## 5 Quality of Protection (QoP) in the Proposed Security Improvement Framework (SIF)  
We have used Quality of Protection (QoP) as quantitative metrics to assess the security features and performance of the proposed framework. Security is a key enabler of large-scale deployments of Zigbee protocol and is envisioned to provide better security than existing network solutions. In order to accomplish this goal, Zigbee security needs to be addressed in a comprehensive way to meet service provider and customer needs. By examining potential security threats to Zigbee protocols, a set of security solutions is proposed. QoP focuses the impacts of security mechanisms on system performance which demonstrate the relationship between the security policies and system performance quantitatively. The proposed solutions are based on the application layer and utilize the KY AES Encryption Key at the network layer to overcome different types of security threats in Zigbee protocols. The solutions are presented in Table 6.  
Five main security parameters are considered as the QoP parameters: authentication, confidentiality, data integrity, availability, and privacy, which are the fundamental features to offer secure and reliable services in SIF [22]. Table 7 gives the relationship between all the security solutions and the five security parameters. Security policy is considered as a combination of several solutions. We have proposed four security policies \(P\) = {\(P_{1}\), \(P_{2}\), \(P_{3}\), \(P_{4}\)}, as shown in Table 8.  
To reflect the strength of protection of each security policy in the proposed SIF, a Cumulate QoP Reward (CQR) function is defined based on the number of QoP parameters each mechanism \begin{table}
\begin{tabular}{c c c} \hline \hline
**Security Solutions** & **Description** & **Used Layer in Zigbee protocol** \\ \hline Algorithm-1 & Physical Attack Detection & Network Layer and Application \\ Algorithm-2 & Replay Attack Prevention & Network Layer and Application \\ Algorithm-3 & Flooding Attack Prevention & Network Layer and Application \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Security solutions in the proposed Security Improvement Framework (SIF). \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Security Policy** & **Description** & **Used Layer in Zigbee protocol** \\ \hline \(P_{1}\) & KY AES Encryption Key & Algorithm-1 &  
covered. According to Table 7, if \(P_{r}=\{p_{1},\,p_{2},\,\ldots\,\,\ldots\,\,,\,p_{n}\}\subseteq P,\,r=1,\,2,\, \ldots\,\,4\) is a set of security policies, then \(S=\{s_{1},\,s_{2},\,s_{3},\,s_{4},\,s_{5}\}\) is a set of security dimension. Therefore, the Cumulative Reward Function (CRF) is presented as  
\[CRF(P_{r})=\sum_{i=1}^{n}\{\omega(p_{i},s_{1})+\omega(p_{i},s_{2})+\omega(p_{i },s_{3})+\omega(p_{i},s_{4})+\omega(p_{i},s_{5})\} \tag{1}\]  
According to the definition of CRF, an effective QoP model is determined by the predefined numeric reward matrix \(\omega(P_{i},s_{j})\) which is usually chosen in an empirical way based on the characteristics of security mechanisms. A simple reference matrix of numeric rewards of all the security mechanisms and algorithms on the five dimensions is tabulated in Table 9. The numeric values provide enough flexibility to adjust according to service sensitivity and user security needs, for example, if service is sensitive in Privacy, then numeric reward of Privacy will be much higher [23]. In most cases, the values are equal to 1 if \(p_{i}\) provides benefits to \(s_{j}\), otherwise 0. Physical Attack Detection provides a guarantee about availability and all other security policies are independent of availability, therefore, its numerical value is set to 2. Using Equation (1), we have calculated the CRF of each security solution presented in Table 10. Considering CRF values of \(P_{4}\) as 100%, results are normalized. After normalizing, we got the QoP partition of seven security levels, which reflects strength of protection of each security solution in the proposed SIF.