforementioned examples. For example... Figure 2 , Figure 5As shown, the assistance device is also equipped with a satellite communication unit 33 connected to the main controller 11, such as a communication module that supports BeiDou short message or 3GPP non-terrestrial network (NTN) standards. The main controller 11 continuously maintains the channel status (cellular registration status, satellite visibility, low-power wireless relay reachability) and remaining power estimates. When it is necessary to upload evidence data first, it performs the following degraded operations in order: First, when the cellular link is available, the evidence data is uploaded in full via the cellular communication module 12, which requires continuous high-power transmission for tens of seconds; Second, when the cellular link is unavailable but the satellite link is available, the minimum distress data packet is sent via satellite short message via the satellite communication unit 33. Its content includes key elements such as location information, event type, and current rolling summary value, which are tens of bytes long. A single transmission only takes a few seconds, and communication suppression devices are usually aimed at the ground cellular frequency band, making it significantly more difficult to suppress satellite uplink pointing towards the zenith; Third, when the satellite link is also unavailable, it is forwarded by the surrounding relay terminals via low-power wireless broadcast, and the sentry domain 20 continuously broadcasts encrypted sentry beacons; Fourth, after the entire device loses power, the last evidence record is passively retained by the non-volatile evidence storage memory 24. The required power and channel conditions for each layer decrease sequentially. The capacity of the backup power supply 15 is determined based on the power required to ensure that the minimum distress data packet is delivered at least once. Thus, under the same volume and cost, the design objective is upgraded from a best-effort full-volume preemptive transmission to a minimum delivery with deterministic guarantee.

[0052] Example 8: The following are further implementation methods that can be implemented alone or in combination with the foregoing examples. First, excitation verification for tamper detection: The control unit applies a pseudo-randomly modulated excitation signal to the tamper detection path and verifies the consistency between the echo signal or impedance characteristics and pre-stored characteristics (which can be calibrated at the factory or during component pairing) to identify destructive methods such as bypassing the detection path with a bridging wire. Second, environmental backscattering beacon: The wireless beacon unit 26 of the sentry domain 20 can use environmental backscattering to transmit the sentry beacon by reflecting existing radio signals in the environment, reducing the beacon transmission power consumption to the nanowatt to microwatt level, further reducing the harvesting power requirements of the sentry domain 20. Third, RF fingerprint-assisted final positioning: The heartbeat signaling can also carry a cellular measurement report (signal strength fingerprint of the serving cell and neighboring cells). The cloud server 50 maintains the RF fingerprint trajectory of the distress device based on this, and retrieves the device's final position by fingerprint matching when satellite positioning is unavailable or the positioning module 18 is destroyed. Fourth, edge-side acoustic event recognition: The help-seeking device can run a lightweight neural network model to locally recognize acoustic events such as screams, broken glass, and distress keywords. Only event labels, rather than the original audio, are used as factors for local risk assessment to drive the contraction of the latest heartbeat deadline and the pre-upload of evidence. The model can be updated via federated learning, and the original audio data does not leave the device. Fifth, trusted execution environment for evidence collection and judicial blockchain anchoring: The collection, digest calculation, and signing of evidence data can be completed within the trusted execution environment of the main controller 11. The rolling digest value can be further anchored to the judicial blockchain evidence storage platform, enabling the evidence chain to meet higher requirements for judicial acceptance. Sixth, security status subscription: The cloud server 50 can maintain a state machine for each help-seeking device, including online, normal stop, abnormal disconnection, abnormal survival, and duress states, and provide subscriptions for state transitions to authorized third-party systems via an event push interface. All of the above can be implemented without changing the overall architecture of the aforementioned embodiments.

[0053] Example 9: Forward Preservation and Destruction Witnessing of Background Evidence in Cases of Instantaneous Complete Destruction. Based on Examples 1 to 8, as follows... Figure 6 As shown, this embodiment further provides a mechanism to deliver background evidence from a period prior to the destruction to emergency contacts even when the emergency assistance device suffers instantaneous and complete physical damage (e.g., high-energy crushing, burning, or explosion, causing the storage module 13, non-volatile forensic memory 24, and near-field communication tag chip 25 to be destroyed before evidence solidification or subsequent passive reading is completed). This mechanism does not upload plaintext background evidence to the cloud server 50 in real time under normal circumstances, to balance privacy and power consumption.

[0054] Opportunistic Dispersion of Evidence Fragments: The main controller 11 divides the background audio and associated sensor data collected by the audio acquisition module 17 into evidence segments according to a fixed duration. Each evidence segment is encrypted with a session key. The session key is derived from a forward-secure key chain, which is derived segment by segment from the initial key through a one-way hash function. Each session key is destroyed after use and cannot be traced back by subsequent keys, thereby limiting the range of segments affected by the leakage of any session key. The encrypted evidence segments are divided into several evidence fragments through erasure coding (e.g., Reed-Solomon coding). Each evidence fragment is opportunistically dispersed in the sentinel beacon payload periodically broadcast by the wireless beacon unit 26 in the sentinel domain 20. The dispersion only reuses the existing low-power beacon broadcast channel without additionally activating the cellular communication module 12, so it basically does not increase power consumption. After any nearby relay terminal 60 passively receives the evidence fragment, it forwards it to the cloud server 50 without decryption. Because of erasure coding, the cloud server 50 does not need to receive all fragments from a single relay terminal, but can reconstruct the corresponding evidence segments from fragments gathered from a large number of past relay terminals; it only needs to preserve the evidence fragments of each segment within a sliding window (e.g., tens of seconds to several minutes) before the destruction occurs, and earlier evidence fragments will naturally become invalid as the key chain progresses.

[0055] Issuance of the Destruction Witness Token: When the tamper status monitoring circuit 27 detects a destruction event, the sentry controller 21 of the sentry domain 20, in addition to writing the destruction event type and time into the non-volatile forensic memory 24 as in Embodiment 3, also signs the data containing the destruction event type, the timestamp of the real-time clock 28, and the current key chain position using the private key held by the sentry domain 20, generating a destruction witness token, and loading it into the subsequently issued sentry beacon; the token is powered by energy provided by the piezoelectric element 31 or the energy harvesting unit 22, and does not require power from the main power domain 10. The destruction witness token is forwarded to the cloud server 50 via the relay terminal 60 in a non-decryption manner, constituting verifiable proof that destruction has indeed occurred.

[0056] Key Threshold Custody and Event-Triggered Decryption: The root key or session keys of the forward secure key chain are split into multiple key fragments through threshold secret sharing. One key fragment required for a threshold is not pre-custodied by any online node, but is carried by a destruction witness token and distributed via sentinel beacons when a destruction event occurs. The remaining fragments are held by the cloud server 50 and the terminal 70 corresponding to the emergency contact, respectively. Accordingly, the threshold is set to require the fragment carried by the destruction witness token to be synthesized into a decryption key. Accordingly, during the normal operation of the emergency assistance device, no single party or even any combination of parties without destruction witness is sufficient to decrypt the distributed evidence fragments. The cloud server 50 normally only holds uninterpretable ciphertext fragments and irreversible rolling digest values, thus protecting the wearer's privacy. It should be noted that the threshold scheme in this embodiment and the three-party threshold scheme for the evidence key described in Embodiment Six are two independent escrow mechanisms, which can be implemented individually or in combination: Embodiment Six prevents unilateral decryption by the cloud server 50, while this embodiment further requires the destruction of the fragments carried by the witness token to decrypt, thereby preventing collusion between the cloud server 50 and the terminal 70 corresponding to the emergency contact. The two have different security natures. When the cloud server 50... Figure 4 The process determines that the emergency assistance device is in an abnormal survival state or an abnormal disconnection state, and after receiving a destruction witness token from the sentinel domain 20, it uses the fragments carried by the token, together with the remaining fragments held by the cloud server 50 and the terminal 70 corresponding to the emergency contact, to synthesize the decryption key of the corresponding segment. The remaining evidence fragments are decrypted, corrected, and reconstructed. The reconstructed background evidence of destruction, along with the last location and integrity verification results, are sent to the terminal 70 corresponding to the emergency contact along with the warning notification.

[0057] The aforementioned emergency assistance device, relay terminal, emergency contact terminal, and cloud server together constitute an emergency assistance data processing system. The fragment segmentation encryption and erasure coding are completed by the main controller 11 during normal operation of the main power domain. The opportunistic distribution of fragments is carried out by the wireless beacon unit 26 of the sentinel domain 20. The destruction witness token is issued by the sentinel controller 21 when a destruction event occurs. Both of these are maintained by the self-powered sentinel domain 20 after the main power fails. The key required for decryption is split through threshold secret sharing. The sum of the fragments held by the cloud server and the emergency contact terminal is insufficient to reach the decryption threshold. The destruction witness token carries one fragment necessary for the threshold. Therefore, if the destruction witness token issued by the device at the moment of destruction is missing, the cloud server cannot decrypt even if it colludes with the emergency contact terminal. Thus, the decryption capability is cryptographically anchored to the physical event that the device has indeed been destroyed. It should be noted that this embodiment decouples the outflow of background evidence from its readability in terms of time and conditions: the encrypted evidence leaves the device and is dispersed before the destruction occurs, and its decryption permission is only unlocked after the fact of destruction is independently proven by the self-powered destruction witness of the sentinel domain 20. Thus, even if the device is instantly and completely destroyed and all remaining evidence inside the device is inaccessible, the loss of background evidence is still limited to a range of less than one dispersal window before the destruction. In environments with sparse traffic or no relay coverage, the probability of evidence fragments being gathered and reconstructed decreases accordingly. At this time, the satellite communication unit 33 can carry the preemptive transmission of destruction witness tokens and key fragments, causing this mechanism to degenerate into a fallback mode of delivering the last evidence anchor point and destruction fact alarm via satellite short message; therefore, this mechanism is used to increase the probability of background evidence being preserved in the case of instantaneous complete destruction, rather than ensuring that it will necessarily be preserved. In terms of privacy, the evidence dispersed outside is always encrypted and its decryption is subject to both threshold and destruction witness constraints, which is equivalent to not being disclosed under the threat model of this invention. In summary, there are three scenarios for the delivery of background evidence prior to destruction: First, the evidence was completely uploaded to the cloud server 50 via cellular or satellite pre-transmission before the destruction occurred; second, evidence fragments were opportunistically dispersed before the destruction, and were subsequently aggregated and reconstructed by the cloud server 50 after the destruction, then unlocked with a destruction witness token; third, neither of the first two scenarios was completed in time, and the background evidence was not preserved, in which case only the last evidence anchor point witnessed by a third party and the last reported location of the device remain. This invention does not guarantee that the first two scenarios will necessarily occur, but rather maximizes the probability of background evidence preservation through multiple parallel pathways such as cellular pre-transmission, satellite short messages, and opportunistic fragment dissemination; even if the third scenario occurs, the last reported location information of the device and the destruction fact alarm will still reach the terminal 70 corresponding to the emergency contact person, constituting the minimum guarantee that cannot be lowered further.

[0058] Example 10: Further enhancements to power consumption, heat dissipation, and information storage can be implemented individually or in combination with the aforementioned examples, without requiring additional reference numerals. Firstly, adaptive joint scheduling of the energy storage capacitor's state of charge: The sentinel controller 21 estimates the state of charge of the energy storage capacitor 23 in real time, and uses the harvesting power of the energy harvesting unit 22 and this state of charge as input to form a closed loop, jointly scheduling the broadcast cycle of the sentinel beacon and the cycle of writing evidence records to the non-volatile evidence storage memory 24—broadcasting with a shorter cycle and normal writing when the charge is sufficient; as the charge decreases, the broadcast and writing cycles are gradually extended until only compressed key evidence records are written and broadcast at a reduced frequency, thus gradually degrading according to the energy budget without interrupting evidence collection and distress calls when the temperature difference, illumination, and motion harvesting inputs approach zero. Secondly, the sensing multiplexing of the kinetic energy harvesting unit 223: In addition to supplying power to the energy storage capacitor 23, the output electrical signal of the kinetic energy harvesting unit 223 is also used by the sentry controller 21 as a motion sensing signal to identify actions such as falls or violent struggles and as a factor in local risk assessment. This motion sensing shares the same device with energy harvesting and has zero incremental power consumption, similar to the multiplexing of power supply and wear detection by the thermoelectric generator 221 in Embodiment 4. Thirdly, environmental backscattering beacon: The wireless beacon unit 26 can adopt an environmental backscattering method to transmit a sentry beacon by modulating and reflecting existing radio signals in the environment, reducing the beacon transmission power consumption to the nanowatt to microwatt level, further reducing the harvesting power requirements of the sentry domain 20.

[0059] Fourth, anisotropic heat distribution and skin-contact insulation: An anisotropic heat distribution plate (such as a graphite film or a micro heat distribution plate) can be installed inside the thermally conductive potting compound 42. Its in-plane thermal conductivity is much greater than its normal thermal conductivity. The power amplifier device 19 of the cellular communication module 12 first diffuses the burst heat laterally along the in-plane through the heat distribution plate and then transfers it to the phase change heat storage body 41, shortening the local temperature rise of the hot spot. At the same time, a heat insulation layer (such as aerogel or other low thermal conductivity materials) is set between the skin-contact surface and the power amplifier device 19 to conduct the heat under the burst condition of uploading for tens of seconds away from the skin-contact surface. This works in conjunction with the latent heat absorption of the phase change heat storage body 41 to take into account both full power uploading and skin-contact surface temperature rise suppression under full potting protection. During uploading, the transmission of the satellite communication unit 33 or the cellular communication module 12 can also be pulsed and duty-free controlled according to the upper limit of the junction temperature to keep the peak junction temperature below the derating point. Fifth, dual-redundant and physically separated evidence storage: In addition to the non-volatile evidence storage 24 and the near-field communication tag chip 25, a second non-volatile evidence storage and a second near-field communication tag chip can be provided. These two are located deep inside the watch case 1 and physically separated from the watch strap 2 or the back cover 3. The sentry controller 21 simultaneously writes the tamper-proof status change record, time information, and the truncation value of the rolling digest value into the two non-volatile evidence storages mentioned above. Even if the device suffers partial or instantaneous damage that destroys one of them, the other can still be passively read through the corresponding near-field communication tag chip. The last evidence anchor point can also be redundantly fixed in the non-volatile storage area of ​​each near-field communication tag chip. Sixth, local anti-tampering log: The evidence records in the non-volatile evidence storage 24 can be written once and stored in an append-only log structure that links the message authentication codes one by one. This makes the local records themselves tamper-proof and mutually corroborates the rolling digest value anchored in the cloud.

[0060] Seventh, anti-suppression communication degradation and adaptation: When the device detects interference characteristics such as abnormal loss of network registration status accompanied by abnormal increase in radio frequency noise level, it reports interference indication information to the cloud server 50 and can switch the broadcast of sentry beacons to frequency hopping or spread spectrum mode to improve anti-suppression capability; when the cellular link is suppressed, the minimum distress data packet is uploaded via a non-terrestrial network (NTN) satellite link supporting multiple constellations (such as via satellite communication unit 33). The cloud server 50 uses the signaling received via frequency hopping or spread spectrum sentry beacons or via non-terrestrial network satellite links as the basis for determining the abnormal survival status. During low-risk periods with a long heartbeat deadline, the device can enter cellular IoT power saving mode (PSM) or extended discontinuous reception (eDRX) deep sleep and be woken up to send heartbeats when the deadline is approaching, thereby reducing communication power consumption without sacrificing detection latency in high-risk situations. Eighth, a zero static power consumption tamper latch: The sentry domain 20 can be equipped with a tamper latch, which is a passive holding device such as a passive magnetic latching switch or a bistable mechanical switch. When the watch strap 2 is cut, the back cover 3 is pried, or the external magnetic field changes according to a certain condition, the mechanical energy of the destructive action itself or the change in the magnetic field directly flips the state and sets a non-volatile flag. The sentry controller 21 is in deep sleep under normal conditions, and the static current of its tamper monitoring branch can be as low as nanoamps. It is only awakened when the hardware event caused by the flipping of the tamper latch occurs, thereby minimizing the standby power consumption of the tamper monitoring and leaving as much harvesting energy as possible for the broadcast of the sentry beacon. The tamper latch is on duty with near-zero power consumption before the destruction occurs, which complements the evidence writing in Embodiment 3, which is powered by the piezoelectric element 31 and completes the event solidification at the moment of destruction. Ninth, irreversible evidence of low-temperature attack: Low temperature is a known means of paralyzing electrochemical batteries. To preserve evidence of this, in addition to the phase change heat storage body 41, the thermally conductive potting compound 42 may also contain a low-temperature indicator phase change material with a phase change temperature below a set low-temperature threshold (e.g., below 0°C). During normal use, it maintains its initial phase state. Once the device is placed in an environment below this threshold (e.g., immersion in liquid nitrogen or freezing), an irreversible phase change occurs (e.g., crystallization or irreversible discoloration). This change can be identified visually or by reading circuitry afterward, thus recording that the device has suffered a low-temperature attack. The low-temperature indicator phase change material and the phase change heat storage body 41 have different phase change points, each with its own function and are not mutually exclusive. Both are housed within the thermally conductive potting compound 42 without adding any additional structural parts. All of the above can be implemented without changing the overall architecture and drawings of the aforementioned embodiments.

[0061] The embodiments of the present invention have been described in detail above, but the content described is only a preferred embodiment of the present invention and should not be considered as limiting the scope of the present invention. All equivalent variations and modifications made within the scope of the claims of the present invention should still fall within the patent coverage of the present invention.

Claims

1. A self-powered emergency assistance device for evidence collection, comprising a watch case (1), a watch strap (2) connected to the watch case (1), an openable back cover (3), and a main power domain (10) disposed within the watch case (1), wherein the main power domain (10) comprises a main controller (11), a cellular communication module (12), a storage module (13), and a main battery (14), wherein the cellular communication module (12) and the storage module (13) are both electrically connected to the main controller (11), and the main battery (14) supplies power to the main power domain (10); characterized in that, Also includes: Sentinel domain (20) is set within the casing (1). Sentinel domain (20) includes a sentinel controller (21), an energy harvesting unit (22), an energy storage capacitor (23), a non-volatile forensic memory (24), a near-field communication tag chip (25), a wireless beacon unit (26), an anti-tamper status monitoring circuit (27), and a real-time clock (28). The energy harvesting unit (22) includes at least one of a thermoelectric generator (221), a photovoltaic unit (222), and a kinetic energy harvesting unit (223). The cell (22) supplies power to the sentinel domain (20) via the energy storage capacitor (23); the power supply rails of the sentinel domain (20) and the main power domain (10) are independent of each other, and the two domains transmit information bidirectionally through the isolation interface (29). The isolation interface (29) is configured to prevent overcurrent, overvoltage or ground potential fluctuations on the side of the main power domain (10) from being conducted to the sentinel domain (20) through the isolation interface (29), so that the power supply of the sentinel domain (20) is not affected when the main battery (14) is short-circuited, removed or damaged. The main controller (11) is configured to continuously calculate the rolling digest value of the evidence data temporarily stored in the storage module (13) and transmit the rolling digest value to the sentinel controller (21) via the isolation interface (29). The anti-tamper status monitoring circuit (27) is electrically connected to the sentry controller (21) and is used to monitor the anti-tamper status of the emergency assistance device; a piezoelectric element (31) is provided inside the strap (2) and / or at the buckle of the back cover (3). The piezoelectric element (31) is connected to the energy storage capacitor (23) via the rectifier energy storage circuit (32). When the strap (2) is cut or torn, or the back cover (3) is pried open, the electrical pulse generated by the piezoelectric element (31) due to mechanical strain is fed into the energy storage capacitor via the rectifier energy storage circuit (32). The circuit (23) wakes up the sentry controller (21), and the electrical pulse provides at least enough power for the sentry controller (21) to write the current tampering event and the corresponding time information into the non-volatile evidence storage (24); the tampering event signal output by the tampering status monitoring circuit (27) is also transmitted from the sentry domain (20) to the main controller (11) via the isolation interface (29), and the main controller (11) is configured to respond to the tampering event signal and initiate the preemptive upload of the evidence data temporarily stored in the storage module (13); The sentry controller (21) is configured to write the time information output by the real-time clock (28) and the anti-tamper status change record output by the anti-tamper status monitoring circuit (27) into the non-volatile evidence memory (24), and periodically broadcast an encrypted sentry beacon via the wireless beacon unit (26). The payload of the sentry beacon includes device identification ciphertext, monotonically increasing count, and the truncated value of the rolling digest value most recently received via the isolation interface (29). After the main power domain (10) completely fails, the sentry controller (21) is powered by the energy harvesting unit (22) and the energy storage capacitor (23) to maintain the writing and broadcasting, and the broadcast uses the truncated value last received before the failure. The near-field communication tag chip (25) is connected to or integrated with the non-volatile evidence storage (24) and has a passive reading interface. The data in the non-volatile evidence storage (24) can be passively read by an external reading device through the near-field communication tag chip (25) when the entire emergency assistance device is powered off.

2. The self-powered evidence collection emergency assistance device according to claim 1, characterized in that: The sentinel controller (21) is also configured to acquire waveform characteristics of the electrical pulse, the waveform characteristics including at least one of rise time, peak amplitude, oscillation frequency and pulse train interval; the sentinel controller (21) classifies the current tampering event as one of cutting, prying or smashing based on the matching result of the waveform characteristics and the pre-stored damage type feature template, and writes the classification result together with the time information into the non-volatile evidence memory (24) and loads the sentinel beacon that will be broadcast subsequently.

3. The self-powered emergency assistance device for evidence collection according to claim 1, characterized in that, The energy harvesting unit (22) includes a thermoelectric generator (221) attached to the skin-contact surface of the emergency assistance device. The output of the thermoelectric generator (221) is also used as a basis for detecting the wearing status: when the output of the thermoelectric generator (221) decays according to the set characteristics or does not conform to the thermal characteristics of the human body, the emergency assistance device is determined to be out of wearing status by the sentry controller (21) or by the main controller (11) when the main power domain (10) is powered. The set characteristics include the characteristic that the output of the thermoelectric generator (221) decays exponentially according to its thermal time constant after the device is out of wearing.

4. The self-powered emergency assistance device for evidence collection according to claim 1, characterized in that, The main power domain (10) also includes a backup power supply (15) and a power switching circuit (16). The main battery (14) and the backup power supply (15) both supply power to the main controller (11), the storage module (13) and the cellular communication module (12) through the power switching circuit (16) and are isolated from each other. The power switching circuit (16) is configured to be powered by the backup power supply (15) when the main battery (14) is interrupted, so as to complete the data upload in the storage module (13). At least the main controller (11), the cellular communication module (12), the storage module (13) and the backup power supply (15) are all located in a thermally conductive potting body (42). The thermally conductive potting body (42) is provided with a phase change heat storage body (41) that is in thermal contact with the power amplification device (19) of the cellular communication module (12).

5. The self-powered emergency assistance device for evidence collection according to claim 4, characterized in that, It also includes a satellite communication unit (33) connected to the main controller (11); the main controller (11) is configured to perform multi-level degraded transmission based on remaining power and channel availability when it is necessary to preemptively upload evidence data temporarily stored in the storage module (13): when the cellular link is available, the evidence data is uploaded via the cellular communication module (12); when the cellular link is unavailable but the satellite link is available, the minimum distress data packet containing at least location information and event type is sent via the satellite communication unit (33) in the form of satellite short message; when the satellite link is also unavailable, the encrypted sentry beacon is forwarded by the surrounding relay terminal via low-power wireless broadcast and / or broadcast by the sentry domain (20); the power and channel conditions required for each layer of transmission decrease sequentially, and the capacity of the backup power supply (15) is determined according to the power required to ensure that the minimum distress data packet is delivered once.

6. The self-powered emergency assistance device for evidence collection according to claim 1, characterized in that, The main controller (11) is configured to encrypt locally stored background evidence in segments according to the forward security key chain and encode it into background evidence fragments through erasure coding; the sentinel domain (20) is configured to distribute the background evidence fragments opportunistically via the wireless beacon unit (26) using sentinel beacons, and when the tamper protection status monitoring circuit (27) detects a tampering event, to issue a tamper witness token containing the signature and time of the tampering event using the private key held by the sentinel domain (20) and broadcast it via the wireless beacon unit (26); the distribution and issuance and broadcasting of the tamper witness token performed by the sentinel domain (20) are maintained by the energy harvesting unit (22) and the energy storage capacitor (23) after the main power domain (10) fails.

7. A method for determining anomalies in a self-powered emergency assistance device for evidence collection, applied to a cloud server, based on the self-powered emergency assistance device for evidence collection according to any one of claims 1 to 6, characterized in that, Includes the following steps: Receive heartbeat signaling sent by the emergency assistance device during normal operation. The heartbeat signaling carries the latest deadline for the next heartbeat determined by the emergency assistance device based on the local risk assessment results, as well as the rolling digest value continuously calculated by the emergency assistance device for its locally rolled temporary evidence data. The cloud server retains the rolling digest value and uses the latest deadline carried by the most recently received heartbeat signaling as the timeout criterion. If a normal shutdown signal is received from the emergency assistance device before the heartbeat signal is interrupted, then the normal shutdown signal is authenticated. If no new heartbeat signal is received after the latest deadline has expired and the set buffer period has elapsed, and no properly authenticated stop signal has been received before the interruption (i.e., no signal was received, or the signal was received but not authenticated), the emergency assistance device is determined to be abnormally disconnected, and a warning notification is pushed to the terminal corresponding to the emergency contact person pre-bound to the emergency assistance device. If a normal shutdown signal is received before the interruption, the emergency assistance device is determined to have stopped operating normally, and no warning notification of the abnormal disconnection is pushed. During the interruption of the heartbeat signaling or after the abnormal disconnection is determined, if an encrypted sentinel beacon originating from the sentinel domain (20) of the emergency help device is received via the relay terminal, the device identifier and monotonically increasing count in the sentinel beacon payload are verified to exclude replay. The emergency help device is determined to be in an abnormal survival state where the main power supply fails or communication is suppressed but the device survives, and is handled differently from the abnormal disconnection. The cloud server also refreshes the approximate location trajectory of the emergency help device according to the approximate location reported by the relay terminal, and changes the state of the emergency help device to an abnormal disconnection state after the sentinel beacon disappears. The truncated value of the rolling digest value carried in the payload is extracted and compared with the remaining rolling digest value. The rolling digest value that matches the comparison is determined as the last evidence anchor point. Upon receiving evidence data uploaded by the emergency assistance device or subsequently read from the emergency assistance device, the integrity and timing of the evidence data are verified based on the retained rolling summary value and the last evidence anchor point. The verification results are then sent out along with the warning notification, or retained only when the device is determined to be in normal shutdown mode.

8. The method for determining anomalies in a self-powered emergency assistance device according to claim 7, characterized in that, The latest deadline carried in the heartbeat signaling is a deadline value determined by the emergency assistance device after making a local risk assessment based on at least one of its movement status, time period, location information and physiological parameters. The latest deadline is shortened when the risk increases and extended when the risk decreases. The method further includes: receiving interference indication information reported by the emergency assistance device before the heartbeat signaling is interrupted, wherein the interference indication information is generated by the emergency assistance device when it detects interference characteristics such as abnormal loss of network registration status and abnormal increase in radio frequency noise level; the cloud server uses the interference indication information received before the interruption as a weighted condition for determining the abnormal disconnection or the abnormal survival status.

9. The method for determining anomalies in a self-powered emergency assistance device according to claim 7, characterized in that, The cloud server retains the background evidence data that the emergency assistance device uploads in advance when it is initially judged locally to be suspected of being damaged. Only after the abnormal disconnection or abnormal survival status is determined and the integrity and timing verification are passed, will the background evidence data be sent to the terminal corresponding to the emergency contact along with the warning notification.

10. The method for determining anomalies in a self-powered emergency assistance device according to claim 7, characterized in that, The method further includes: receiving and storing the encrypted evidence data uploaded by the emergency assistance device after being encrypted with an evidence key; the evidence key is split into at least three key fragments through threshold secret sharing, the cloud server holds one key fragment, and the remaining key fragments are held by the terminal corresponding to the emergency assistance device and the emergency contact, respectively, and the key fragment held by any single party is insufficient to decrypt the evidence data; the cloud server only combines the key fragment it holds with the key fragment received from the terminal corresponding to the emergency contact to recover the evidence key after determining that there is an abnormal disconnection or an abnormal survival state, decrypts the evidence data, and sends it out with the warning notification.

11. A self-powered emergency assistance system for evidence collection, based on a self-powered emergency assistance device for evidence collection according to any one of claims 1 to 6, comprising an emergency assistance device, a cloud server, a relay terminal, and a terminal corresponding to an emergency contact, characterized in that, in: The emergency assistance device is configured to encrypt locally stored background evidence in segments according to a forward security key chain and encode it into background evidence fragments through erasure coding, distribute the background evidence fragments opportunistically using sentinel beacons, and issue a destruction witness token containing the signature and time of the destruction event with its private key when a destruction event is detected. The relay terminal is configured to forward the received background evidence fragments and the destruction witness token to the cloud server without decryption; The cloud server is configured to retain the background evidence fragments but not decrypt them, wherein the fragment decryption key required to decrypt the background evidence fragments is split through threshold secret sharing, and the sum of the key fragments held by the cloud server and the terminal corresponding to the emergency contact is insufficient to reach the decryption threshold, and the destruction witness token carries one key fragment necessary for the threshold; The cloud server is also configured to, only after determining that the emergency assistance device is in an abnormal survival state or an abnormal disconnection state and receiving the destruction witness token, use the key fragment carried by the destruction witness token, together with the key fragment submitted by itself and the terminal corresponding to the emergency contact, to synthesize the fragment decryption key, decrypt and correct the remaining background evidence fragments, and reconstruct them, and send the reconstructed background evidence before destruction to the terminal corresponding to the emergency contact along with the warning notification.

Images