Wireless fine time measurement authentication
A Fine Time Measurement (FTM) authentication system and method include performing a FTM transaction comprising at least one FTM-ACK message pair transmitted and received via a first communication channel between two endpoints, where the at least one FTM-ACK message pair contains timestamp values of message departure time and message arrival time during the FTM transaction. At least one authenticating value indicative of timestamp values of the at least one FTM-ACK message pair arrival and departure times during the FTM transaction is then transmitted via a second communication channel. FTM timestamp values are recovered from the received at least one authenticating value, which are compared with the received FTM timestamp values. The received FTM timestamp values can be authenticated if there is a match between the recovered FTM timestamp values and the received FTM timestamp values.
1 . A method, comprising:
receiving, via a first communication channel, a first fine time measurement (FTM) message including a departure timestamp of a previous FTM message and an arrival timestamp of a previous acknowledgement (ACK) message corresponding to the previous FTM message;
sending, via the first communication channel, a corresponding first ACK message in response to receiving the first FTM message;
receiving, via a second communication channel, an authenticating value indicative of the time of departure and arrival timestamp values of at least the first FTM message and at least the first corresponding ACK messages; and
authenticating the first FTM and ACK time of departure and arrival timestamps in response to evaluating the authenticating value, comprising:
recovering the departure and arrival timestamp values from the received authenticating value;
comparing the recovered timestamp values with observed FTM-ACK time of departure and arrival timestamps; and
authenticating the time of departure and arrival timestamps in response to a match between the compared timestamp values.
2 . The method of claim 1 , wherein receiving the authenticating value via a second communication channel comprises receiving a hash value of the timestamp values via a secure side channel.
3 . The method of claim 1 , wherein receiving the authenticating value via the second communication channel comprises receiving the authenticating value after transmission of each ACK message in response to receiving an FTM message, the authenticating value indicative of timestamp values of the FTM and ACK message arrival and departure times.
4 . The method of claim 1 , wherein receiving the authenticating value via the second communication channel comprises receiving the authenticating value after transmission of each ACK message in response to receiving an FTM message, the authenticating value indicative of a hash value of the FTM and ACK message arrival and departure timestamps.
5 . The method of claim 4 , wherein authenticating the first FTM and ACK time of departure and arrival timestamps comprises:
determining the departure and arrival timestamp values from the received hash value;
comparing the recovered timestamp values with observed FTM-ACK time of departure and arrival timestamps; and
authenticating the time of departure and arrival timestamps in response to a match between the compared timestamp values.
6 . The method of claim 1 , wherein receiving the authenticating value via the second communication channel comprises receiving the authenticating value at an FTM initiator.
7 . The method of claim 1 , wherein receiving the authenticating value via the second communication channel comprises receiving the authenticating value at an FTM responder.
8 . A device, comprising:
a transceiver; and
a processor coupled to the transceiver, the processor configurable to:
receive, via the transceiver over a first communication channel, a first fine time measurement (FTM) message including a previous FTM message departure timestamp and a previous corresponding acknowledgement (ACK) message arrival timestamp;
transmit, via the transceiver over the first communication channel, a corresponding first ACK message in response to receiving the first FTM message;
receive, via the transceiver over a second communication channel, a hash value indicative of the time of departure and arrival timestamp values of at least the first FTM message and at least the first corresponding ACK messages, wherein the second communication channel is a secure side channel; and
evaluate the hash value and authenticate the first FTM and ACK time of departure and arrival timestamps based on evaluating the hash value.
9 . The device of claim 8 , wherein the processor is further configurable to:
recover the departure and arrival timestamp values from the hash value;
compare the recovered timestamp values with observed FTM-ACK time of departure and arrival timestamps; and
authenticate the time of departure and arrival timestamps in response to a match between the compared timestamp values.
10 . The device of claim 8 , wherein receiving the hash value via a second communication channel comprises receiving the hash value after transmission of each FTM-ACK message pair indicative of timestamp values of the FTM and ACK message arrival and departure times.
11 . The device of claim 8 , wherein receiving the hash value via a second communication channel comprises receiving the hash value at an FTM responder.
12 . The device of claim 8 , wherein receiving the hash value via a second communication channel comprises receiving the hash value at an FTM initiator.
13 . A non-transitory computer-readable storage medium having encoded thereon a computer-executable method comprising:
receiving, via a first communication channel, a first fine time measurement (FTM) message including previous FTM message departure timestamp and previous corresponding acknowledgement (ACK) message arrival timestamp;
sending, via the first communication channel, a corresponding first ACK message in response to receiving the first FTM message;
receiving, via the first communication channel, a second FTM message including time of departure timestamp of the first FTM message and a time of arrival timestamp for the corresponding first ACK message;
sending, via the first communication channel, a corresponding second ACK message in response to receiving the second FTM message;
receiving, via a second communication channel, an authenticating value after transmission of each FTM-ACK message pair indicative of timestamp values of FTM and ACK message arrival and departure times, the authenticating value indicative of the time of departure and arrival timestamp values of at least one of the first and second FTM messages and at least one of the first and second corresponding ACK messages; and
authenticating the time of departure and arrival timestamps in response to evaluating the authenticating value.
14 . The non-transitory computer-readable storage medium of claim 13 , the method further comprising:
recovering the timestamp values from the received authenticating value;
comparing the recovered timestamp values with observed FTM-ACK time of departure and arrival timestamps; and
authenticating the time of departure and arrival timestamps in response to a match between the compared timestamp values.
15 . The non-transitory computer-readable storage medium of claim 13 , wherein receiving the authenticating value via the second communication channel comprises receiving a hash value of the timestamp values via a secure side channel.
16 . The non-transitory computer-readable storage medium of claim 13 , wherein receiving the authenticating value via the second communication channel comprises receiving the authenticating value from an FTM initiator to an FTM responder.
17 . The non-transitory computer-readable storage medium of claim 13 , wherein receiving the authenticating value via the second communication channel comprises receiving the authenticating value from an FTM responder to an FTM initiator.