A computer-implemented method for securing a wireless mesh network of beacon devices, comprising: receiving, by a master beacon device and from a plurality of servant beacon devices (110a, 110b) in a mesh network, survey data comprising, for each of the servant beacon devices, a beacon device identifier and a measure to estimate a distance between proximate servant beacon devices detected by each servant beacon device, wherein the measure comprises path loss information, a received signal strength indicator, a received channel power indicator, a time of arrival, or a round trip time of proximate servant beacon devices, detected by each servant beacon device; constructing, by the master beacon device, a first virtual map of the mesh network based on the received survey, the first virtual map comprising a list of beacon devices in the mesh network identified by the beacon device identifiers and the measure detected by servant beacon devices; transmitting, by the master beacon device and to each of the plurality of servant beacon devices (110a, 110b), enrollment data comprising beacon device identifiers and corresponding measure values of proximate beacon devices to servant beacon devices, wherein the enrollment data is based on the first virtual map data and wherein the enrollment data may be retransmitted by servant beacon devices within the mesh network to reach other recipient servant beacon devices; receiving, by the master beacon device, authentication data from a plurality of servant beacon devices (110a, 110b), the authentication data comprising beacon device identifiers for servant beacon devices and the measure detected by servant beacon devices of proximate servant beacon devices; constructing, by the master beacon device, a second virtual map of the mesh network based on the received authentication data, the second virtual map comprising a list of all known beacon devices in the mesh network identified by the beacon device identifiers and the measure detected by servant beacon devices; comparing, by the master beacon device, the first virtual map to the second virtual map; and determining, by the master beacon device, that the mesh network is insecure based on identified differences between the first virtual map and the second virtual map. receiving, by a master beacon device and from a plurality of servant beacon devices (110a, 110b) in a mesh network, survey data comprising, for each of the servant beacon devices, a beacon device identifier and a measure to estimate a distance between proximate servant beacon devices detected by each servant beacon device, wherein the measure comprises path loss information, a received signal strength indicator, a received channel power indicator, a time of arrival, or a round trip time of proximate servant beacon devices, detected by each servant beacon device; constructing, by the master beacon device, a first virtual map of the mesh network based on the received survey, the first virtual map comprising a list of beacon devices in the mesh network identified by the beacon device identifiers and the measure detected by servant beacon devices; transmitting, by the master beacon device and to each of the plurality of servant beacon devices (110a, 110b), enrollment data comprising beacon device identifiers and corresponding measure values of proximate beacon devices to servant beacon devices, wherein the enrollment data is based on the first virtual map data and wherein the enrollment data may be retransmitted by servant beacon devices within the mesh network to reach other recipient servant beacon devices; receiving, by the master beacon device, authentication data from a plurality of servant beacon devices (110a, 110b), the authentication data comprising beacon device identifiers for servant beacon devices and the measure detected by servant beacon devices of proximate servant beacon devices; constructing, by the master beacon device, a second virtual map of the mesh network based on the received authentication data, the second virtual map comprising a list of all known beacon devices in the mesh network identified by the beacon device identifiers and the measure detected by servant beacon devices; comparing, by the master beacon device, the first virtual map to the second virtual map; and determining, by the master beacon device, that the mesh network is insecure based on identified differences between the first virtual map and the second virtual map.