SECURE LOCATION DIGISIGN: A PROXIMITY-ENFORCED NFC DIGITAL SIGNATURE FRAMEWORK WITH CERTIFICATE-BASED AUTHENTICATION AND HYBRID WI-FI DIRECT TRANSFER

Abstract

The increasing reliance on digital processes in business, medical, and legal settings calls for the implementation of methods for securely signing docu ments. The existing methods using remote document signing techniques have several weaknesses, which include man-in-the-middle attacks, interception, and vulnerability to network issues, but do not offer cryptographic proof of presence at the signing session. This thesis focuses on the design and experimental analysis of two in novative digital signature systems based on the concept of proximity, imple mented successively. The first of these systems, termed the Secure Location DigiSign (SLDS) system, is presented as a new certificate-based NFC dig ital signature system. This allows for interaction between the Signee mobile application working in the HCE mode and the Signer PC application con nected to a PC/SC reader through an NFC connection. The SLDS system makes use of RSA-2048 credentials and X.509 certificates provided by a CA server and embedded into tamper-proof Secure Elements residing in each of the two devices. The process of mutual authentication occurs using a mutual challenge–response procedure, followed by the encrypted communication of the documents and their RSA-SHA256 signing using the NFC link. The se curity of the SLDS mutual authentication protocol was rigorously verified using the Scyther security tool for protocols assuming the Dolev–Yao adver sary model, demonstrating its robustness against man-in-the-middle, replay, and impersonation attacks even when the number of sessions is unbounded. SLDS takes 253.5 seconds to sign a 500 KB document during one signing session, with cryptographic functions taking up 13.5 seconds of this time. However, the basic bandwidth limitations of NFC, which amount to 106 424 kbps, make pure NFC-based document transfer impractical, at least for realistic file sizes– a 5 MB document, for instance, requires more than 60 minutes. The proposed Secure Location DigiSign Enhanced (SLDS E) framework, a hybrid proximity digital signing system that designates NFC exclusively for proximity-enforced mutual authentication and Wi-Fi Direct credential exchange, and delegates any and all document transfer to a high-speed Transmission Control Protocol (TCP) channel over Wi-Fi Di rect secured with Advanced Encryption Standard 256-bit Galois/Counter 2 Mode (AES-256-GCM), utilizing the NFC-negotiated session key to enforce an end-to-end cryptographic continuity across both channels alleviates this critical bottleneck. Wi-Fi Direct credentials are delivered exclusively over the authenticated NFC channel, ensuring that physical co-location remains a mandatory prerequisite for initiating any document transfer. Experimen tal evaluation demonstrates throughput improvements of 40× to 720× over pure NFC transfer across document sizes from 200 KB to 5 MB, reducing a 500 KB signing session from 253.5 seconds to 10 seconds , a 96% reduc tion while preserving all security guarantees of the original SLDS framework including mutual authentication, proximity enforcement, and cryptographic non-repudiation. Both frameworks are evaluated against enterprise-grade security require ments and validated through a healthcare insurance prescription signing use case. The results confirm that SLDS-E constitutes a practical, secure, and high-performance solution for proximity-based digital document signing in professional environments.