A smart cemetery digital sacrifice management system and method

Abstract

The present application relates to the technical field of intelligent cemetery management, in particular to an intelligent cemetery digital sacrifice management system and method, which realizes real-time synchronization of operation instructions and sound and light states by establishing unique binding of a user terminal and offline sacrifice hardware, supports multi-faith sacrifice scene switching and sacrifice music playing, provides full-process services such as sacrifice archive management, commemorative goods purchase, park reservation, and intelligent reminder of matters, and enables users to complete tablet registration and trigger offline hardware feedback by scanning a code, with all data being encrypted for transmission and storage, thus solving the problems of time and space limitations of existing sacrifice services, disconnection between online and offline experiences, and scattered service processes, and providing cross-time-and-space and immersive civilized digital sacrifice services for users and improving the efficiency of cemetery digital sacrifice management.

Description

Technical Field

[0001] This invention relates to the field of smart cemetery management technology, specifically to a smart cemetery digital memorial management system and method. Background Technology

[0002] With the growing demand for cross-temporal and spatial memorial services, how to provide users who cannot attend in person with realistic, adaptable, and integrated online and offline memorial services has become a critical issue that urgently needs to be addressed in the construction of smart cemeteries. Current technologies often rely on purely virtual interfaces for online memorial services, lacking the interaction and feedback from physical offline hardware, resulting in insufficient realism and solemnity in the rituals. Offline physical memorial services are limited by time and space, preventing users from completing their rituals anytime, anywhere. Furthermore, the physical memorial tablets and lamps deployed in the cemetery cannot synchronize their status with the user's device, and the user's chosen memorial scenes and music preferences cannot be synchronized with the offline hardware. Additionally, existing solutions lack a unified memorial service system. The lack of robust record management capabilities means that users' memorial records and genealogical information cannot be stored long-term. Supporting services such as purchasing memorial goods, making appointments at the cemetery, and receiving reminders are scattered across different platforms, resulting in cumbersome user processes. Furthermore, some online memorial solutions lack privacy protection features, posing a risk of leakage of users' memorial information and personal data. Therefore, achieving real-time twin synchronization between the online user interface and offline physical memorial hardware, adapting to different memorial scenarios, integrating the entire memorial service process, and protecting user privacy are core technical challenges that urgently need to be addressed in building an immersive, cross-temporal digital memorial service. To solve this problem, we provide a smart cemetery digital memorial management system and method. Summary of the Invention

[0003] The purpose of this invention is to provide a smart cemetery digital memorial management system and method to solve the problems mentioned in the background art.

[0004] To achieve the above objectives, a smart cemetery digital memorial management system is provided, including a user interaction terminal, an on-site memorial hardware terminal, a twin data synchronization unit, an archive management unit, a memorial scene processing unit, a hardware execution unit, a business service unit, and an information service unit. The user interaction terminal is used to provide an entry point for sacrificial operations, receive user-inputted registration information, operation instructions and service requests, and display the online sacrificial interface; The on-site sacrificial hardware terminals include smart memorial tablet terminals and lotus lantern terminals deployed at the sacrificial site, which are used to present the offline sacrificial display effects and sound and light feedback; The twin data synchronization unit is used to establish a unique binding relationship between the user interaction terminal and the corresponding on-site sacrificial hardware terminal, so as to realize the online and offline real-time synchronization of operation instructions, display content and sound and light status. The archive management unit is used to store user information, information of the person being worshipped, and historical sacrificial records, and supports information retrieval and data management; The sacrificial scene processing unit has multiple sets of differentiated sacrificial scene resources built in, which are used to generate corresponding scene rendering instructions according to user selection and synchronize them to the user interaction terminal and hardware execution unit. The hardware execution unit communicates with the on-site sacrificial hardware terminal and is used to control the display status of the smart memorial tablet and the sound and light output of the lotus lamp according to the synchronization instructions. The commercial service unit is used to provide online display, transaction and payment functions for sacrificial-related products, and to complete the entire order process management; The information service unit is used to provide functions such as information inquiry for sacrificial sites, service reservation, event reminders, and cultural information inquiry.

[0005] The second objective of this invention is to provide a method for implementing a smart cemetery digital memorial management system, comprising the following steps: S1. Users enter the system by scanning the exclusive QR code of the smart memorial tablet through the interactive terminal, fill in the registration information and select the initial sacrificial scene. After submission, a twin binding relationship is established between the user's interactive terminal and the smart memorial tablet and lotus lamp on site. S2. The hardware execution unit controls the smart memorial tablet on site to play a lotus blooming animation. After the animation ends, the corresponding memorial tablet information is displayed, and the user interaction terminal simultaneously displays the online worship interface. S3. Users select or switch sacrificial scenes through interactive terminals, and send music playback, lamp lighting or service requests. The twin data synchronization unit synchronizes all operation instructions to the on-site hardware terminal in real time, controls the smart tablet to switch display content, the lotus lamp to switch lighting effects and play corresponding music, and keeps the status of the two ends consistent. S4. Users can query venue information and cultural materials through the system, make reservations for park services, purchase sacrificial goods and complete payment. The file management unit automatically records all operations and sacrificial history, and the information service unit pushes reminders on time. S5. After the user triggers the leave command, the dual-end twin binding relationship is released, the smart memorial tablet and lotus lamp on site return to standby state, and the interactive terminal returns to the system homepage.

[0006] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention achieves real-time synchronization of the user interaction terminal with offline smart memorial tablets and lotus lanterns through a twin data synchronization unit. It supports switching between sacrificial scenes and presents them simultaneously online and offline. It provides a full range of services, including long-term management of sacrificial archives, purchase of sacrificial goods, service reservations, and intelligent reminders. Users can complete the registration of the memorial tablet by scanning a code and trigger offline hardware feedback. The lotus lanterns support the playback of sacrificial music. All data is encrypted during transmission and storage and the local temporary cache is cleared after the session ends. This realizes a cross-time and space immersive digital sacrificial service, breaks the time and space limitations of sacrificial rites, enhances the realism and convenience of the sacrificial experience, and integrates the full-process service capabilities of the cemetery while protecting user privacy, thereby improving the digital service level of smart cemeteries. Attached Figure Description

[0007] Figure 1 This is an overall block diagram of the present invention; Figure 2 This is the overall flowchart of the present invention. Detailed Implementation

[0008] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0009] This invention provides a smart cemetery digital memorial management system. Please refer to [link / reference]. Figure 1 As shown, it includes a user interaction terminal, an on-site sacrificial hardware terminal, a twin data synchronization unit, an archive management unit, a sacrificial scene processing unit, a hardware execution unit, a commercial service unit, and an information service unit.

[0010] The user interaction terminal is a network-connected smart display device held by the user, providing the user with an entry point for the entire process of sacrificial rituals, receiving various registration information, operation instructions and service requests input by the user, and rendering and displaying the online sacrificial ritual interaction interface. The on-site memorial service hardware terminals include smart memorial tablet terminals and lotus lantern terminals deployed in the cemetery. The smart memorial tablet terminal integrates a display module and control circuit, while the lotus lantern terminal integrates a light-emitting module, an audio playback module, and a control circuit. The two types of terminals are used together to present the visual display effect and sound and light feedback of the offline memorial service. The twin data synchronization unit is deployed on the cloud service node to establish a unique binding relationship between the user interaction terminal and the corresponding on-site sacrificial hardware terminal, so as to realize the online and offline real-time synchronization of operation instructions, display content and sound and light status, and keep the sacrificial status of the two ends consistent throughout the process. The archive management unit connects to the cloud database to store basic user information, information related to the person being worshipped, and all historical worship records, supporting various information queries and data management operations; The sacrificial scene processing unit has multiple sets of differentiated sacrificial scene resource packages built in. The resource packages include interface materials, sound and light parameters, and ritual configuration content, which are used to generate rendering instructions for the corresponding scene according to the user's selection and distribute them synchronously to the user interaction terminal and hardware execution unit. The hardware execution unit is deployed at the local gateway of the sacrificial site and communicates with the smart memorial tablet terminal and the lotus lamp terminal via wired or wireless means. It is used to control the display content and display status of the smart memorial tablet and control the light output parameters and audio playback status of the lotus lamp according to the received synchronization instructions. The business service unit connects with the product management module and third-party payment channels to provide online display and order placement for sacrificial-related products, as well as multi-channel payment functions, and completes the entire process status management of orders from generation to delivery; The information service unit connects to the venue information database and the cultural resource database to provide functions such as information inquiry and service reservation management for sacrificial venues, as well as reminders for various matters and access to traditional cultural materials.

[0011] After the user interaction terminal is activated, users enter the sacrificial system by scanning the unique QR code printed on the surface of the smart memorial tablet. The QR code carries a unique device identifier for the corresponding smart memorial tablet. After entering the system, the tablet registration interface is displayed, receiving the ancestral hall name, the name of the worshipper, the name and kinship of the person being worshipped, and the initial sacrificial scene selection results from the user's input. After the user clicks to confirm and submit, the twin data synchronization unit generates a unique binding identifier based on the device identifier carried by the QR code, encrypts and packages all the registration information submitted by the user, and synchronizes it to the local gateway where the corresponding smart memorial tablet terminal is located. At the same time, the binding relationship is recorded in the cloud. The binding relationship is only valid during this sacrificial session, as detailed below: After the user clicks the confirmation and submission button, the operation instructions are transmitted to the twin data synchronization unit deployed in the cloud through an encrypted channel. First, the device identifier field obtained by parsing the QR code is extracted. The device identifier is a unique hardware code that is burned into the local security chip once when the smart tablet leaves the factory. Each smart tablet corresponds to a unique device identifier and cannot be tampered with after production. After extraction, the unique binding identifier generation process for this session is started.

[0012] The binding identifier is generated by integrating parameters from four dimensions: device identifier, user-side temporary fingerprint, session timestamp, and single-time random salt. The user-side temporary fingerprint is a 64-bit temporary feature value generated by the user terminal based on the device's hardware characteristics when entering the sacrificial page. The single-time random salt is a 128-bit truly random number generated independently for each submission. The binding identifier is obtained by concatenating the four parameters in a fixed order and calculating them using the following formula: , in the formula This generates a unique binding identifier, measured in bits, with a fixed length of 256 bits. A unique 128-bit device identifier for the smart memorial tablet. A 64-bit temporary fingerprint generated for the user interaction terminal. This is the Unix timestamp when the user submitted the operation, measured in seconds. A 128-bit single-use random salt is generated for this session. The random salt is generated independently for each submission and does not repeat with historical sessions. After the binding identifier is calculated, the local cache is first checked to see if the binding identifier exists in the historical binding record. If it exists, it is determined to be a replay attack request and the current request is discarded without further processing. If it does not exist, the subsequent encryption process continues. This multi-parameter fusion hash generation method can prevent the binding identifier from being forged or reused, ensuring the uniqueness and security of the binding relationship from the source of generation. The encryption and packaging process employs a hybrid encryption mechanism. First, a 128-bit temporary symmetric key is generated. This temporary symmetric key is then used to perform SM4 symmetric encryption on all user-submitted registration information to obtain the ciphertext. Next, the public key of the corresponding smart tablet is used to perform SM2 asymmetric encryption on the temporary symmetric key to obtain the key ciphertext. The smart tablet's public key is bound to the device identifier and stored in a cloud-based key database at the factory. It can only be decrypted by the private key stored in the corresponding smart tablet's local security chip. After encryption, the bound identifier, ciphertext, key ciphertext, timestamp, and a single random salt are concatenated into a complete synchronization data packet. The data packet is split into 128-byte fragments of fixed length. Each fragment independently calculates a CRC32 checksum and appends it to the end of the fragment. Synchronization timeout calculation is initiated during fragment transmission. The retransmission timeout is calculated using the following formula: , in the formula The retransmission timeout period is measured in milliseconds. As a smoothing factor, its value is fixed at 4. The historical smoothed round-trip time is measured in milliseconds, with an initial value set to 500 milliseconds. This is the deviation factor, with a fixed value of 2. The round-trip time deviation is measured in milliseconds, with an initial value of 250 milliseconds. After each fragment transmission confirmation, the round-trip time and the round-trip time deviation are updated and smoothed based on the actual round-trip time. If no confirmation is received from the local gateway after the retransmission timeout period, the corresponding fragment is automatically retransmitted. Upon arrival at the local gateway, each fragment's CRC32 checksum is first verified. If the verification passes, a confirmation is returned to the cloud; otherwise, the fragment is discarded and retransmitted. The maximum number of retransmissions is set to three. If no confirmation is received after three retransmissions, a network error is detected, and a network error message is returned to the user's terminal, guiding the user to check the network connection and resubmit. This adaptive timeout retransmission mechanism can adapt to transmission needs in different network environments, ensuring reliable transmission of data packets to the local gateway even in weak network conditions.

[0013] After the data packet is fully transmitted in fragments and passes the integrity verification of the local gateway, the local gateway first uses the private key stored in the smart tablet's local security chip to decrypt the encrypted key to obtain a temporary symmetric key. Then, it uses the temporary symmetric key to decrypt the encrypted information to obtain the plaintext information of the user's registration. After decryption, a binding confirmation signal is returned to the cloud. Upon receiving the confirmation signal, the cloud writes this binding record into its binding relationship table. The record includes the binding identifier, device identifier, user's temporary fingerprint, session start timestamp, and a single random salt. The binding relationship has a validity period of 2 hours, starting from the session start timestamp. After the validity period, the binding relationship automatically expires. Within the validity period, subsequent command transmissions between the same user's interactive terminal and the smart tablet only need to carry the binding identifier to complete authentication; there is no need to repeatedly encrypt the full registration information. During the authentication process, the cloud compares the binding identifier carried in the command. The system checks whether the binding record matches the identifier and verifies whether the current time is within the valid duration. If both checks pass, the command is forwarded to the local gateway; if either check fails, the command is deemed invalid and discarded. The binding record is automatically marked as invalid after the user triggers a leave command at the end of the session. After invalidation, the binding identifier can no longer be used for command authentication. When storing binding records in the cloud, only the hashed binding identifier and associated parameters are stored; the plaintext registration information submitted by the user is not stored. The plaintext registration information is only temporarily cached on the local gateway and is automatically overwritten and deleted after the session ends, making it unrecoverable by technical means. This design, where only the binding hash value is stored in the cloud and the plaintext is only temporarily cached locally, avoids the risk of leakage caused by large-scale storage of user privacy data in the cloud. At the same time, the binding authentication mechanism can reduce the encryption overhead of subsequent command transmission and improve the response speed of dual-end synchronization. The entire binding generation and encrypted synchronization process achieves end-to-end security protection from three levels: identifier generation, encrypted transmission, and data storage. It ensures the unique reliability of the dual-end binding relationship while taking into account transmission efficiency and user privacy protection, providing a secure and reliable authentication foundation for subsequent scene switching, music control, and hardware status synchronization.

[0014] The hardware execution unit runs on the local gateway. After receiving the encrypted registration information, it first decrypts it locally. After the local gateway receives all the fragments and confirms that all fragment verifications have passed, it first splices all the fragments in ascending order of fragment number to obtain a complete synchronization data packet. The local gateway is an edge computing gateway deployed locally in the cemetery. It communicates with all smart memorial tablets and lotus lanterns within its coverage area through the local area network. Local control commands are not transmitted through the public network.

[0015] After the data packet is assembled, the overall integrity verification of the data packet is initiated. The verification process uses the SM3 cryptographic hash algorithm to calculate the overall hash value of all contents of the data packet except for the verification field. The calculation result is compared with the pre-calculated hash value appended to the end of the data packet by the cloud. After the overall verification is passed, the different fields in the data packet are separated to obtain the binding identifier and key ciphertext, as well as the information ciphertext, timestamp, and single random salt.

[0016] After field separation, local timeliness verification is performed first. The difference between the current time of the local gateway's real-time clock and the timestamp carried in the data packet is calculated. The time difference calculation takes into account the clock offset tolerance, which is calculated through the historical deviation of the gateway's daily clock synchronization with the cloud clock. The maximum allowable time difference is calculated using the following formula: , in the formula This represents the maximum permissible time difference, with the unit of time being seconds. This represents the average time discrepancy between the gateway and cloud clocks over the past 7 days, with the time unit being seconds. The standard deviation of the clock deviation over the past 7 days is used, with the time unit being seconds. A tolerance range of 3 times the standard deviation can cover 99.7% of clock offset scenarios, avoiding the mistaken interception of legitimate requests caused by normal clock deviation. After calculating the current time difference, if the time difference is greater than the maximum allowed time difference, the data packet is determined to be an expired replay packet, and the data packet is directly discarded without performing subsequent operations. After recording the exception log, a timeliness verification failure response is returned to the cloud. If the time difference is within the allowed range, the subsequent decryption process continues.

[0017] Before decryption, a local secure channel is first established with the smart memorial tablet security chip corresponding to the device identifier. During the establishment of the secure channel, the device communication authentication code is calculated. The communication authentication code is obtained by hashing the device identifier, a single random salt, and the local area network communication key stored locally by the gateway using SM3. After receiving the authentication code, the smart memorial tablet compares it with the locally calculated authentication code. If the comparison is successful, the decryption interface of the security chip is opened. If the comparison fails, the communication port is closed and an abnormal access log is recorded.

[0018] After the secure channel is established, the gateway sends the encrypted key to the hardware security chip of the smart tablet. The private key of the smart tablet is burned into the security chip once during production and never leaves the chip. All decryption operations are completed within the hardware of the security chip. The security chip uses the internally stored SM2 private key to decrypt the encrypted key, obtaining a 128-bit temporary symmetric key. After decryption, the temporary symmetric key does not leave the security chip but is used directly within the chip for subsequent information encryption operations. After the information encryption is sent to the security chip, SM4 symmetric decryption is performed using the temporary symmetric key. After decryption, the plaintext registration information is obtained. The decryption result is verified for correctness within the chip. The verification process calculates the SM3 hash value of the binding identifier concatenated with a single random salt and compares it with the pre-stored check value within the chip. If the comparison matches, the decryption result is confirmed to be correct. The plaintext registration information is returned to the gateway's secure buffer through the internal hardware bus. The secure buffer is a physically isolated storage area in the gateway's memory, physically disconnected from the gateway's external storage and public network interface. The plaintext information is only temporarily stored in the secure buffer and is not written to any permanent storage medium. After the gateway reads the plaintext registration information from the security cache, it parses it to obtain the ancestral hall name, the name of the worshipper, the name and kinship of the person being worshipped, and the initial sacrificial scene fields. After parsing, it first generates a lotus blooming animation playback command. Before sending the command, it calculates the command transmission compensation delay within the local area network. The transmission compensation delay is calculated based on the historical round-trip time of communication between the gateway and the smart memorial tablet to ensure that the time when the command arrives at the smart memorial tablet is synchronized with the user's redirection time. The compensation delay is calculated using the following formula: , in the formula The compensation delay for instruction transmission is measured in milliseconds. This represents the average round-trip time (RTT) of the last 100 communications between the gateway and the corresponding smart memorial tablet, expressed in milliseconds. The gateway generates a base latency for the command, measured in milliseconds. After calculating the compensation latency, the gateway waits for the corresponding compensation latency duration before sending an animation playback command to the smart memorial tablet. Simultaneously, it returns a successful binding response to the user terminal, triggering the user terminal to redirect to the main sacrificial interface. After the command is sent, the gateway adds an activation record to the local binding table, containing the binding identifier, session start time, and temporary symmetric key handle. It also starts a 2-hour session timeout timer. After the timer expires, it automatically clears all plaintext data in the security buffer, deletes the activation record from the local binding table, sends a standby command to the smart memorial tablet, and terminates the dual-end binding relationship.

[0019] If any abnormal situation occurs during the decryption process, such as integrity verification failure, timeliness verification failure, authentication failure, or decryption verification failure, the gateway will immediately terminate the current process, discard all received data packets, and not send any control commands to the smart memorial tablet. At the same time, it will return the corresponding type of decryption failure response to the cloud, triggering the cloud to return an operation failure prompt to the user. The entire local decryption process achieves end-to-end security protection for registration information during the local decryption process through hardware-level key isolation, physical cache isolation, and multiple verification mechanisms. The design of private key not leaving the chip and plaintext not being written to disk can prevent the leakage of user registration information from the hardware level. The clock fault tolerance and latency compensation design can not only intercept illegal replay requests, but also ensure the synchronization of dual-end operations, providing a safe and reliable local execution environment for subsequent sacrificial interaction processes.

[0020] The display module of the smart memorial tablet terminal first plays a lotus blossoming animation of preset duration. The lotus blossoming animation is a video resource pre-stored in the smart memorial tablet storage module. The animation playback duration is set to three seconds. After the animation finishes playing, the display of the memorial tablet information interface is automatically switched. The interface content includes the ancestral hall name submitted by the user and the title and name of the deceased's relatives, along with decorative border elements corresponding to the initial scene. The smart memorial tablet has a flashing information display effect enabled by default. Users can send a command to turn off the flashing effect through the user interaction terminal. The command is transmitted to the hardware execution unit in real time through the twin data synchronization unit, controlling the smart memorial tablet to turn off the flashing effect and maintain a constantly lit display state.

[0021] The sacrificial scene processing unit has pre-set sacrificial scenes with corresponding independent interface material packages and hardware parameter configurations. Users can switch between different scene previews by swiping left and right on the scene selection interface of the user interaction terminal. The scene switching command triggered by the swiping operation is transmitted to the local gateway in real time through the twin data synchronization unit. After the user selects the final scene and stays for more than the preset time, the user interaction terminal continuously displays the complete sacrificial interface of the corresponding scene. The interface includes the background elements, offering table elements and sacrificial decoration elements of the corresponding scene. The interface continues to be displayed until the user actively triggers the leave command. After receiving the scene switching command, the hardware execution unit synchronously controls the smart tablet to switch the border decoration elements and background display elements of the corresponding scene. At the same time, it controls the lotus lamp terminal to switch the light color parameters, light brightness parameters and light flashing frequency parameters of the corresponding scene, so as to achieve the unity of online and offline scene visual effects.

[0022] The Lotus Lantern terminal's built-in storage module pre-stores four sacrificial theme music tracks. The music files are pre-burned into the Lotus Lantern terminal's local storage chip. Users can view the music list on the user interaction terminal's music control interface, send commands to select tracks, play, pause, skip tracks, or adjust volume. These commands are transmitted in real-time to the hardware execution unit via a twin data synchronization unit. The hardware execution unit generates corresponding audio control signals based on the command content and sends them to the Lotus Lantern terminal's audio playback module to execute the corresponding operations. The current music playback progress, playback status, and volume parameters are synchronized back to the user interaction terminal in real-time, maintaining consistency between the playback control interfaces on both ends.

[0023] The twin data synchronization unit employs a low-latency message queue communication mechanism when synchronizing instructions and data. The synchronization latency is calculated using the following formula: in the formula This represents the total end-to-end synchronization delay, measured in milliseconds. Network transmission latency, measured in milliseconds, is the time it takes for an instruction to travel from the user's terminal to the local gateway. It is calculated in real-time using heartbeat packets. The gateway processing latency, measured in milliseconds, is the time taken for the hardware execution unit to parse instructions and generate control signals. Hardware rendering latency, measured in milliseconds, is the time it takes for the smart tablet or lotus lamp to complete content rendering or state switching after receiving a control signal.

[0024] The total synchronization latency is controlled within 100 milliseconds to ensure that there is no noticeable delay in the feedback of offline hardware after user operation. All user privacy data is encrypted using the national cryptographic SM4 algorithm during transmission and a transparent encryption mechanism is used during storage. The permission management process is set up with a hierarchical permission management mechanism. Each user can only access the memorial tablet device and corresponding sacrificial data that they are bound to, and cannot access the binding relationship and data content of other users. After the user triggers the leave command to end the sacrificial session, the twin data synchronization unit immediately releases the dual-end binding relationship. The hardware execution unit controls the smart memorial tablet and lotus lamp on site to return to standby state and automatically clears all user registration information and operation data temporarily cached in the local gateway and hardware terminal. The cloud only retains the sacrificial history records authorized by the user for subsequent query.

[0025] After the dual-end binding is completed and the sacrificial interaction process is entered, all data written to the storage automatically triggers the transparent encryption process. Transparent encryption is a storage encryption mechanism that automatically encrypts data when it is written to the storage medium and automatically decrypts it when it is read. The encryption and decryption process is imperceptible to the upper-layer business operations.

[0026] First, a transparent encryption key is derived based on the parameters of this session. The key derivation uses the PBKDF2 cryptographic derivation algorithm. The derivation process incorporates multi-dimensional session parameters to ensure the uniqueness of the encryption key for each session. The number of key derivation iterations is dynamically calculated based on the local CPU computing power of the gateway to ensure that the key derivation time is fixed within the target range, balancing security and performance. The number of iterations is calculated using the following formula: , in the formula Let be the number of key derivation iterations, with the dimension . The time taken to derive the target from the key is measured in milliseconds and is fixed at 100 milliseconds. The average time taken for the gateway CPU to perform a single password hash iteration is measured in milliseconds. The single iteration time is calibrated by benchmark testing when the gateway starts up, and is recalibrated every 24 hours during operation to adapt to changes in computing power.

[0027] After calculating the number of iterations, the transparent encryption key is derived. The key derivation calculation uses the following formula: , in the formula The derived 256-bit transparent encryption key is expressed in bits. A unique 256-bit binding identifier generated for this session. A 64-bit temporary fingerprint generated for the user interaction terminal. A unique 128-bit device identifier for the smart memorial tablet. A 128-bit single-use random salt was generated for this session. A 64-bit global random salt is used for transparent encryption. The random salt is generated and stored in the security chip when the gateway is deployed.

[0028] After obtaining the key through derivation, all user data written to the gateway's security cache and the hardware terminal's temporary cache is used... Data is encrypted using the SM4 algorithm before being written, and automatically used when reading data. After decryption, the data is transmitted to the business module. Even if the storage medium is physically stolen, the user's plaintext data cannot be decrypted without the corresponding session key. This transparent encryption mechanism, which dynamically derives keys based on session parameters, achieves full lifecycle encryption protection for user data without increasing the response delay of business operations.

[0029] Hierarchical permission verification is performed synchronously during data storage. Permission management adopts a three-level permission division mechanism. Different levels of access subjects can only access data and functions within their authorized scope. After each operation request arrives, the permission matching degree is calculated in real time, and the access legality is verified from multiple dimensions. The permission matching degree is calculated using the following formula: , in the formula This is the permission matching score, with a matching unit of 1 and a value range of 0 to 1. This is the weight of the character features, with a fixed value of 0.5. A score is awarded based on the matching of the user's role. The score is 1 if the user's role meets the operational requirements, and 0 if it does not. The context feature weights are fixed at 0.3. For context matching scores, a score of 1 is awarded when the login location, device fingerprint, and operation time of the accessing subject all conform to the security baseline; a score of 0 is awarded if any one of these does not conform. The weights for the operational features are fixed at 0.2. The system assigns a score based on the operation type. A score of 1 is given when the requested operation type falls within the allowed range for the role, and 0 when it falls outside the range. The sum of the three weighted values ​​equals 1. When the calculated permission matching degree equals 1, the permission verification is considered successful, and the corresponding operation is allowed. If the matching degree is less than 1, the operation request is directly rejected. Access subject information and operation type are recorded, and an abnormal access log is generated and synchronized to the management end. In the permission level classification, ordinary users can only access operation permissions within their own bound session, and can send scene switching, music control, and leave commands, but cannot access any data from other sessions. Cemetery administrators can only access the online status and fault information of devices within their assigned cemetery, as well as service statistics, but cannot access user-inputted names, relationships, messages, or other private content. Maintenance personnel can only perform device restarts, firmware upgrades, and parameter configuration-related device maintenance operations, but cannot access any user-related data. This multi-dimensional weighted hierarchical permission mechanism can prevent data leakage caused by bypassing single-role verification and achieve access control under the principle of least privilege.

[0030] When a user clicks the "Leave" button on the interactive interface, a leave command is triggered. The command first undergoes permission matching verification. After successful verification, the twin data synchronization unit sends an unbinding command to the local gateway. The unbinding command is a high-priority command, and a shorter retransmission timeout is used to ensure that the command is delivered quickly. The retransmission timeout for the unbinding command is calculated using the following formula: , in the formula The timeout period for retransmission of the unbinding command, measured in milliseconds. This is the instruction priority coefficient. The coefficient for high-priority instructions is fixed at 0.5, meaning the timeout for unbinding instructions is half that of ordinary instructions. The smoothing factor is fixed at 4. The network history smoothed round-trip time is expressed in milliseconds. The deviation factor is fixed at 2. This represents the network round-trip time deviation, measured in milliseconds.

[0031] After calculating the retransmission timeout, the gateway sends unbinding and clearing commands to the smart memorial tablet, lotus lamp, and local cache module. After sending, a retransmission timer is started. If no confirmation reply is received from the corresponding module after the timeout, the command is automatically retransmitted. The maximum number of retransmissions is set to 5. If no confirmation is received after 5 retransmissions, it is determined that the network of the corresponding module is disconnected, triggering the module's local timeout automatic clearing mechanism to ensure that even if the network is interrupted, the user's temporary data will not remain for a long time.

[0032] Upon receiving the unbinding command, all hardware terminals and gateway modules first stop the currently playing music and displaying the sacrificial scene. The smart memorial tablet switches to the default standby screen, turns off the flashing effect, and the lotus lamp turns off its lighting effects and audio output, returning to standby mode. Then, they begin clearing the temporarily cached user data. This temporary data is stored in volatile memory and is cleared using a full address overwrite method. The required number of overwrite rounds is calculated based on the storage medium characteristics to ensure that the data cannot be recovered by any technical means after the overwrite is complete. The overwrite rounds are calculated using the following formula: , in the formula The data is overwritten with round numbers, the unit of which is "times", and the calculation result is rounded up. To ensure the safety factor is fixed at 2, This refers to the smallest storage unit size of a storage medium, with the unit of measurement being bytes. This refers to the size of a memory page in the storage medium, with the storage unit being bytes.

[0033] The gateway security cache is DDR memory, and the calculated overwrite round is 1. The on-chip RAM of the hardware terminal is also calculated to have 1 overwrite round. According to the calculated round, independently generated meaningless random data is written to all memory addresses that have stored user temporary data. After the overwrite is completed, the corresponding memory area is marked as reusable.

[0034] After local data is cleared, the gateway sends an unbinding completion confirmation to the cloud. Upon receiving the confirmation, the cloud immediately marks the binding relationship of this session as invalid. The invalidated binding cannot be used for any permission verification or command transmission. Then, it checks whether the user has authorized the storage of the sacrificial history. If the user has authorized storage, the desensitized information of this sacrificial ceremony will be encrypted and stored in the history archive. The desensitized information only includes the sacrificial time, the selected scene type, and the music selection record. It does not store private plaintext content such as the user's name and relationship. If the user has not authorized storage, all data related to this session will be directly deleted from the cloud.

[0035] If the user does not actively trigger the exit command, after the session expires in 2 hours, the gateway and hardware terminal will automatically trigger the same state recovery and data clearing process as if the user actively unbound the session. This avoids data residue caused by the user forgetting to log out. The entire transparent encryption, permission management, and unbinding and clearing process provides full lifecycle security protection for user data from three levels: storage encryption, access control, and data destruction. Dynamic key derivation and multi-dimensional permission verification can maximize data security without affecting the user experience. Reliable retransmission and automatic timeout clearing mechanisms can cover edge scenarios such as network anomalies, ensuring that temporary user data does not remain on the device. The cloud-based desensitized storage design not only meets the user's need to query historical sacrificial records but also protects user privacy to the greatest extent.

[0036] The archive management unit connects to a cloud-based MySQL database, providing long-term encrypted storage for every user's sacrificial ritual operation, sacrificial item purchase record, and garden service reservation record. It automatically establishes a genealogical relationship between the user and the corresponding person being worshipped, allowing users to search for related ancestral information using surname and ancestral hall keywords. It automatically records the user's frequently used address information, past selections of sacrificial scenes, and music preferences, prioritizing these preferences when the user re-enters the system. When filling in the information of the person being worshipped, the user can simultaneously enter the person's birth date and death date, as well as other commemorative dates. The information service unit has a built-in reminder trigger mechanism that scans all recorded commemorative dates, memorial tablet renewal deadlines, and user-reserved garden service dates daily. The reminder trigger time is calculated using the following formula: in the formula To remind you of the message push time, the time measurement unit is a timestamp. The target time for the event, with the time measured in timestamps. To ensure timely reminders, the unit of measurement is seconds. The reminder duration for memorial dates and renewal deadlines is set to the number of seconds corresponding to three days, while the reminder duration for in-person service appointments is set to the number of seconds corresponding to two hours. After calculating the reminder time, the reminder message is pushed to the user's interactive terminal at the corresponding time. The reminder content includes the date and type of the event, as well as a quick processing entry. Users can directly jump to the corresponding function interface by clicking the entry. The information service unit also connects to the cemetery's information publishing interface, allowing users to query the park's guide map, opening hours, funeral culture knowledge, the latest notices and announcements, and customer service inquiries online. Users can submit in-person appointment requests through the information service unit, selecting the appointment date and time slot. After submission, the appointment request is synchronized to the cemetery management terminal for review, and the review result is pushed to the user's interactive terminal in real time.

[0037] The business service unit connects to the merchandise inventory management system, displaying images, prices, and descriptions of various sacrificial souvenirs on the online store interface. After selecting items, users can choose delivery to their door or on-site placement. After submitting the order, they are redirected to the payment interface, which supports Alipay, WeChat Pay, and UnionPay. The payment status is synchronized in real time after payment, and the order information is pushed to the cemetery management terminal for further processing. After processing, the order status is updated and synchronized to the user's interactive terminal. All purchase records are automatically synchronized and stored in the user's profile. Users can view historical orders, electronic coupons, and discount coupons in their personal center, and available coupons are automatically matched for deduction when placing an order.

[0038] Please see Figure 2 As shown, the second objective of this invention is to provide a method for implementing a smart cemetery digital memorial management system, comprising the following steps: S1. Users enter the system by scanning the exclusive QR code of the smart memorial tablet through the interactive terminal, fill in the registration information and select the initial sacrificial scene. After submission, a twin binding relationship is established between the user's interactive terminal and the smart memorial tablet and lotus lamp on site. S2. The hardware execution unit controls the smart memorial tablet on site to play a lotus blooming animation. After the animation ends, the corresponding memorial tablet information is displayed, and the user interaction terminal simultaneously displays the online worship interface. S3. Users select or switch sacrificial scenes through interactive terminals, and send music playback, lamp lighting or service requests. The twin data synchronization unit synchronizes all operation instructions to the on-site hardware terminal in real time, controls the smart tablet to switch display content, the lotus lamp to switch lighting effects and play corresponding music, and keeps the status of the two ends consistent. S4. Users can query venue information and cultural materials through the system, make reservations for park services, purchase sacrificial goods and complete payment. The file management unit automatically records all operations and sacrificial history, and the information service unit pushes reminders on time. S5. After the user triggers the leave command, the dual-end twin binding relationship is released, the smart memorial tablet and lotus lamp on site return to standby state, and the interactive terminal returns to the system homepage.

[0039] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as defined by the appended claims and their equivalents.

Claims

1. A smart cemetery digital memorial management system, characterized in that, It includes a user interaction terminal, an on-site sacrificial hardware terminal, a twin data synchronization unit, an archive management unit, a sacrificial scene processing unit, a hardware execution unit, a commercial service unit, and an information service unit; The user interaction terminal is used to provide an entry point for sacrificial operations, receive user-inputted registration information, operation instructions and service requests, and display the online sacrificial interface; The on-site sacrificial hardware terminals include smart memorial tablet terminals and lotus lantern terminals deployed at the sacrificial site, used to present the offline sacrificial display effects and audio-visual feedback; The twin data synchronization unit is used to establish a unique binding relationship between the user interaction terminal and the corresponding on-site sacrificial hardware terminal, so as to realize the online and offline real-time synchronization of operation instructions, display content and sound and light status. The file management unit is used to store user information, information of the person being worshipped, and historical worship records, and supports information query and data management. The sacrificial scene processing unit has multiple sets of differentiated sacrificial scene resources built in, which are used to generate corresponding scene rendering instructions according to user selection and synchronize them to the user interaction terminal and hardware execution unit. The hardware execution unit is communicatively connected to the on-site sacrificial hardware terminal and is used to control the display status of the smart memorial tablet and the sound and light output of the lotus lamp according to the synchronization command. The commercial service unit is used to provide online display, transaction and payment functions for sacrificial-related products and to complete the entire order process management; The information service unit is used to provide functions such as information inquiry for sacrificial sites, service reservation, event reminders, and cultural information inquiry.

2. The intelligent cemetery digital memorial management system according to claim 1, characterized in that: The user interaction terminal enters the sacrificial system by scanning the unique QR code corresponding to the smart memorial tablet. It receives the ancestral hall number, the name of the sacrificial person, the name of the person being sacrificed, the kinship, and the initial sacrificial scene information entered by the user. After submission, the twin data synchronization unit generates a unique binding identifier and synchronizes the registration information to the corresponding smart memorial tablet terminal.

3. The intelligent cemetery digital memorial management system according to claim 2, characterized in that: After receiving the memorial tablet registration information, the hardware execution unit controls the smart memorial tablet terminal to play a lotus blooming animation of a preset duration. After the animation finishes playing, it switches to display the memorial tablet information interface. The flashing effect of the smart memorial tablet display can be turned off by the user sending a command through the interactive terminal.

4. The intelligent cemetery digital memorial management system according to claim 1, characterized in that: The sacrificial scene processing unit allows users to switch sacrificial scenes by swiping. The switching command is synchronized in real time through the twin data synchronization unit. The user interaction terminal displays the sacrificial scene interface selected by the user until the user triggers the leave command. The hardware execution unit synchronously controls the smart tablet to switch the display elements of the corresponding scene and controls the lotus lamp to switch the lighting parameters of the corresponding scene.

5. The intelligent cemetery digital memorial management system according to claim 1, characterized in that: The Lotus Lantern terminal has a built-in storage module that stores multiple sacrificial theme music tracks. After the hardware execution unit receives the song selection command sent by the user through the interactive terminal, it controls the Lotus Lantern terminal to play the corresponding music. It supports playback status adjustment operations, and the music playback status is synchronized with the playback interface of the user's interactive terminal in real time.

6. The intelligent cemetery digital memorial management system according to claim 1, characterized in that: The archive management unit stores every sacrificial operation, product purchase record, and service reservation record of the user, establishes a genealogical relationship between the user and the person being worshipped, supports users to query ancestral genealogical information by surname and ancestral hall name, and records the user's frequently used address and sacrificial preferences.

7. The intelligent cemetery digital memorial management system according to claim 1, characterized in that: The information service unit has a built-in reminder trigger mechanism that generates reminder messages based on the memorial date of the person being worshipped, the deadline for renewal of the memorial tablet, and the appointment service time, and pushes them to the user's interactive terminal in advance. At the same time, it supports users to query online information on the worship site, opening information, cultural knowledge, and notices.

8. The intelligent cemetery digital memorial management system according to claim 1, characterized in that: The business service unit connects to multiple third-party payment interfaces. After the user selects sacrificial goods, a payment order is generated. After the payment is completed, the order information is synchronized to the management terminal to arrange the delivery of goods or on-site placement. At the same time, the purchase record is stored in the user's profile, allowing the user to view historical orders and rights information.

9. The intelligent cemetery digital memorial management system according to claim 1, characterized in that: The twin data synchronization unit adopts a low-latency message communication mechanism to ensure the real-time synchronization of operation commands. All user data is transmitted and stored in encrypted form, and hierarchical permission management is set up. Users can only access the memorial tablets and sacrificial data bound to them. After a user triggers a leave command, the on-site sacrificial hardware terminal automatically returns to standby mode and clears the temporarily cached user operation data.

10. A method for implementing a smart cemetery digital memorial management system according to any one of claims 1-9, characterized in that: Includes the following steps: S1. Users enter the system by scanning the exclusive QR code of the smart memorial tablet through the interactive terminal, fill in the registration information and select the initial sacrificial scene. After submission, a twin binding relationship is established between the user's interactive terminal and the smart memorial tablet and lotus lamp on site. S2. The hardware execution unit controls the smart memorial tablet on site to play a lotus blooming animation. After the animation ends, the corresponding memorial tablet information is displayed, and the user interaction terminal simultaneously displays the online worship interface. S3. Users select or switch sacrificial scenes through interactive terminals, and send music playback, lamp lighting or service requests. The twin data synchronization unit synchronizes all operation instructions to the on-site hardware terminal in real time, controls the smart tablet to switch display content, the lotus lamp to switch lighting effects and play corresponding music, and keeps the status of the two ends consistent. S4. Users can query venue information and cultural materials through the system, make reservations for park services, purchase sacrificial goods and complete payment. The file management unit automatically records all operations and sacrificial history, and the information service unit pushes reminders on time. S5. After the user triggers the leave command, the dual-end twin binding relationship is released, the smart memorial tablet and lotus lamp on site return to standby state, and the interactive terminal returns to the system homepage.

Images