A Three-Layer Authentication Protocol for Secure Access Control in AI-Based Enterprise Document Management Systems

AI-based enterprise document management systems increasingly integrate semantic retrieval, Retrieval-Augmented Generation (RAG), multimodal interaction, and data analytics. In such environments, protected objects extend beyond original documents to chunks, embeddings, retrieval outputs, generated responses, and analytical results. Consequently, conventional login-based or static role-based access control is insufficient. This paper proposes a three-layer authentication protocol that sequentially performs session authentication, role/permission verification, and event-based group-membership authentication. Unlike conventional group-key approaches, the proposed method uses event-specific group keys only as authentication material, not for document re-encryption. By combining forward and reverse hash chains, the protocol supports group key secrecy, forward secrecy, and backward secrecy in dynamic group environments. Security analysis shows that the protected authentication values are computationally indistinguishable from random bit strings of the same length under the stated assumptions. In addition, the efficiency analysis and prototype-based evaluation show constant-time online authentication per request, together with practical latency, throughput, and manageable membership-change overhead. Therefore, the proposed scheme provides a practical application-layer access-control architecture for AI-based enterprise document services.