## 3 Proposed Security Improvement Framework (SIF) Using Zigbee Protocol
### Physical Attack Control Object  
Securing the Zigbee network by only securing devices' configurations is not sufficient. Therefore, removing a node from the Zigbee network is not detected by the network, specifically by the coordinator, and does not generate and send a new network key to the other devices that are still in the network. Detecting the absence of a node in the network is crucial to prevent any stolen Zigbee device from being reused, and from thus rejoining and compromising the network. To prevent any potential Physical Attack of Zigbee devices, Physical Attack Control Object is implemented. This module produces a \"Pulse Beat\" between the coordinator and the end devices that will notify the user/admin in case the coordinator does not receive any signal from the end devices. The Pulse Beat implementation is added to cover the lack of detection of missing nodes in the network by the Zigbee protocol.  
The pseudocodes used to detect Physical Attack is shown in Table 2. The Pulse Beat is an encrypted message sent by the sender repeatedly every 200 ms to indicate its presence to the receiver; in case the receiver does not receive any message in the period of 2 s, it will notify the user. Implementing the Pulse Beat will not only warn the user about a possible malfunctioning of the sender but also about its nonexistence in the network, and will prevent any possible future network attacks. In addition to the Pulse Beat implementation, we have also encrypted all the data that is to be transmitted at the application layers. If the Pulse Beat message is valid, then the receiver will make an \"HttpRequest\" to the web application that will show the admin \"No Physical Attack\". Figure 4 shows the sequence diagram of Router, Coordinator, Webserver, and Admin to detect Physical Attack in the proposed SIF. To confirm its presences in the network, the sender will send an encrypted Pulse Beat signal to the receiver every 200 ms. The receiver, in its turn, will decrypt the Pulse Beat message. When the sender becomes unavailable or the receiver does not receive any Pulse Beat signal within 2 s, the receiver will make an HttpRequest to the web application that will show the admin \"Physical attack\".  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Algorithm: Physical\_Attack\_Detect (T\_data, R\_data, P)** \\ \hline
**Data**: Transmitting data=T\_data, Receiving data=R\_data, Pulse\_bit=P, \\
**Result**: Physical Attack=P\_attack. \\ \hline (1) & Start \\ \hline (2) & Connection=Serial Communication();/*Check serial communication between router and coordinator*/ \\ \hline (3) & If connection==Fail \\ \hline (4) & Return Start; /*Step 1*/ \\ \hline (5) & End \\ \hline (6) & If connection==True then \\ \hline (7) & T\_data==Encrypt(data); /*AES 128 bit encryption*/ \\ \hline (8) & If R\_data==’P’ OR ‘H’ OR ‘L’ then /*128 bit decryption*/ \\ \hline (9) & P\_attack==No; \\ \hline (10) & Update Web(P\_attack);/*Update web page with no Physical attack data*/ \\ \hline (11) & Send Email(Admin); /*Send email to Admin notifying no Physical attack*/ \\ \hline (12) & Else \\ \hline (13) & P\_attack==Yes; \\ \hline (14) & Update Web(P\_attack);/*Update web page with Physical attack data*/ \\ \hline (15) & Send Email(Admin); /*Send email to Admin notifying Physical attack*/ \\ \hline (16) & End \\ \hline (17) & End \\ \hline \hline \end{tabular}
\end{table}
Table 2: Pseudocodes used to detect Physical Attack in the proposed SIF using Zigbee protocol.