## 4 Proposed Work
### Registration Phase  
Before performing any operations, a BCS must enroll all Zigbee coordinators, routers, and end devices. The trusted blockchain will create the signed certificates using a private validator key commonly used as a root of trust. Only the Trusted Permissioned Blockchain can create authentically signed certificates. Any router or edge device that holds the validator's public key can validate the signed certificate and guarantee the public key's integrity. Figure 4 shows the node joining procedure in a secure blockchain network. The registration phase is discussed below. 1. The ZED enrolls the APUF response in the Cryptographic Key Generation \((CKG)\) Function. With the help of (the CKG) function, the ZED will reconstruct the key pair \(([DP]_{k}ey,[DP]_{k}ey)\). 2. The ZED Identifier, called Device ID, is a unique identifier performed by incrementing the global counter of the manufacturer. 3. The ZED ID and its Public Key \([DP]_{k}ey\) are sent to the permissioned Blockchain System \((pBCS)\). 4. The \(pBCS\) System binds the ZED ID and PUF Public Key and creates the signed certificate using the coordinator/validator private key. 5. If the ZED enrollment is successful, then for that ZED, the same above secure procedure will be performed with the coordinator/validator registration process. The Zigbee IP Coordinator is the full-function device that can initiate a new Zigbee network and maintain the blockchain system. As per Zigbee alliance specifications, there must be a single coordinator for each Zigbee network. The end user will communicate with any ZED only through the Zigbee IP Coordinator. If a current Zigbee network has a new end device that the end user wants to add, then the user must change the network's status through Blockchain DAPps from closed to open state and send the exact request (open state) command to the coordinator. The blockchain system's smart contract will then confirm the status and modify the system's state. The coordinator authorizes the broadcast of the join response message, telling all ZD when new joining requests are allowed. This occurs when the Zigbee network transitions to an open state. On the other hand, no new devices can join the Zigbee network once it closes. Figure 4 shows the secure key exchange and authentication protocol using the APUF and blockchain systems. The process for adding a node to a secure blockchain network is as follows: Each new joiner device must follow the process to connect to a secure blockchain network using a ZR. 1. The joiner end device continuously broadcasts at the beginning of the joining procedure by broadcasting an unencrypted beacon request frame and waits for the reply message. 2. The coordinator will verify the device ID (EUID, PAN-ID) of the joining device through the blockchain's smart contract. After the verification of the smart contract, issue the permit join request to the coordinator. 3. The coordinator provides the unencrypted beacon acknowledgment for routers to join the Zigbee network. The ZR's MAC address, personal area network \((PAN)-1D\), and unencrypted beacon message coordinator public Key \(([CPu]_{k}ey)\). 4. The network declares the joiner end device as connected, but it lacks authentication. 5. The joiner end device initiates a connection with the ZR by sending an association request message-1. The ZR requests the device update from the coordinator. Once again, the smart contract will verify the device ID (EUID, PAN-ID) and generate the key pairs using the function Gen-Key \(([DPr]_{k}ey,[Dpu]_{k}ey)\) from the blockchain system. 6. The smart contract will create the signature: \(Signed(EUID||PANID||([DPr]_{k}ey,[DPu]_{k}ey)||N1||[CPu]_{k}ey)\) and sends to the ZR. The ZR replies with an Signed association response message to the joining end device. 7. The Public Key \(([CPu]_{k}ey)\) of the coordinator will be used by the joiner end device to validate the signature. 8. The coordinator's Public Key \([CPu]_{k}ey\) will be used by the joiner ZED to validate the signature. 9.