Detecting MiTM via FTM

A non-transitory, computer readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform an operation, the operation comprising:

• initiating a fine timing measurement (FTM) exchange between a second station and a first station to detect or confirm a man-in-the-middle (MiTM) attack in a network in which a MiTM is positioned between the first station and a third station, wherein initiating the FTM exchange comprises sending, by the second station, a FTM request to the first station;
• and
• detecting or confirming, or both, the MiTM attack based at least in part on FTM information determined during the FTM exchange, wherein when no response to the FTM request is received by the second station and the first station is out of range of the second station, detecting or confirming the MiTM attack based at least in part on the FTM information determined during the FTM exchange comprises:
• receiving, by the second station in response to a FTM capability inquiry and over a distribution system, a FTM capability response that includes the FTM information.

A station, comprising:

• a processor;
• and
• a memory storing a program executable by the processor to perform an operation, the operation comprising:
• initiating a fine timing measurement (FTM) exchange between the station and a first station to detect or confirm a man-in-the-middle (MiTM) attack in a network in which a MiTM is positioned between the first station and a third station, wherein initiating the FTM exchange comprises sending, by the first station, a FTM request to the station;
• and
• detecting or confirming the MiTM attack based at least in part on FTM information associated with the FTM exchange, the FTM information being transmitted over a distribution system between the station and the first station or a controller associated with the first station, wherein when the FTM request is relayed by the MiTM from the first station to the station and a response to the FTM request is relayed by the MiTM from the station to the first station, and the station is out of range of the first station and wherein the station does not have an a controller associated therewith or locations of stations of the network are not known to the controller or the station, detecting or confirming the MiTM attack based at least in part on the FTM information comprises:
• determining a first distance via the FTM exchange, the first distance is a distance calculated using a direct path between the first station and the station or a distance that is less than a second distance calculated using an alternative path;
• determining, via a second FTM exchange, the second distance, the second distance is calculated using the alternative path that includes at least one node that is not the station or the first station and that is known to be longer than the direct path;
• and
• comparing the first distance with the second distance, and
• wherein when the second distance is equal to, shorter than, or within a predetermined range of the first distance as determined by the comparing, the MiTM attack is detected or confirmed.