Enterprise-level knowledge base information query system and method based on HMAC
An enterprise-level knowledge base information query system that combines HMAC signatures and a large language model solves the problems of access control and retrieval security in enterprise-level knowledge bases, realizes dynamic access control and information integrity protection, and improves security and user experience.
Patent Information
- Application Number
- CN202610004187.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-05
- Publication Date
- 2026-04-03
AI Technical Summary
Enterprise-level knowledge bases suffer from issues such as over-authorization and tampering with retrieval links in access control, leading to security and compliance risks.
HMAC is used to sign user accounts and passwords to generate user tokens, and the security and integrity of the query process are ensured by verifying the signature packets twice, combined with a large language model and role-based access control.
It implements dynamic access control, prevents information leakage and tampering, improves the security and accuracy of information transmission, and enhances user experience and compliance.
Smart Images
Figure CN121786186A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security technology, and in particular to an enterprise-level knowledge base information query system and method based on HMAC. Background Technology
[0002] In the process of enterprises promoting digital transformation, knowledge bases are increasingly becoming a key core platform for internal information management and supporting intelligent decision-making. They enable unified storage and management of various enterprise documents, regulations, R&D materials, and customer files, providing strong support for internal employees to retrieve, learn, and reuse knowledge.
[0003] Unlike consumer-grade search engines, enterprise-grade knowledge bases face the following prominent challenges in practical applications: On the one hand, there's the dilemma of "dynamic least privilege" caused by cross-departmental role differences. Employees in different departments have strict restrictions on the types of documents they can access. For example, finance personnel are only authorized to access documents related to budgets and expenses; human resources personnel can only view documents related to employee performance and training; and R&D personnel need to access documents such as design specifications and technical reports. If traditional static role tables or unified token-based access control methods are used, over-authorization is very likely to occur. Taking a user querying "team training expenses for this quarter" as an example, the system might accidentally return contract attachments containing employee privacy information due to improper access control, which undoubtedly poses a potential risk to the company.
[0004] On the other hand, the multi-hop retrieval chain raises concerns about the "trusted transmission" risks. The retrieval process in enterprise knowledge bases is typically complex, involving multiple stages: first, semantic parsing to accurately identify the user's query intent; then, vectorizing the documents for similarity matching; and finally, calling the indexing service to retrieve relevant documents from the document storage. Due to the lengthy retrieval chain, without effective integrity protection measures, any intermediate step could be tampered with, leading to forged search results and posing security and compliance risks. Summary of the Invention
[0005] The purpose of this application is to provide an enterprise-level knowledge base information query system and method based on HMAC, which can improve the security of information transmission between the client and the knowledge base.
[0006] To achieve the above objectives, this application provides the following solution.
[0007] Firstly, this application provides an enterprise-level knowledge base information query system based on HMAC, including: a client, an authentication module, a large language interaction module, and a knowledge base module; The client is used to obtain the user's account, password, and retrieval request; The authentication module is connected to the client and is used to receive the account and password, and to sign the account and password using HMAC based on a cryptographic hash verification algorithm to generate a user token, and then return the user token to the client. The large language interaction module is connected to the client and is used to receive retrieval requests and user tokens, generate a query plan based on the retrieval request using a first large language model, and sign the query plan and the user token using HMAC to obtain a first signature packet; the first large language model is obtained by training the large language model using sample retrieval requests and corresponding sample query plans; the first signature packet includes the query plan, the user token, and a first signature value; The knowledge base module is connected to the large language interaction module and is used to receive the first signature packet and verify the first signature packet using HMAC. The authentication module is also connected to the knowledge base module. After the first signature packet verification is passed, it queries the query plan and the user token based on the role-based access control method to obtain the document whitelist and returns the document whitelist to the knowledge base module. The knowledge base module is further configured to perform vectorized matching on the document whitelist, the query plan, and the user token to obtain an original document set, and to use HMAC to sign the original document set and the user token to obtain a second signature package; the second signature package includes the original document set, the user token, and the second signature value. The large language interaction module is also used to receive the second signature packet and verify the second signature packet using HMAC. After the verification is successful, the module generates query results based on the original document set using the second large language model and returns the query results to the client. The second large language model is obtained by training the large language model using a whitelist of sample documents and the corresponding sample query results.
[0008] Secondly, this application provides an enterprise-level knowledge base information query method based on HMAC, including: Obtain the user's account, password, and search request through the client; The authentication module receives the account and password, and uses HMAC to sign the account and password based on a cryptographic hash verification algorithm to generate a user token, which is then returned to the client. The system receives retrieval requests and user tokens through a large language interaction module, generates a query plan based on the retrieval request using a first large language model, and signs the query plan and user token using HMAC to obtain a first signature packet. The first large language model is trained using sample retrieval requests and corresponding sample query plans. The first signature packet includes the query plan, user token, and first signature value. The first signature packet is received through the knowledge base module, and HMAC is used to verify the first signature packet. After the first signature packet verification is successful, the authentication module queries the query plan and the user token using the role-based access control method to obtain the document whitelist, and then returns the document whitelist to the knowledge base module. The document whitelist, the query plan, and the user token are vectorized and matched using the knowledge base module to obtain the original document set. The original document set and the user token are then signed using HMAC to obtain a second signature packet. The second signature packet includes the original document set, the user token, and the second signature value. The second signature packet is received by the large language interaction module, and HMAC is used to verify the second signature packet. After the verification is successful, the second large language model is used to generate query results based on the original document set, and the query results are returned to the client. The second large language model is obtained by training the large language model using the sample original document set and the corresponding sample query results.
[0009] According to the specific embodiments provided in this application, this application has the following technical effects: In this application, during each retrieval request, the authentication module uses a cryptographic hash verification algorithm and HMAC (Hash-based Message Authentication Code) to sign the user's account and password, generating a user token. This allows the user's access permissions to be precisely located throughout the entire query process between the client and the knowledge base module, avoiding the over-authorization problem caused by traditional static permissions or unified tokens and preventing the leakage of messages within the knowledge base. At the same time, HMAC is used to perform encryption and verification twice, once on the client and once on the knowledge base module, to further prevent information tampering and improve the security of the content in the signature packet, thereby enhancing the security of information transmission between the client and the knowledge base module. Attached Figure Description
[0010] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0011] Figure 1 This is a schematic diagram of a module of an enterprise-level knowledge base information query system based on HMAC, provided as an embodiment of this application.
[0012] Figure 2 This is a flowchart illustrating the workflow between modules of an enterprise-level knowledge base information query system based on HMAC, provided as an embodiment of this application.
[0013] Figure 3 This is a flowchart illustrating an HMAC-based enterprise knowledge base information query method provided in one embodiment of this application.
[0014] Figure label: Client-1; Authentication module-2; RBAC engine-21; User authentication unit-22; Large language interaction module-3; Request processor-31; First signature manager-32; Knowledge base module-4; API adapter-41; Second signature manager-42; Recaller-43. Detailed Implementation
[0015] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0016] Definitions: Hash-based Message Authentication Code (HMAC) is a mechanism that combines cryptographic hash functions with shared keys to achieve message authentication. In this application, HMAC utilizes an integrity check code generated by a "secure hash + message authentication algorithm" to detect tampering.
[0017] Role-Based Access Control (RBAC) is an access control mechanism that manages permissions through role assignment.
[0018] User token: An encrypted token issued after login, serving as the unique identity credential for all subsequent requests.
[0019] Query plan: The knowledge base retrieval plan generated after the large language interaction module parses the user's intent.
[0020] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0021] In one exemplary embodiment, such as Figure 1 and Figure 2 As shown, an enterprise-level knowledge base information query system based on HMAC is provided. The system includes: client 1, authentication module 2, big language interaction module 3, and knowledge base module 4.
[0022] Client 1 is used to obtain the user's account, password, and retrieval request.
[0023] The authentication module 2, connected to client 1, receives the account and password, and uses HMAC to sign the account and password based on a cryptographic hash verification algorithm to generate a user token, and then returns the user token to client 1.
[0024] Specifically, HMAC uses the HMAC-SHA256 algorithm.
[0025] The large language interaction module 3 is connected to the client 1. It is used to receive retrieval requests and user tokens, generate a query plan based on the retrieval request using the first large language model, and sign the query plan and user token using HMAC to obtain the first signature packet. The first large language model is trained by using sample retrieval requests and corresponding sample query plans. The first signature packet includes the query plan, user token and first signature value.
[0026] The knowledge base module 4 is connected to the large language interaction module 3. It is used to receive the first signature packet and verify the first signature packet using HMAC.
[0027] Specifically, HMAC is used to calculate the hash digest of the first signed packet to obtain the first digest value; when the first digest value and the first signature value are consistent, the verification is successful; when the first digest value and the first signature value are inconsistent, the verification is unsuccessful.
[0028] The authentication module 2 is also connected to the knowledge base module 4. After the first signature packet verification is passed, the role-based access control method is used to query the query plan and user token to obtain the document whitelist, and then return the document whitelist to the knowledge base module 4.
[0029] Knowledge base module 4 is also used to perform vectorized matching of document whitelist, query plan and user token to obtain original document set, and to sign the original document set and user token using HMAC to obtain second signature package; the second signature package includes original document set, user token and second signature value.
[0030] The large language interaction module 3 is also used to receive the second signature packet and verify the second signature packet using HMAC. After the verification is passed, the second large language model is used to generate query results based on the original document set and the query results are returned to the client 1. The second large language model is obtained by training the large language model using a whitelist of sample documents and the corresponding sample query results.
[0031] Specifically, HMAC is used to calculate the hash digest of the second signature packet to obtain the second digest value; when the second digest value is consistent with the second signature value, the verification is successful; when the second digest value is inconsistent with the second signature value, the verification is unsuccessful.
[0032] Furthermore, the authentication module 2 includes: RBAC engine 21 and user authentication unit 22.
[0033] User authentication unit 22, connected to client 1, is used to generate a user token by signing the account and password using HMAC based on a cryptographic hash verification algorithm, and then returning the user token to client 1.
[0034] The RBAC engine 21, connected to the knowledge base module 4, is used to query the query plan and user tokens using a role-based access control method, obtain the document whitelist, and return the document whitelist to the knowledge base module 4.
[0035] Furthermore, the large language interaction module 3 includes a request processor 31 and a first signature manager 32.
[0036] Request processor 31, connected to client 1, receives retrieval requests and user tokens, and generates a query plan based on the retrieval request using the first major language model.
[0037] The first signature manager 32 and the request processor 31 are used to receive the query plan and the user token, and to sign the query plan and the user token using HMAC to obtain the first signature packet.
[0038] The first signature manager 32 is also connected to the knowledge base module to receive the second signature packet and verify the second signature packet using HMAC.
[0039] The request processor 31 is also used to generate query results based on the original document set using the second largest language model after the verification is passed, and return the query results to the client 1.
[0040] Furthermore, the knowledge base module 4 includes: an API adapter 41, a second signature manager 42, and a recaller 43.
[0041] The second signature manager 42 is connected to the first signature manager 32 and is used to receive the first signature packet and verify the first signature packet using HMAC.
[0042] API adapter 41, connected to RBAC engine 21, is used to send a query plan and user token after the first signature packet verification is successful, and to receive the document whitelist and send the document whitelist to the second signature manager 42.
[0043] The recaller 43, connected to the second signature manager 42, is used to perform vectorized matching of the document whitelist, query plan and user token to obtain the original document set, and send the original document set to the second signature manager 42.
[0044] The second signature manager 42 is also used to sign the original document set, query plan and user token using HMAC to obtain a second signature package, and send the original document set to the first signature manager 32.
[0045] In one exemplary embodiment, such as Figure 3 As shown, an enterprise-level knowledge base information query method based on HMAC is provided. This method is executed by a computer device, specifically by a terminal or server alone, or by both a terminal and a server. In this embodiment, the method is described using a server as an example, and includes the following steps S1 to S6.
[0046] Step S1: Obtain the user's account, password, and retrieval request through client 1.
[0047] Step S2: Receive the account and password through the authentication module 2, and use HMAC to sign the account and password based on the cryptographic hash verification algorithm to generate a user token, and return the user token to the client 1.
[0048] Step S3: Receive the retrieval request and user token through the large language interaction module 3, generate a query plan based on the retrieval request using the first large language model, and sign the query plan and user token using HMAC to obtain the first signature packet; the first large language model is obtained by training the large language model using sample retrieval requests and corresponding sample query plans; the first signature packet includes the query plan, user token and first signature value.
[0049] Furthermore, the training process of the first large language model specifically includes: inputting the sample retrieval request into the first large language model to obtain the predicted query result; based on the predicted query result and the sample query plan, using the loss function to iteratively optimize the parameters of the large language model until the loss function reaches its minimum value or the iteration optimization rounds reach their maximum value, then stopping the iterative optimization to obtain the first large language model.
[0050] Step S4: Receive the first signature packet through knowledge base module 4 and verify the first signature packet using HMAC.
[0051] Furthermore, HMAC specifically adopts the HMAC-SHA256 algorithm.
[0052] Specifically, JWT (JSON Web Token) can be used to replace HMAC. JWT is a lightweight authentication and authorization mechanism based on JSON. It is an open standard (RFC 7519) for transmitting claims in web applications.
[0053] Furthermore, HMAC is used to verify the first signed packet, specifically including: calculating the hash digest of the first signed packet using HMAC to obtain the first digest value; when the first digest value and the first signature value are consistent, the verification is successful; when the first digest value and the first signature value are inconsistent, the verification is unsuccessful.
[0054] Step S5: After the first signature packet verification is passed by the authentication module 2, the role-based access control method queries the query plan and user token to obtain the document whitelist, and returns the document whitelist to the knowledge base module 4.
[0055] Step S6: The document whitelist, query plan and user token are vectorized and matched using the knowledge base module 4 to obtain the original document set. The original document set and user token are then signed using HMAC to obtain the second signature packet. The second signature packet includes the original document set, user token and second signature value.
[0056] Furthermore, HMAC is used to verify the second signature packet, specifically including: calculating the hash digest of the second signature packet using HMAC to obtain the second digest value; when the second digest value is consistent with the second signature value, the verification is successful; when the second digest value is inconsistent with the second signature value, the verification is unsuccessful.
[0057] Step S7: Receive the second signature packet through the large language interaction module 3, and verify the second signature packet using HMAC. After the verification is successful, generate query results based on the original document set using the second large language model, and return the query results to client 1. The second large language model is obtained by training the large language model using the sample original document set and the corresponding sample query results.
[0058] The main advantages of the HMAC-based enterprise knowledge base information retrieval system proposed in this application are as follows: 1. Each retrieval request is signed based on the user account and password to generate a user token. The user token and query plan are then used to perform the query, resulting in a document whitelist corresponding to each retrieval request. This document whitelist dynamically changes with the user account and password, achieving the minimum dynamic permissions for the document whitelist. This avoids the over-authorization problem caused by traditional static permissions or unified tokens, prevents the leakage of messages within the knowledge base, and improves security.
[0059] 2. HMAC is used to sign the query plan and user token for the first time to prevent unauthorized calls; HMAC is used to sign the original document set, query plan and user token for the second time to bind the original document set and ensure that the final result is not tampered with during transmission. The two-stage signature chain realizes end-to-end integrity protection.
[0060] 3. The large language interaction module and the knowledge base module use a large language model to perform semantic transformation on the retrieval request and the original document set, generate query plans and query results, realize the natural language parsing and vector matching mechanism of the retrieval request and the original document set, and perform vectorized matching on the document whitelist, the query plan and the user token to achieve accurate document retrieval of the original document set, taking into account both user experience and compliance.
[0061] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.
[0062] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).
[0063] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.
[0064] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0065] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. An enterprise-level knowledge base information query system based on HMAC, characterized in that, The system includes: a client, an authentication module, a large language interaction module, and a knowledge base module; The client is used to obtain the user's account, password, and retrieval request; The authentication module is connected to the client and is used to receive the account and password, and to sign the account and password using HMAC based on a cryptographic hash verification algorithm to generate a user token, and then return the user token to the client. The large language interaction module is connected to the client and is used to receive retrieval requests and user tokens, generate a query plan based on the retrieval request using a first large language model, and sign the query plan and the user token using HMAC to obtain a first signature packet; the first large language model is obtained by training the large language model using sample retrieval requests and corresponding sample query plans; the first signature packet includes the query plan, the user token, and a first signature value; The knowledge base module is connected to the large language interaction module and is used to receive the first signature packet and verify the first signature packet using HMAC. The authentication module is also connected to the knowledge base module. After the first signature packet verification is passed, it queries the query plan and the user token based on the role-based access control method to obtain the document whitelist and returns the document whitelist to the knowledge base module. The knowledge base module is further configured to perform vectorized matching on the document whitelist, the query plan, and the user token to obtain an original document set, and to use HMAC to sign the original document set and the user token to obtain a second signature package; the second signature package includes the original document set, the user token, and the second signature value. The large language interaction module is also used to receive the second signature packet and verify the second signature packet using HMAC. After the verification is successful, the module generates query results based on the original document set using the second large language model and returns the query results to the client. The second large language model is obtained by training the large language model using the sample original document set and the corresponding sample query results.
2. The enterprise-level knowledge base information query system based on HMAC according to claim 1, characterized in that, The authentication module includes: an RBAC engine and a user authentication unit; The user authentication unit is connected to the client and is used to sign the account and password using HMAC based on a cryptographic hash verification algorithm to generate a user token and return the user token to the client. The RBAC engine, connected to the knowledge base module, is used to query the query plan and the user token using a role-based access control method to obtain a document whitelist, and then return the document whitelist to the knowledge base module.
3. The enterprise-level knowledge base information query system based on HMAC according to claim 2, characterized in that, The large language interaction module includes: a request processor and a first signature manager; The request processor, connected to the client, is used to receive retrieval requests and user tokens, and to generate a query plan based on the retrieval request using a first major language model. The first signature manager, connected to the request processor and the knowledge base module, is configured to receive the query plan and the user token, and sign the query plan and the user token using HMAC to obtain a first signature packet; and to receive the second signature packet and verify the second signature packet using HMAC. The request processor is further configured to, after verification, generate query results based on the original document set using a second major language model, and return the query results to the client.
4. The enterprise-level knowledge base information query system based on HMAC according to claim 3, characterized in that, The knowledge base module includes: an API adapter, a second signature manager, and a recaller; The second signature manager, connected to the first signature manager, is used to receive the first signature packet and verify the first signature packet using HMAC; The API adapter is connected to the second signature manager and the RBAC engine. After the first signature package verification is passed, it sends the query plan and the user token to the RBAC engine, receives the document whitelist, and sends the document whitelist to the second signature manager. The recaller is connected to the second signature manager and is used to perform vectorized matching on the document whitelist, the query plan and the user token to obtain the original document set, and send the original document set to the second signature manager; The second signature manager is further configured to use HMAC to sign the original document set, the query plan, and the user token to obtain a second signature packet, and send the original document set to the first signature manager.
5. A method for querying enterprise-level knowledge base information based on HMAC, characterized in that, The method is applied to the HMAC-based enterprise knowledge base information query system described in claims 1-4, and the method includes: Obtain the user's account, password, and search request through the client; The authentication module receives the account and password, and uses HMAC to sign the account and password based on a cryptographic hash verification algorithm to generate a user token, which is then returned to the client. The system receives retrieval requests and user tokens through a large language interaction module, generates a query plan based on the retrieval request using a first large language model, and signs the query plan and user token using HMAC to obtain a first signature packet. The first large language model is trained using sample retrieval requests and corresponding sample query plans. The first signature packet includes the query plan, user token, and first signature value. The first signature packet is received through the knowledge base module, and HMAC is used to verify the first signature packet. After the first signature packet verification is successful, the authentication module queries the query plan and the user token using the role-based access control method to obtain the document whitelist, and then returns the document whitelist to the knowledge base module. The document whitelist, the query plan, and the user token are vectorized and matched using the knowledge base module to obtain the original document set. The original document set and the user token are then signed using HMAC to obtain a second signature packet. The second signature packet includes the original document set, the user token, and the second signature value. The second signature packet is received by the large language interaction module, and HMAC is used to verify the second signature packet. After the verification is successful, the second large language model is used to generate query results based on the original document set, and the query results are returned to the client. The second large language model is obtained by training the large language model using the sample original document set and the corresponding sample query results.
6. The enterprise-level knowledge base information query method based on HMAC according to claim 5, characterized in that, The HMAC specifically uses the HMAC-SHA256 algorithm.
7. The enterprise-level knowledge base information query method based on HMAC according to claim 5, characterized in that, The training process of the first major language model specifically includes: The sample retrieval request is input into the first large language model to obtain the predicted query result; Based on the predicted query results and the sample query plan, the parameters of the large language model are iteratively optimized using the loss function until the loss function reaches its minimum value or the number of iterations reaches its maximum value, at which point the iterative optimization stops, and the first large language model is obtained.
8. The enterprise-level knowledge base information query method based on HMAC according to claim 5, characterized in that, The first signed packet is verified using HMAC, specifically including: HMAC is used to calculate the hash digest of the first signature packet to obtain the first digest value; When the first digest value and the first signature value are consistent, the verification is successful. When the first digest value and the first signature value are inconsistent, it indicates that the verification fails.
9. The enterprise-level knowledge base information query method based on HMAC according to claim 5, characterized in that, The second signature packet is verified using HMAC, specifically including: The second signature packet is hashed using HMAC to obtain the second digest value. When the second digest value and the second signature value match, the verification is successful. If the second digest value and the second signature value are inconsistent, the verification fails.